CloudTrail trail destination S3 bucket has access logging enabled
cloudtrail_logs_s3_bucket_access_logging_enabled
CloudTrail trails deliver logs to an S3 bucket; this evaluates whether that bucket has S3 server access logging enabled to record requests against it.
If the destination bucket is outside the account or audit scope, a manual review is indicated.
Risk
Without access logging on the CloudTrail logs bucket, access and changes to log files lack an independent audit trail. Attackers could read, delete, or replace logs without attribution, undermining log confidentiality and integrity, and slowing incident response.
prowler aws --checks cloudtrail_logs_s3_bucket_access_logging_enabled
Recommendation
Enable S3 server access logging on the CloudTrail logs bucket and write logs to a separate, tightly controlled bucket. Apply least privilege, enable versioning, and consider Object Lock to deter tampering. Centralize monitoring to support defense-in-depth and rapid investigation.
Remediation
aws s3api put-bucket-logging --bucket <CLOUDTRAIL_BUCKET_NAME> --bucket-logging-status "{"LoggingEnabled":{"TargetBucket":"<TARGET_BUCKET_NAME>"}}"
- In the AWS Console, go to S3 and open the bucket used by your CloudTrail trail
- Select the Properties tab
- In Server access logging, click Edit
- Enable logging and choose a different destination S3 bucket for the logs
- Click Save changes
Source Code
Resource Type
AwsCloudTrailTrail