CloudWatch Log Group is not publicly accessible

Check ID: cloudwatch_log_group_not_publicly_accessible
Provider: AWS
Service: cloudwatch
Severity: HIGH
Categories: internet-exposed, identity-access
Resource type: Other

What this check verifies

CloudWatch Log Groups with resource policies that grant access to any principal are identified. Statements using Principal:"*" or wildcard Resource that reference a log group ARN indicate that the log group is exposed through a public policy.

Risk

Public access to log groups enables unauthorized reading of logs, revealing secrets and operational metadata, harming confidentiality. If broad actions are allowed, attackers can modify subscriptions or logs, undermining integrity and disrupting availability of audit evidence.

Recommendation

Remove public access from log group resource policies. Replace Principal:"*" and Resource:"*" with narrowly scoped principals and specific ARNs. Grant only necessary actions, apply conditions to constrain use, and enforce least privilege and separation of duties with regular policy reviews.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws logs delete-resource-policy —policy-name <policy-name>

resource "aws_cloudwatch_log_resource_policy" "<example_resource_name>" {
  policy_name     = "<example_resource_name>"
  policy_document = jsonencode({
    Version   = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = { AWS = "<example_account_id>" } # FIX: restrict Principal (not "*") to avoid public access
      Action    = "logs:PutSubscriptionFilter"
      Resource  = "arn:aws:logs:<region>:<account-id>:destination:<example_resource_name>"
    }]
  })
}

Resources:
  <example_resource_name>:
    Type: AWS::Logs::ResourcePolicy
    Properties:
      PolicyName: <example_resource_name>
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: "<example_account_id>"  # FIX: restrict to specific account (not *) to prevent public access
            Action: logs:PutSubscriptionFilter
            Resource: "arn:aws:logs:<region>:<account-id>:destination:<example_resource_name>"

References

https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/iam-access-control-overview-cwl.html

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudwatch_log_group_not_publicly_accessible. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

CloudWatch log group contains no secrets in its log events CloudWatch log group meets the minimum retention period

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires