Description

Ensure that Amazon CloudWatch Logs resource policies (account-level or log-group-level) do not grant read or write access to the wildcard principal (*) or otherwise allow unauthenticated, public access to log data.

Rationale

CloudWatch Logs resource policies can be used to allow other AWS services or accounts to write to or read from log groups, but a misconfigured policy granting access to a wildcard principal would allow any AWS account, or in some misconfigurations any unauthenticated caller, to read potentially sensitive log data or inject misleading log entries. Log data often contains application details, error messages, and operational metadata that should only be accessible to authorized principals within the organization.

Impact

  • Prevents unauthorized parties from reading or tampering with log data

  • Protects potentially sensitive information contained in application and infrastructure logs

  • Requires reviewing legitimate cross-account or cross-service log delivery configurations to scope them correctly rather than removing them entirely

Default Value

CloudWatch Logs resource policies are not configured by default; access is governed by standard IAM policies unless a resource policy is explicitly added.

Pre-Requisites

  • IAM permissions to view and update CloudWatch Logs resource policies (logs:DescribeResourcePolicies, logs:PutResourcePolicy, logs:DeleteResourcePolicy)

Test Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon CloudWatch > Log groups and review any log-group-level resource policies, and separately review account-level resource policies (via the CLI: aws logs describe-resource-policies, if not shown in console).

  3. Review each policy statement's Principal and Condition elements.

  4. Verify that no statement grants access to Principal '*' without a restrictive condition (such as aws:SourceArn or aws:SourceAccount) scoping it to specific, trusted resources.

  5. If an overly permissive policy is found, follow the implementation steps.

Implementation Steps

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Identify the CloudWatch Logs resource policy granting overly broad access (via the console log group permissions, or the CLI aws logs describe-resource-policies).

  3. Edit the policy to replace the wildcard principal with the specific AWS account ID(s) or service principal(s) that legitimately need access, and add a condition (such as aws:SourceArn) to scope the grant to the specific expected source resource.

  4. Apply the updated policy using the console or aws logs put-resource-policy.

  5. Verify that legitimate log delivery or cross-account access continues to function, and that the previously overly broad access is no longer possible.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Re-apply the previous, broader resource policy using aws logs put-resource-policy if reverting is required.

Reference