Rule: All S3 Buckets Should Log S3 Data Events in CloudTrail
This rule ensures that all S3 buckets log S3 data events in CloudTrail.
| Rule | All S3 buckets should log S3 data events in CloudTrail |
| Framework | FedRAMP Moderate Revision 4 |
| Severity | ✔ Medium |
Rule Description
This rule ensures that all S3 buckets within the AWS account have logging enabled for S3 data events in CloudTrail, in compliance with the FedRAMP Moderate Revision 4 requirements. Logging S3 data events allows monitoring and auditing of actions performed on S3 objects, providing visibility into bucket access and changes to the data stored in the buckets.
Troubleshooting Steps
If any S3 bucket is not logging S3 data events in CloudTrail, follow these troubleshooting steps:
- 1.
Verify the bucket's CloudTrail configuration: Ensure that the affected S3 bucket has the proper CloudTrail configuration to enable logging of S3 data events. Check the bucket's settings to confirm that it is set up to send the necessary logs to CloudTrail.
- 2.
Check the CloudTrail trail: Validate that the CloudTrail trail, which receives the logs from S3, is properly configured and active. Ensure that it is not deleted, paused, or experiencing any other issues.
- 3.
Review S3 bucket permissions: Verify that the S3 bucket has the necessary permissions to send logs to CloudTrail. Check the bucket policy and ensure it includes the appropriate permissions to write logs to the CloudTrail trail.
- 4.
Inspect CloudTrail logging errors: If there are any errors related to CloudTrail logging, review the CloudTrail logs in the AWS Management Console. Look for any error messages or warnings that could indicate the cause of the issue.
- 5.
Check AWS Identity and Access Management (IAM) permissions: Ensure that the IAM user or role used to create or configure the S3 bucket has the necessary permissions to enable CloudTrail logging. Check for any permission issues that could prevent the logging configuration from being applied.
Necessary Code
There is no specific code required for this rule as it focuses on the configuration and settings of S3 buckets and CloudTrail.
Step-by-Step Guide for Remediation
To enable logging of S3 data events in CloudTrail for an S3 bucket, follow these steps:
- 1.
Sign in to the AWS Management Console: Open the AWS Management Console using your AWS account credentials.
- 2.
Navigate to the CloudTrail service: In the AWS Management Console, search for "CloudTrail" in the services search bar, and click on the "CloudTrail" result.
- 3.
Select an existing trail or create a new one: If you already have a CloudTrail trail configured, select it from the displayed list. If not, click on the "Trails" link in the left navigation pane and click "Create trail" to set up a new trail.
- 4.
Configure the trail settings: In the trail configuration screen, provide a name for the trail, select your desired storage location for the logs, and enable the "Data events" option under "Event selector." Ensure that the "S3" checkbox is selected within the "Data events" section.
- 5.
Select the S3 bucket: Choose the S3 bucket for which you want to enable logging of S3 data events. You can either select an existing S3 bucket from the dropdown menu or create a new bucket directly from the trail configuration screen.
- 6.
Enable advanced event selectors (optional): If required, you can further customize the types of S3 data events to be logged by enabling advanced event selectors. This allows filtering specific event types or specific objects within the bucket for logging.
- 7.
Configure advanced settings (optional): If you need to specify additional options such as log file encryption, log file validation, or CloudWatch Logs integration, you can configure those settings in the advanced options section.
- 8.
Review and create/update the trail: Double-check the trail configuration, ensuring that it includes the proper S3 bucket and desired settings. Click "Create" or "Update" to create or update the trail with the configured settings.
- 9.
Verify log delivery: Monitor the CloudTrail dashboard to confirm that the logs are being delivered to the selected storage location. You can also inspect the CloudTrail logs in the AWS Management Console to validate that the S3 data events are being logged for the configured bucket.
By following these steps, you will enable logging of S3 data events in CloudTrail for an S3 bucket, ensuring compliance with the FedRAMP Moderate Revision 4 requirements.