CloudTrail S3 Bucket Logging Enabled

01 Sign in to the AWS Management Console.

02 Navigate to CloudTrail dashboard at https://console.aws.amazon.com/cloudtrail/.

03 In the left navigation panel, select Trails.

04 Under Name column, select the trail name that you need to examine.

05 Under S3 section check for the S3 bucket name:

used to store log data.

06Navigate to S3 dashboard at https://console.aws.amazon.com/s3/.

07Select the S3 bucket used for CloudTrail logging, then click the Properties tab from the right panel:

08In the Properties panel, click the Logging tab and check if the Enabled checkbox is selected or not:

If the checkbox is not selected the logging feature is not enabled for the selected CloudTrail bucket.

01 Run describe-trails command (OSX/Linux/UNIX) to list all CloudTrail trails available in the selected AWS region:

aws cloudtrail describe-trails

02 The command output should expose the name of each S3 bucket used for logging by the AWS CloudTrail:

{
    "trailList": [
        {
            "IncludeGlobalServiceEvents": true,
            "Name": "MyCloudTrail",
            "TrailARN": "arn:aws:cloudtrail:us-east-1:
                         123456789012:trail/MyCloudTrail",
            "LogFileValidationEnabled": false,
            "IsMultiRegionTrail": true,
            "S3BucketName": "cloudtrail-global-logging",
            "HomeRegion": "us-east-1"
        }
    ]
}

03 Run get-bucket-logging command (OSX/Linux/UNIX) to return the logging status for the selected CloudTrail bucket:

aws s3api get-bucket-logging
	--bucket cloudtrail-global-logging

If the command is not returning any output, the bucket access logging is not currently enabled.

01 Sign in to the AWS Management Console.

02 Navigate to CloudTrail dashboard at https://console.aws.amazon.com/cloudtrail/.

03 In the left navigation panel, select Trails.

04 Under Name column, select the trail name that you need to examine.

05 Under S3 section check for the S3 bucket name:

used to store log data.

06 Navigate to S3 dashboard at https://console.aws.amazon.com/s3/.

07 Select the S3 bucket used for CloudTrail logging, then click the Properties tab from the right panel:

08 In the Properties panel, click the Logging tab and set up access logging for the selected bucket:

1. Select Enabled checkbox to enable the feature.
2. In the Target Bucket field enter the name for the bucket that will store the access logs. You can use the selected bucket or create a new S3 bucket for these logs.
3. In the Target Prefix field enter a name for the subdirectory where the access logs will be stored – useful to manage your logs.

09 Review the configuration details and click Save:

AWS will add automatically the necessary grantee (Log Delivery) and its permissions for the S3 bucket.

01 Run describe-trails command (OSX/Linux/UNIX) to list all CloudTrail trails available in the selected AWS region:

aws cloudtrail describe-trails

02 The command output should expose the name of each S3 bucket used for logging by the AWS CloudTrail service:

{
    "trailList": [
        {
            "IncludeGlobalServiceEvents": true,
            "Name": "MyCloudTrail",
            "TrailARN": "arn:aws:cloudtrail:us-east-1:
                         123456789012:trail/MyCloudTrail",
            "LogFileValidationEnabled": false,
            "IsMultiRegionTrail": true,
            "S3BucketName": "cloudtrail-global-logging",
            "HomeRegion": "us-east-1"
        }
    ]
}

03 Run put-bucket-acl command (OSX/Linux/UNIX) to set the necessary S3 bucket permissions using access control lists (ACL):

aws s3api put-bucket-acl --bucket cloudtrail-global-logging
	--grant-write URI=http://acs.amazonaws.com/groups/s3/LogDelivery
	--grant-read-acp URI=http://acs.amazonaws.com/groups/s3/LogDelivery

04 Create a new policy document called access-logging.json and specify the permissions for who can view and modify the access logging parameters:

{
  "LoggingEnabled": {
    "TargetBucket": "cloudtrail-global-logging",
    "TargetPrefix": "access-logs/",
    "TargetGrants": [
      {
        "Grantee": {
            "Type": "Group",
            "URI": "http://acs.amazonaws.com/groups/s3/LogDelivery"
         },
        "Permission": "WRITE"
      },
      {
        "Grantee": {
            "Type": "Group",
            "URI": "http://acs.amazonaws.com/groups/s3/LogDelivery"
         },
        "Permission": "READ_ACP"
      }
    ]
  }
}

05 Run put-bucket-logging command (OSX/Linux/UNIX) to turn on server access logging and set up the necessary permissions for the log delivery system using the policy document created earlier (access-logging.json):

aws s3api put-bucket-logging
	--bucket cloudtrail-global-logging
	--bucket-logging-status file://access-logging.json