# Ensure S3 buckets have server access logging enabled

- Source: https://support.icompaas.com/support/solutions/articles/a_1793292222993246-ensure-s3-buckets-have-server-access-logging-enabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224)
- Last updated: 2026-10-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that server access logging is enabled on every Amazon S3 bucket. Server access logging records detailed information about each request made to the bucket, such as the requester, the object, the action and the response status, and delivers these log records to a destination bucket that you choose.

**Rationale**

Without access logs, object reads, writes and deletions are not recorded, which makes it difficult to detect unauthorized access or data exfiltration and slows down incident response and forensic investigations. Sending server access logs to a dedicated, access-controlled log bucket with a defined retention period provides an audit trail for every bucket. For object-level visibility, these logs can be complemented with CloudTrail data events.

**Impact**

-   Provides an audit trail of all requests made to the bucket
    
-   Supports security monitoring, incident response and access reviews
    
-   Log files are stored in the destination bucket and incur standard S3 storage costs
    

**Default Value**

Server access logging is disabled by default for new S3 buckets.

**Pre-Requisites**

-   IAM permissions: s3:ListAllMyBuckets, s3:GetBucketLogging, s3:PutBucketLogging and s3:PutBucketPolicy (on the destination bucket)
    
-   A destination log bucket in the same AWS Region and account as the source bucket, which must not be the source bucket itself
    
-   The destination bucket's policy must allow the S3 logging service (logging.s3.amazonaws.com) to write log objects; the console adds this permission automatically
    

**Remediation**

**Test Plan**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon S3 console and select **Buckets**.
    
3.  Select a bucket and open the **Properties** tab.
    
4.  In the **Server access logging** section, check that logging is **Enabled**.
    
5.  Repeat for each bucket.
    
6.  If logging is disabled for any bucket, follow the implementation steps.
    

**CLI:**

List all buckets:

aws s3api list-buckets --query "Buckets\[\].Name"

Show the logging configuration of a bucket:

aws s3api get-bucket-logging --bucket <BUCKET\_NAME>

A bucket fails if the output does not contain a LoggingEnabled section (the command returns no output when logging is disabled).

**Implementation Steps**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon S3 console and select the bucket.
    
3.  Open the **Properties** tab.
    
4.  In the **Server access logging** section, choose **Edit**.
    
5.  Select **Enable** and choose the destination bucket (and optional prefix) for the logs.
    
6.  Choose **Save changes**.
    
7.  Repeat for each affected bucket.
    

**CLI:**

Enable server access logging, sending logs to the destination bucket under the logs/ prefix:

aws s3api put-bucket-logging --bucket <BUCKET\_NAME> --bucket-logging-status '{"LoggingEnabled":{"TargetBucket":"<LOG\_BUCKET\_NAME>","TargetPrefix":"logs/"}}'

**Backout Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon S3 console, select the bucket and open the **Properties** tab.
    
3.  In the **Server access logging** section, choose **Edit**.
    
4.  Select **Disable**.
    
5.  Choose **Save changes**.
    

**CLI:**

aws s3api put-bucket-logging --bucket <BUCKET\_NAME> --bucket-logging-status '{}'

Note: rolling back stops recording access to the bucket. Log files already delivered remain in the destination bucket.

**Reference**

-   [https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerLogs.html](https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerLogs.html)
    
-   [https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-server-access-logging.html](https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-server-access-logging.html)
    
-   [https://docs.aws.amazon.com/config/latest/developerguide/s3-bucket-logging-enabled.html](https://docs.aws.amazon.com/config/latest/developerguide/s3-bucket-logging-enabled.html)
    
-   [https://docs.aws.amazon.com/cli/latest/reference/s3api/put-bucket-logging.html](https://docs.aws.amazon.com/cli/latest/reference/s3api/put-bucket-logging.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.