Check ID:
Provider: AWS
Service:
Severity: MEDIUM
Categories:
Resource type:
s3_bucket_server_access_logging_enabledProvider: AWS
Service:
s3Severity: MEDIUM
Categories:
logging, forensics-readyResource type:
AwsS3BucketWhat this check verifies
Amazon S3 buckets are evaluated for server access logging configured to record access requests and deliver logs to a designated destination bucket.Risk
Without access logs, object reads, writes, and deletions may go untracked, hindering detection of unauthorized access and data exfiltration. This degrades forensic visibility, delays incident response, and weakens evidence integrity, impacting confidentiality and integrity.Recommendation
Enable server access logging and send logs to a dedicated log bucket with least privilege, retention, and monitoring. Complement with CloudTrail data events for object-level visibility. Apply defense in depth by centralizing logs and protecting them from tampering.Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
References
- https://docs.amazonaws.cn/en_us/config/latest/developerguide/s3-bucket-logging-enabled.html
- https://docs.aws.amazon.com/AmazonS3/latest/dev/security-best-practices.html
Where this check fires
This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable byCheck ID = s3_bucket_server_access_logging_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks