Description

Ensure that Amazon S3 server access logging is enabled on the S3 bucket to which each AWS CloudTrail trail delivers its log files. Server access logging records every request made to the bucket, such as reads, uploads and deletions of log files.

Rationale

The CloudTrail bucket holds the audit history of the account. Without server access logging on this bucket, there is no independent record of who read, deleted or replaced log files. An attacker could access or tamper with the logs without attribution, which weakens the confidentiality and integrity of the audit trail and slows incident response. Access logs should be written to a separate, tightly controlled bucket.

Impact

  • Provides an independent record of all access to CloudTrail log files

  • Supports investigations into log tampering or unauthorized access

  • Adds storage costs for the access log files in the target bucket; there is no effect on CloudTrail delivery

Default Value

Server access logging is disabled by default for new S3 buckets.

Pre-Requisites

  • IAM permissions: cloudtrail:DescribeTrails, s3:GetBucketLogging, s3:PutBucketLogging and s3:PutBucketPolicy (on the target bucket)

  • A separate target bucket for the access logs in the same region and account as the CloudTrail bucket, whose bucket policy allows the logging.s3.amazonaws.com service principal to write to it (the console adds this permission automatically)

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the CloudTrail console, select Trails and note the S3 bucket of each trail.

  3. Open the Amazon S3 console and select that bucket.

  4. Open the Properties tab and check that Server access logging is Enabled.

  5. Repeat for the bucket of each trail in each region in use.

  6. If server access logging is disabled on any of these buckets, follow the implementation steps.

CLI:

List the trails with their S3 bucket:

aws cloudtrail describe-trails --region <REGION> --query "trailList[].[Name,HomeRegion,S3BucketName]" --output table

Show the access logging configuration of the bucket:

aws s3api get-bucket-logging --bucket <CLOUDTRAIL_BUCKET_NAME>

The bucket fails if the command returns no LoggingEnabled section. If the bucket belongs to another account (for example a central logging account), check it in that account.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon S3 console and select the bucket used by the trail.

  3. Open the Properties tab and, in Server access logging, choose Edit.

  4. Select Enable.

  5. For Destination, choose a different bucket for the access logs, optionally with a prefix.

  6. Choose Save changes.

  7. Repeat for each affected CloudTrail bucket.

CLI:

Save the following as logging.json:

{"LoggingEnabled":{"TargetBucket":"<TARGET_BUCKET_NAME>","TargetPrefix":"<CLOUDTRAIL_BUCKET_NAME>/"}}

Enable server access logging on the CloudTrail bucket (the target bucket policy must already allow logging.s3.amazonaws.com to write to it):

aws s3api put-bucket-logging --bucket <CLOUDTRAIL_BUCKET_NAME> --bucket-logging-status file://logging.json

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon S3 console and select the CloudTrail bucket.

  3. Open the Properties tab and, in Server access logging, choose Edit.

  4. Select Disable.

  5. Choose Save changes.

CLI:

aws s3api put-bucket-logging --bucket <CLOUDTRAIL_BUCKET_NAME> --bucket-logging-status {}

Note: disabling access logging removes the record of who accesses the CloudTrail log files.

Reference