AWS Cloudtrail
      Back to home
      1. CNS Policies
      2. AWS Knowledge Base
      3. AWS Cloudtrail

      CloudTrail Bucket Access Logging Disabled

      This plugin enables access logging in the CloudTrail logging bucket to detect log file manipulation

      Risk Level: MEDIUM

      Description:

      This plugin enables access logging in the CloudTrail logging bucket to detect log file manipulation. For an extra layer of auditing, CloudTrail buckets should use access logging. The additional access logs can help discover who performed the changes if the log files are destroyed or manipulated in any manner.


      Recommended Action: Enable access logging on the CloudTrail bucket from the S3 console

      About the Service :

      AWS CloudTrail is an AWS service that allows you to manage your AWS account's governance, compliance, operational, and risk auditing. In CloudTrail, actions done by a user, role, or AWS service are recorded as events. Actions made in the AWS Management Console, AWS Command Line Interface, and AWS SDKs and APIs are all considered events.

      Impact: 

      Because CloudTrail buckets contain important data, they should be secured against unwanted access. You can trace any requests made to access your CloudTrail buckets with S3 Server Access Logging enabled, and you can even limit who can edit or remove the access logs to prevent a user from covering their tracks.

      Steps to reproduce :

      1. Sign in to your AWS management console.
      2. Navigate to the CloudTrail dashboard at: https://console.aws.amazon.com/cloudtrail/
      3. On the left panel, select Trails.
      4. Click on the trail you want to examine.
      5. Under the S3 section check for the S3 bucket name.
      6. Navigate to the S3 dashboard at: https://console.aws.amazon.com/s3/
      7. Select the S3 bucket used for CloudTrail logging, then click the Properties tab from the right panel.
      8. Under Properties, check for the value of Server Access Logging.
      9. If disabled, then the logging feature is not enabled for the selected CloudTrail bucket.
      10. Repeat steps no. 4-8 for other trails in the selected AWS region as well as for other regions.

      Steps for remediation :

      1. Sign in to your AWS management console.
      2. Navigate to the CloudTrail dashboard at: https://console.aws.amazon.com/cloudtrail/
      3. On the left panel, select Trails.
      4. Click on the trail you want to examine.
      5. Under the S3 section check for the S3 bucket name.
      6. Navigate to the S3 dashboard at: https://console.aws.amazon.com/s3/
      7. Select the S3 bucket used for CloudTrail logging, then click the Properties tab from the right panel.
      8. Under Properties, scroll down to  Server Access Logging and click Edit.
      9. Click on Enable radio button and select a target bucket from the dropdown list.
      10. Click on Save changes to apply the settings.
      11. Repeat steps no. 4-10 for other trails in the selected AWS region as well as for other regions

      References: