Back to Checks
aws

S3 bucket has server access logging enabled

s3_bucket_server_access_logging_enabled
Service: s3Severity: medium
OfficialBuilt-inVerified
Categories:loggingforensics-ready
Resource Type:AwsS3Bucket

Amazon S3 buckets are evaluated for server access logging configured to record access requests and deliver logs to a designated destination bucket.

Prowler logoProwlerprowler-provider-aws

Risk

Without access logs, object reads, writes, and deletions may go untracked, hindering detection of unauthorized access and data exfiltration. This degrades forensic visibility, delays incident response, and weakens evidence integrity, impacting confidentiality and integrity.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks s3_bucket_server_access_logging_enabled

Recommendation

Enable server access logging and send logs to a dedicated log bucket with least privilege, retention, and monitoring. Complement with CloudTrail data events for object-level visibility. Apply defense in depth by centralizing logs and protecting them from tampering.

Remediation

CLI

aws s3api put-bucket-logging --bucket <BUCKET_NAME> --bucket-logging-status '{"LoggingEnabled":{"TargetBucket":"<LOG_BUCKET>","TargetPrefix":"logs/"}}'

Terraform

resource "aws_s3_bucket_logging" "<example_resource_name>" {
  bucket        = "<example_bucket_name>"
  target_bucket = "<example_log_bucket_name>"  # CRITICAL: Enables server access logging by specifying the target bucket
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::S3::Bucket
    Properties:
      LoggingConfiguration:
        DestinationBucketName: <example_resource_id>  # CRITICAL: Enables server access logging by sending logs to this bucket

Other

1Open the AWS Management Console and go to S3
2Select the bucket with the finding
3Go to the Properties tab
4In Server access logging, click Edit
5Toggle Enable, choose the target log bucket, and Save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.s3.s3_client import s3_client


class s3_bucket_server_access_logging_enabled(Check):
    def execute(self):
        findings = []
        for bucket in s3_client.buckets.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=bucket)
            if bucket.logging:
                report.status = "PASS"
                report.status_extended = (
                    f"S3 Bucket {bucket.name} has server access logging enabled."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"S3 Bucket {bucket.name} has server access logging disabled."
                )
            findings.append(report)

        return findings

References