CloudTrail S3 bucket does not have server-access logging enabled

Severity: Low
Service: CloudTrail
Check ID: CLOUDTRAIL_BUCKET_LOGGING_DISABLED

What this check finds

The S3 bucket that stores CloudTrail logs should itself have server-access logging enabled. Without it, access to the audit log bucket — including unauthorised read or deletion attempts — is not recorded. CIS v5.0 §3.4.

Passing looks like: CloudTrail bucket has server-access logging.

How to fix it

Enable server-access logging on the CloudTrail S3 bucket, writing logs to a separate bucket.

AWS CLI

aws s3api put-bucket-logging --bucket CLOUDTRAIL_BUCKET --bucket-logging-status '{"LoggingEnabled":{"TargetBucket":"LOG_BUCKET","TargetPrefix":"cloudtrail-access/"}}'

Names in capitals are placeholders for your own resource. Review a command before you run it.

AWS console

S3 → select the CloudTrail bucket → Properties → Server access logging → Enable.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to CloudTrail S3 bucket does not have server-access logging enabled
Framework	Controls
CIS AWS Foundations Benchmark v5.0.0	3.4 Ensure that server access logging is enabled on the CloudTrail S3 bucket
PCI-DSS v4.0.1	10.3 Audit logs are protected from destruction and unauthorized modifications
SOC 2 — Trust Services Criteria	CC7.2 Security Event Monitoring
NIST SP 800-53 Rev5 (Moderate)	AU-2 Event Logging
NIST Cybersecurity Framework 2.0	PR.PS-04 Log records are generated for monitoring
ISO/IEC 27001:2022 Annex A	A.8.15 Logging

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More CloudTrail checks

All CloudTrail checks