📝 AWS S3 Bucket Server Access Logging is not enabled 🟢

• Contextual name: 📝 Bucket Server Access Logging is not enabled 🟢
• ID: /ce/ca/aws/s3/bucket-server-access-logging
• Located in: 📁 AWS S3

Flags

• 🟢 Policy with categories
• 🟢 Policy with type
• 🟢 Production policy

Our Metadata

• Policy Type: COMPLIANCE_POLICY
• Policy Category:
  • SECURITY

Similar Policies

• AWS Trusted Advisor
  • [BueAdJ7NrP](Amazon S3 Bucket Logging (https://docs.aws.amazon.com/awssupport/latest/user/fault-tolerance-checks.html#amazon-s3-bucket-logging)]
• Cloud Conformity
  • S3 Bucket Logging Enabled
• Internal
  • dec-x-e0014333

Similar Internal Rules

Rule	Policies	Flags
✉️ dec-x-e0014333	2

Logic

• 🧠 prod.logic.yaml 🟢
  • 📕 AWS S3 Bucket
  • 🔌 AWS S3 Bucket - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

AWS S3 Server Access Logging enables you to track and analyze access to your S3 buckets, providing detailed records of requests made to the objects.

Rational

When Server Access Logging is enabled for an S3 (source) bucket, Amazon S3 starts to capture access logs and store them in a separate (destination) bucket designated for logging purposes. These logs are typically stored in a standardized format and can be easily analyzed using various AWS tools or third-party services.

The access logs generated by S3 contain information such as:

• Requester's IP Address: The IP address of the entity making the request to access the S3 bucket.
• Request Timestamp: The date and time when the request was made.
• Requested Resource: The specific object within the S3 bucket that was accessed.
• HTTP Method: The method used for the request (e.g., GET, PUT, DELETE).
• Response Status: The HTTP status code returned by S3 in response to the request.
• Bytes Sent/Received: The number of bytes sent from S3 to the requester and received by S3 from the requester.

... see more

Remediation

Open File

Remediation

Prerequisites

• The destination (target) bucket must be in the same AWS Region and AWS account as the source bucket.
• Your destination bucket should not have server access logging enabled.
• S3 buckets that have S3 Object Lock enabled can't be used as destination buckets
• The destination bucket must not have Requester Pays enabled.
• Default server-side encryption with AWS Key Management Service (AWS KMS) keys (SSE-KMS) is not supported.

From Command Line

It's recommended that you create a dedicated logging bucket in each AWS Region that you have S3 buckets in. Then have your Amazon S3 access logs delivered to that S3 bucket. Distinguish buckets from each other by adding a prefix.

Step 1. Grant permissions for server access log delivery by using a bucket policy

To grant permissions to the logging service principal, use the put-bucket-policy command. Replace {{your-log-destination-bucket}} with the name of your destination bucket.

aws s3api put-bucket-policy --bucket {{your-log-destination-bucket}} --policy file://{{policy.json}}

... [see more](remediation.md)

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 APRA CPG 234 → 💼 67a network and user profiling that establishes a baseline of normal activity which, when combined with logging and alerting mechanisms, can enable detection of anomalous activity;		18	21
💼 APRA CPG 234 → 💼 h. audit logging and monitoring of access to information assets by all users;		7	8
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [S3.9] S3 general purpose buckets should have server access logging enabled		1	2
💼 Cloudaware Framework → 💼 Logging and Monitoring Configuration			49
💼 FedRAMP High Security Controls → 💼 AC-2(4) Automated Audit Actions (M)(H)		1	13
💼 FedRAMP High Security Controls → 💼 AC-6(9) Log Use of Privileged Functions (M)(H)		7	23
💼 FedRAMP High Security Controls → 💼 AU-2 Event Logging (L)(M)(H)			6
💼 FedRAMP High Security Controls → 💼 AU-3 Content of Audit Records (L)(M)(H)	1		20
💼 FedRAMP High Security Controls → 💼 AU-6 Audit Record Review, Analysis, and Reporting (L)(M)(H)	6	21	26
💼 FedRAMP High Security Controls → 💼 AU-6(3) Correlate Audit Record Repositories (M)(H)			6
💼 FedRAMP High Security Controls → 💼 AU-6(4) Central Review and Analysis (H)			6
💼 FedRAMP High Security Controls → 💼 AU-10 Non-repudiation (H)			5
💼 FedRAMP High Security Controls → 💼 AU-11 Audit Record Retention (L)(M)(H)		17	19
💼 FedRAMP High Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)	2		47
💼 FedRAMP High Security Controls → 💼 CA-7 Continuous Monitoring (L)(M)(H)	2		8
💼 FedRAMP High Security Controls → 💼 CM-3 Configuration Change Control (M)(H)	4		21
💼 FedRAMP High Security Controls → 💼 SI-4(20) Privileged Users (H)		46	48
💼 FedRAMP Low Security Controls → 💼 AU-2 Event Logging (L)(M)(H)			6
💼 FedRAMP Low Security Controls → 💼 AU-3 Content of Audit Records (L)(M)(H)			6
💼 FedRAMP Low Security Controls → 💼 AU-6 Audit Record Review, Analysis, and Reporting (L)(M)(H)			23
💼 FedRAMP Low Security Controls → 💼 AU-11 Audit Record Retention (L)(M)(H)			19
💼 FedRAMP Low Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)			47
💼 FedRAMP Low Security Controls → 💼 CA-7 Continuous Monitoring (L)(M)(H)	1		8
💼 FedRAMP Moderate Security Controls → 💼 AC-2(4) Automated Audit Actions (M)(H)			13
💼 FedRAMP Moderate Security Controls → 💼 AC-6(9) Log Use of Privileged Functions (M)(H)			23
💼 FedRAMP Moderate Security Controls → 💼 AU-2 Event Logging (L)(M)(H)			6
💼 FedRAMP Moderate Security Controls → 💼 AU-3 Content of Audit Records (L)(M)(H)	1		20
💼 FedRAMP Moderate Security Controls → 💼 AU-6 Audit Record Review, Analysis, and Reporting (L)(M)(H)	2		26
💼 FedRAMP Moderate Security Controls → 💼 AU-6(3) Correlate Audit Record Repositories (M)(H)			6
💼 FedRAMP Moderate Security Controls → 💼 AU-11 Audit Record Retention (L)(M)(H)			19
💼 FedRAMP Moderate Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)			47
💼 FedRAMP Moderate Security Controls → 💼 CA-7 Continuous Monitoring (L)(M)(H)	2		8
💼 FedRAMP Moderate Security Controls → 💼 CM-3 Configuration Change Control (M)(H)	2		17
💼 GDPR → 💼 Art. 30 Records of processing activities		3	4
💼 ISO/IEC 27001:2013 → 💼 A.12.4.1 Event logging		16	18
💼 NIST CSF v1.1 → 💼 DE.AE-2: Detected events are analyzed to understand attack targets and methods		19	22
💼 NIST CSF v1.1 → 💼 DE.AE-3: Event data are collected and correlated from multiple sources and sensors		19	22
💼 NIST CSF v1.1 → 💼 DE.CM-1: The network is monitored to detect potential cybersecurity events		19	28
💼 NIST CSF v1.1 → 💼 DE.CM-3: Personnel activity is monitored to detect potential cybersecurity events		21	24
💼 NIST CSF v1.1 → 💼 DE.CM-7: Monitoring for unauthorized personnel, connections, devices, and software is performed		19	23
💼 NIST CSF v1.1 → 💼 DE.DP-4: Event detection information is communicated		30	33
💼 NIST CSF v1.1 → 💼 ID.SC-4: Suppliers and third-party partners are routinely assessed using audits, test results, or other forms of evaluations to confirm they are meeting their contractual obligations		16	19
