# Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket

- Source: https://support.icompaas.com/support/solutions/articles/a_1793292192165818-ensure-s3-bucket-access-logging-is-enabled-on-the-cloudtrail-s3-bucket
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224)
- Last updated: 2026-10-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that Amazon S3 server access logging is enabled on the S3 bucket to which each AWS CloudTrail trail delivers its log files. Server access logging records every request made to the bucket, such as reads, uploads and deletions of log files.

**Rationale**

The CloudTrail bucket holds the audit history of the account. Without server access logging on this bucket, there is no independent record of who read, deleted or replaced log files. An attacker could access or tamper with the logs without attribution, which weakens the confidentiality and integrity of the audit trail and slows incident response. Access logs should be written to a separate, tightly controlled bucket.

**Impact**

-   Provides an independent record of all access to CloudTrail log files
    
-   Supports investigations into log tampering or unauthorized access
    
-   Adds storage costs for the access log files in the target bucket; there is no effect on CloudTrail delivery
    

**Default Value**

Server access logging is disabled by default for new S3 buckets.

**Pre-Requisites**

-   IAM permissions: cloudtrail:DescribeTrails, s3:GetBucketLogging, s3:PutBucketLogging and s3:PutBucketPolicy (on the target bucket)
    
-   A separate target bucket for the access logs in the same region and account as the CloudTrail bucket, whose bucket policy allows the logging.s3.amazonaws.com service principal to write to it (the console adds this permission automatically)
    

**Remediation**

**Test Plan**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the CloudTrail console, select **Trails** and note the S3 bucket of each trail.
    
3.  Open the Amazon S3 console and select that bucket.
    
4.  Open the **Properties** tab and check that **Server access logging** is **Enabled**.
    
5.  Repeat for the bucket of each trail in each region in use.
    
6.  If server access logging is disabled on any of these buckets, follow the implementation steps.
    

**CLI:**

List the trails with their S3 bucket:

aws cloudtrail describe-trails --region <REGION> --query "trailList\[\].\[Name,HomeRegion,S3BucketName\]" --output table

Show the access logging configuration of the bucket:

aws s3api get-bucket-logging --bucket <CLOUDTRAIL\_BUCKET\_NAME>

The bucket fails if the command returns no LoggingEnabled section. If the bucket belongs to another account (for example a central logging account), check it in that account.

**Implementation Steps**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon S3 console and select the bucket used by the trail.
    
3.  Open the **Properties** tab and, in **Server access logging**, choose **Edit**.
    
4.  Select **Enable**.
    
5.  For **Destination**, choose a different bucket for the access logs, optionally with a prefix.
    
6.  Choose **Save changes**.
    
7.  Repeat for each affected CloudTrail bucket.
    

**CLI:**

Save the following as logging.json:

{"LoggingEnabled":{"TargetBucket":"<TARGET\_BUCKET\_NAME>","TargetPrefix":"<CLOUDTRAIL\_BUCKET\_NAME>/"}}

Enable server access logging on the CloudTrail bucket (the target bucket policy must already allow logging.s3.amazonaws.com to write to it):

aws s3api put-bucket-logging --bucket <CLOUDTRAIL\_BUCKET\_NAME> --bucket-logging-status file://logging.json

**Backout Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon S3 console and select the CloudTrail bucket.
    
3.  Open the **Properties** tab and, in **Server access logging**, choose **Edit**.
    
4.  Select **Disable**.
    
5.  Choose **Save changes**.
    

**CLI:**

aws s3api put-bucket-logging --bucket <CLOUDTRAIL\_BUCKET\_NAME> --bucket-logging-status {}

Note: disabling access logging removes the record of who accesses the CloudTrail log files.

**Reference**

-   [https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerLogs.html](https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerLogs.html)
    
-   [https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-server-access-logging.html](https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-server-access-logging.html)
    
-   [https://docs.aws.amazon.com/securityhub/latest/userguide/cloudtrail-controls.html](https://docs.aws.amazon.com/securityhub/latest/userguide/cloudtrail-controls.html)
    
-   [https://docs.aws.amazon.com/cli/latest/reference/s3api/put-bucket-logging.html](https://docs.aws.amazon.com/cli/latest/reference/s3api/put-bucket-logging.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.