Ensure that server access logging is enabled on the CloudTrail S3 bucket

高等級 1人工審核aws

說明

Server access logging generates a log that contains access records for each request made to your S3 bucket. An access log record contains details about the request, such as the request type, the resources specified in the request worked, and the time and date the request was processed. It is recommended that server access logging be enabled on the CloudTrail S3 bucket. By enabling server access logging on target S3 buckets, it is possible to capture all events that may affect objects within any target bucket. Configuring the logs to be placed in a separate bucket allows access to log information that can be useful in security and incident response workflows. In some environments (e.g., AWS Control Tower), logs may be delivered to the same bucket with appropriate prefixes, which is also an acceptable configuration.

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

Perform the following ensure that the CloudTrail S3 bucket has access logging is enabled: From Console: 1. Go to the Amazon CloudTrail console at https://console.aws.amazon.com/cloudtrail/home. 2. In the API activity history pane on the left, click Trails. 3. In the Trails pane, note the bucket names in the S3 bucket column. 4. Sign in to the AWS Management Console and open the S3 console at https://console.aws.amazon.com/s3. 5. Under All Buckets click on a target S3 bucket. 6. Click on Properties in the top right of the console. 7. Scroll down to Server access logging. 8. Ensure Server access logging is Enabled. 9. Verify the Target bucket where logs are delivered. From Command Line: 1. Get the name of the S3 bucket that CloudTrail is logging to: aws cloudtrail describe-trails --query 'trailList[*].S3BucketName' 2. Ensure logging is enabled on the bucket: aws s3api get-bucket-logging --bucket <s3-bucket-for-cloudtrail> Ensure the command does not return an empty output. Sample output for a bucket with logging enabled: { "LoggingEnabled": { "TargetPrefix": "<log-file-prefix>", "TargetBucket": "<logging-bucket>" } }

修補方式

修補方法: 操作指南或基礎設施修補檔

Perform the following to enable server access logging: From Console: 1. Sign in to the AWS Management Console and open the S3 console at https://console.aws.amazon.com/s3. 2. Under All Buckets click on the target S3 bucket. 3. Click on Properties in the top right of the console. 4. Under Server access logging, click Edit. 5. Configure bucket logging: o Check the Enabled box. o Select a Target Bucket from the list. o Enter a Target Prefix. 6. Click Save. From Command Line: 1. Get the name of the S3 bucket that CloudTrail is logging to: aws cloudtrail describe-trails --region <region-name> --query trailList[*].S3BucketName 2. Create a logging configuration file and populate the following values: { "LoggingEnabled": { "TargetBucket": "<TargetBucket>", "TargetPrefix": "<TargetPrefix>", "TargetGrants": [ { "Grantee": { "Type": "AmazonCustomerByEmail", "EmailAddress": "" }, "Permission": "FULL_CONTROL" } ] } } 3. Save the file as <file>.json 4. Apply the logging configuration: aws s3api put-bucket-logging --bucket <bucket-name> --bucket-logging-status file://<file>.json

屬性

作業系統: 不限
標籤: access-controlawscloudlogging
參考資料: CIS Amazon Web Services Foundations Benchmark v7.0.0 - 4.4 Ensure that server access logging is enabled on the CloudTrail S3 bucket