S3 bucket does not have server-access logging enabled
- Severity
- Low
- Service
- S3
- Check ID
- S3_LOGGING_DISABLED
What this check finds
Without server-access logging, there is no record of who accessed objects in the bucket, what operations were performed, or from which IP address. This makes forensic investigation of data breaches impossible.
Passing looks like: S3 server-access logging enabled.
How to fix it
Enable server-access logging on the bucket and specify a target bucket and prefix.
AWS CLI
aws s3api put-bucket-logging --bucket BUCKET_NAME --bucket-logging-status '{"LoggingEnabled":{"TargetBucket":"LOG_BUCKET","TargetPrefix":"BUCKET_NAME/"}}'
Names in capitals are placeholders for your own resource. Review a command before you run it.
AWS console
S3 → Bucket → Properties → Server access logging → Enable.
Compliance controls it is evidence for
A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works
| Framework | Controls |
|---|---|
| PCI-DSS v4.0.1 |
|
| HIPAA Security Rule |
|
| NIST SP 800-53 Rev5 (Moderate) |
|
| NIST Cybersecurity Framework 2.0 |
|
| ISO/IEC 27001:2022 Annex A |
|
Checked on every scan
KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs
More S3 checks
- HighInternet accessible S3 bucket via policy
- HighPublic grant to S3 bucket via ACL
- MediumS3 bucket does not require SSL/HTTPS for all requests
- MediumS3 bucket has incomplete multipart uploads consuming storage
- LowS3 Block Public Access does not block all access types
- LowS3 Block Public Access is not enabled for the account
- LowS3 bucket with versioning enabled does not have MFA delete configured
- LowVPC with private subnets has no S3 endpoint