All checks
Medium
S3 general purpose buckets should have server access logging enabled
Checks that server access logging is on for the S3 general purpose bucket, recording each request for security and access audits. The bucket that receives the logs fails too; AWS advises suppressing its finding rather than logging that bucket to itself.
- service
- S3
- severity
- Medium
- scope
- evaluated once per account
How to fix it
In the console
S3 → the bucket → Properties
With the AWS CLI
aws s3api put-bucket-logging --bucket <bucket-name> --bucket-logging-status file://logging.jsonWith Terraform
resource "aws_s3_bucket_logging" "this" {
bucket = var.bucket_name
target_bucket = var.log_bucket_name
target_prefix = "s3-access-logs/"
}See which of your accounts this check is failing on.
Book a demo