Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket

2.6 Logging (AWS CIS Benchmark).


S3 Bucket Access Logging generates a log that contains access records for each request made to your S3 bucket.

An access log record contains details about the request, such as the:

  • Request type
  • Resources specified in the request
  • Time and date that the request was processed.

It is recommended that bucket access logging be enabled on the CloudTrail S3 bucket.

Enable S3 bucket logging via the AWS Management Console

Step 1. Log in to the AWS Management Console and open the S3 console at https://console.aws.amazon.com/s3.

Step 2. Under "All Buckets" click on the target S3 bucket.

Step 3. Click on Properties in the top right of the console.

Step 4. Under Bucket: <s3bucket_for_cloudtrail> click on _Logging.

Step 5. To configure bucket logging:

  • Click on the Enabled checkbox.
  • Select the Target Bucket from the list.
  • Enter a Target Prefix.
  • Click Save.