Check ID:
Provider: AWS
Service:
Severity: CRITICAL
Categories:
Resource type:
cloudtrail_logs_s3_bucket_is_not_publicly_accessibleProvider: AWS
Service:
cloudtrailSeverity: CRITICAL
Categories:
internet-exposedResource type:
AwsS3BucketWhat this check verifies
CloudTrail log destination S3 buckets are inspected for ACL grants that expose data to the publicAllUsers group.
Buckets hosted in other accounts are flagged for out-of-scope review.
Risk
Exposed CloudTrail logs erode confidentiality and integrity. Adversaries can harvest API activity to map accounts, roles, and keys, enabling reconnaissance and evasion. If write is allowed, logs can be poisoned or deleted, thwarting investigations and compromising incident timelines.Recommendation
Apply least privilege to the log bucket:- Enable S3
Block Public Access(account and bucket) - Remove
AllUsers/AuthenticatedUsersACLs; avoid wildcard principals - Permit only CloudTrail and constrain with
aws:SourceArn
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
aws s3api put-bucket-acl —bucket <example_resource_name> —acl private
References
- https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/aws/CloudTrail/cloudtrail-bucket-publicly-accessible.html
- https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html
- https://docs.aws.amazon.com/config/latest/developerguide/cloudtrail-s3-bucket-public-access-prohibited.html
- https://docs.panther.com/alerts/alert-runbooks/built-in-policies/aws-cloudtrail-logs-s3-bucket-not-publicly-accessible
Where this check fires
This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable byCheck ID = cloudtrail_logs_s3_bucket_is_not_publicly_accessible. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks