| Plugin Title | CloudTrail Bucket Access Logging |
| Cloud | AWS |
| Category | CloudTrail |
| Description | Ensures CloudTrail logging bucket has access logging enabled to detect tampering of log files |
| More Info | CloudTrail buckets should utilize access logging for an additional layer of auditing. If the log files are deleted or modified in any way, the additional access logs can help determine who made the changes. |
| AWS Link | http://docs.aws.amazon.com/AmazonS3/latest/UG/ManagingBucketLogging.html |
| Recommended Action | Enable access logging on the CloudTrail bucket from the S3 console |
- Log into the AWS Management Console.
- Select the "Services" option and search for "CloudTrail".
- In the "Dashboard" panel click on "View trails" button.
- Select the "trail" that needs to be verified under "Name" column.
- Scroll down and under the "Storage location" option check the S3 bucket used to store log data.
- Go to "Services" and search for "S3" to go into S3 buckets dashboard.
- Select the "S3 bucket" used to store data log in CloudTrail.
- Click the "Properties" tab from panel to get into Properties configuration options.
- From "Server Access Login" check if the "Enabled" checkbox is selected and if the "Disable Logging" checkbox is selected the logging feature is not enabled for the selected "CloudTrail" bucket.
- Click on "Enabled" checkbox and specify the "Target bucket" used to store data log files. Provide a "Prefix" that S3 can assign to all log object keys. Save the changes after review.
