Description

Ensure that server access logging is enabled on every Amazon S3 bucket. Server access logging records detailed information about each request made to the bucket, such as the requester, the object, the action and the response status, and delivers these log records to a destination bucket that you choose.

Rationale

Without access logs, object reads, writes and deletions are not recorded, which makes it difficult to detect unauthorized access or data exfiltration and slows down incident response and forensic investigations. Sending server access logs to a dedicated, access-controlled log bucket with a defined retention period provides an audit trail for every bucket. For object-level visibility, these logs can be complemented with CloudTrail data events.

Impact

  • Provides an audit trail of all requests made to the bucket

  • Supports security monitoring, incident response and access reviews

  • Log files are stored in the destination bucket and incur standard S3 storage costs

Default Value

Server access logging is disabled by default for new S3 buckets.

Pre-Requisites

  • IAM permissions: s3:ListAllMyBuckets, s3:GetBucketLogging, s3:PutBucketLogging and s3:PutBucketPolicy (on the destination bucket)

  • A destination log bucket in the same AWS Region and account as the source bucket, which must not be the source bucket itself

  • The destination bucket's policy must allow the S3 logging service (logging.s3.amazonaws.com) to write log objects; the console adds this permission automatically

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon S3 console and select Buckets.

  3. Select a bucket and open the Properties tab.

  4. In the Server access logging section, check that logging is Enabled.

  5. Repeat for each bucket.

  6. If logging is disabled for any bucket, follow the implementation steps.

CLI:

List all buckets:

aws s3api list-buckets --query "Buckets[].Name"

Show the logging configuration of a bucket:

aws s3api get-bucket-logging --bucket <BUCKET_NAME>

A bucket fails if the output does not contain a LoggingEnabled section (the command returns no output when logging is disabled).

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon S3 console and select the bucket.

  3. Open the Properties tab.

  4. In the Server access logging section, choose Edit.

  5. Select Enable and choose the destination bucket (and optional prefix) for the logs.

  6. Choose Save changes.

  7. Repeat for each affected bucket.

CLI:

Enable server access logging, sending logs to the destination bucket under the logs/ prefix:

aws s3api put-bucket-logging --bucket <BUCKET_NAME> --bucket-logging-status '{"LoggingEnabled":{"TargetBucket":"<LOG_BUCKET_NAME>","TargetPrefix":"logs/"}}'

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon S3 console, select the bucket and open the Properties tab.

  3. In the Server access logging section, choose Edit.

  4. Select Disable.

  5. Choose Save changes.

CLI:

aws s3api put-bucket-logging --bucket <BUCKET_NAME> --bucket-logging-status '{}'

Note: rolling back stops recording access to the bucket. Log files already delivered remain in the destination bucket.

Reference