No Public Log Access

The S3 Bucket backing Cloudtrail should be private

CloudTrail logs will be publicly exposed, potentially containing sensitive information. CloudTrail logs a record of every API call made in your account. These log files are stored in an S3 bucket. CIS recommends that the S3 bucket policy, or access control list (ACL), applied to the S3 bucket that CloudTrail logs to prevents public access to the CloudTrail logs. Allowing public access to CloudTrail log content might aid an adversary in identifying weaknesses in the affected account’s use or configuration.

Impact

Recommended Actions

Follow the appropriate remediation steps below to resolve the issue.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

Resources:
  GoodExampleBucket:
    Type: AWS::S3::Bucket
    Properties:
      AccessControl: Private
      BucketName: my-bucket

  GoodExampleTrail:
    Type: AWS::CloudTrail::Trail
    Properties:
      IsLogging: true
      S3BucketName: my-bucket
      TrailName: Cloudtrail

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

resource "aws_cloudtrail" "good_example" {
  is_multi_region_trail = true
  s3_bucket_name        = "abcdefgh"

  event_selector {
    read_write_type           = "All"
    include_management_events = true

    data_resource {
      type   = "AWS::S3::Object"
      values = ["${data.aws_s3_bucket.important-bucket.arn}/"]
    }
  }
}

resource "aws_s3_bucket" "good_example" {
  bucket = "abcdefgh"
  acl    = "private"
}

Links

• https://docs.aws.amazon.com/AmazonS3/latest/userguide/configuring-block-public-access-bucket.html