Ensure the S3 bucket used to store CloudTrail logs is not publicly accessible

How to fix it

Remove public read from the S3 bucket the named trail delivers to; the finding names the trail, so the bucket is the one in that trail's storage location. Two things fail it: an ACL grant of READ or FULL_CONTROL to the AllUsers or AuthenticatedUsers group, and a bucket policy statement allowing s3:GetObject, s3:GetObjectVersion or s3:GetObjectAcl (directly or through a wildcard such as s3:Get*) to everyone, through a Principal of * or a NotPrincipal, unless its Condition pins a key such as aws:SourceVpce or aws:SourceAccount to a fixed value, or a Deny to everyone that covers it exempts only such fixed values. Block Public Access is worth turning on but does not clear a failing policy statement: it stops one taking effect and leaves it in place. Setting the ACL back to private removes every other grant on it, and an edited policy still has to keep the statements that let CloudTrail write.

In the console

S3 → the bucket in the trail’s storage location → Permissions → Access control list, and Bucket policy

With the AWS CLI

aws s3api put-bucket-acl --bucket <log-bucket-name> --acl private

With Terraform

resource "aws_s3_bucket_acl" "this" {
  bucket = aws_s3_bucket.cloudtrail_logs.id
  acl    = "private"
}