CloudTrail trail S3 bucket is not publicly accessible
cloudtrail_logs_s3_bucket_is_not_publicly_accessible
CloudTrail log destination S3 buckets are inspected for ACL grants that expose data to the public AllUsers group.
Buckets hosted in other accounts are flagged for out-of-scope review.
Risk
Exposed CloudTrail logs erode confidentiality and integrity.
Adversaries can harvest API activity to map accounts, roles, and keys, enabling reconnaissance and evasion. If write is allowed, logs can be poisoned or deleted, thwarting investigations and compromising incident timelines.
prowler aws --checks cloudtrail_logs_s3_bucket_is_not_publicly_accessible
prowler aws --checks cloudtrail_logs_s3_bucket_is_not_publicly_accessible --fixer
Recommendation
Apply least privilege to the log bucket:
- Enable S3
Block Public Access(account and bucket) - Remove
AllUsers/AuthenticatedUsersACLs; avoid wildcard principals - Permit only CloudTrail and constrain with
aws:SourceArn
Use a dedicated private bucket and monitor for permission changes.
Remediation
aws s3api put-bucket-acl --bucket <example_resource_name> --acl private
- Open the AWS S3 Console
- Select the bucket used by CloudTrail
- Go to Permissions > Access control list (ACL)
- Click Edit under Public access, remove any grants to "Everyone (public access)" (uncheck Read/Write)
- Save changes
Source Code
Resource Type
AwsS3Bucket
References
- https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/aws/CloudTrail/cloudtrail-bucket-publicly-accessible.html
- https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html
- https://docs.aws.amazon.com/config/latest/developerguide/cloudtrail-s3-bucket-public-access-prohibited.html
- https://docs.panther.com/alerts/alert-runbooks/built-in-policies/aws-cloudtrail-logs-s3-bucket-not-publicly-accessible
Depends On
- s3_bucket_public_access