S3 bucket used for CloudTrail logs is publicly accessible

Severity: Critical
Service: CloudTrail
Check ID: CLOUDTRAIL_BUCKET_PUBLIC

What this check finds

The S3 bucket storing CloudTrail logs grants public read or write access via its ACL. Anyone on the internet can read or tamper with your audit trail, completely undermining log integrity and exposing sensitive API call history. CIS v1.4 §3.3.

Passing looks like: CloudTrail log bucket is private.

How to fix it

Remove all public grants from the CloudTrail bucket ACL.

AWS CLI

aws s3api put-bucket-acl --bucket CLOUDTRAIL_BUCKET --acl private

Then enable S3 Block Public Access at the account and bucket level to prevent future misconfiguration.

Names in capitals are placeholders for your own resource. Review a command before you run it.

AWS console

S3 → select the bucket → Permissions → Block public access → enable all four settings.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to S3 bucket used for CloudTrail logs is publicly accessible
Framework	Controls
NIST SP 800-53 Rev5 (Moderate)	AC-3 Access Enforcement AU-9 Protection of Audit Information
NIST Cybersecurity Framework 2.0	PR.AA-05 Access permissions and authorizations are enforced with least privilege PR.PS-04 Log records are generated for monitoring
ISO/IEC 27001:2022 Annex A	A.5.15 Access control A.5.28 Collection of evidence A.8.15 Logging

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More CloudTrail checks

All CloudTrail checks