💼 NIST CSF v1.1 → 💼 PR.PT-1: Audit/log records are determined, documented, implemented, and reviewed in accordance with policy		17	20
💼 NIST CSF v1.1 → 💼 RS.AN-1: Notifications from detection systems are investigated		19	22
💼 NIST CSF v1.1 → 💼 RS.CO-2: Incidents are reported consistent with established criteria		20	23
💼 NIST CSF v2.0 → 💼 DE.AE-02: Potentially adverse events are analyzed to better understand associated activities			26
💼 NIST CSF v2.0 → 💼 DE.AE-03: Information is correlated from multiple sources			26
💼 NIST CSF v2.0 → 💼 DE.AE-06: Information on adverse events is provided to authorized staff and tools			33
💼 NIST CSF v2.0 → 💼 DE.AE-07: Cyber threat intelligence and other contextual information are integrated into the analysis			22
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events			83
💼 NIST CSF v2.0 → 💼 DE.CM-02: The physical environment is monitored to find potentially adverse events			8
💼 NIST CSF v2.0 → 💼 DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events			59
💼 NIST CSF v2.0 → 💼 DE.CM-06: External service provider activities and services are monitored to find potentially adverse events			27
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events			89
💼 NIST CSF v2.0 → 💼 GV.SC-07: The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship			26
💼 NIST CSF v2.0 → 💼 ID.IM-01: Improvements are identified from evaluations			10
💼 NIST CSF v2.0 → 💼 ID.IM-02: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties			23
💼 NIST CSF v2.0 → 💼 ID.IM-03: Improvements are identified from execution of operational processes, procedures, and activities			24
💼 NIST CSF v2.0 → 💼 ID.RA-01: Vulnerabilities in assets are identified, validated, and recorded			22
💼 NIST CSF v2.0 → 💼 ID.RA-07: Changes and exceptions are managed, assessed for risk impact, recorded, and tracked			24
💼 NIST CSF v2.0 → 💼 ID.RA-10: Critical suppliers are assessed prior to acquisition			26
💼 NIST CSF v2.0 → 💼 RC.CO-04: Public updates on incident recovery are shared using approved methods and messaging			23
💼 NIST CSF v2.0 → 💼 RS.CO-02: Internal and external stakeholders are notified of incidents			30
💼 NIST CSF v2.0 → 💼 RS.MA-02: Incident reports are triaged and validated			22
💼 NIST SP 800-53 Revision 4 → 💼 AU-2 AUDIT EVENTS	4	2	3
💼 NIST SP 800-53 Revision 5 → 💼 AC-2(4) Account Management _ Automated Audit Actions		11	13
💼 NIST SP 800-53 Revision 5 → 💼 AC-4(26) Information Flow Enforcement _ Audit Filtering Actions			7
💼 NIST SP 800-53 Revision 5 → 💼 AC-6(9) Least Privilege _ Log Use of Privileged Functions		15	16
💼 NIST SP 800-53 Revision 5 → 💼 AU-2 Event Logging	4		6
💼 NIST SP 800-53 Revision 5 → 💼 AU-3 Content of Audit Records	3	13	20
💼 NIST SP 800-53 Revision 5 → 💼 AU-6(3) Audit Record Review, Analysis, and Reporting _ Correlate Audit Record Repositories			6
💼 NIST SP 800-53 Revision 5 → 💼 AU-6(4) Audit Record Review, Analysis, and Reporting _ Central Review and Analysis			6
💼 NIST SP 800-53 Revision 5 → 💼 AU-10 Non-repudiation	5		5
💼 NIST SP 800-53 Revision 5 → 💼 AU-12 Audit Record Generation	4	45	47
💼 NIST SP 800-53 Revision 5 → 💼 CA-7 Continuous Monitoring	6		8
💼 NIST SP 800-53 Revision 5 → 💼 CM-3 Configuration Change Control	8	15	21
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(9) Boundary Protection _ Restrict Threatening Outgoing Communications Traffic			7
💼 NIST SP 800-53 Revision 5 → 💼 SI-3(8) Malicious Code Protection _ Detect Unauthorized Commands			3
💼 NIST SP 800-53 Revision 5 → 💼 SI-4(20) System Monitoring _ Privileged Users			3
💼 NIST SP 800-53 Revision 5 → 💼 SI-7(8) Software, Firmware, and Information Integrity _ Auditing Capability for Significant Events			6
💼 PCI DSS v3.2.1 → 💼 10.2 Implement automated audit trails for all system components.	7	7	9
💼 PCI DSS v4.0.1 → 💼 10.2.1 Audit logs are enabled and active for all system components and cardholder data.	7		8
💼 PCI DSS v4.0 → 💼 10.2.1 Audit logs are enabled and active for all system components and cardholder data.	7		8