Rule: S3 Bucket Logging Should Be Enabled

Rule Description: S3 Bucket Logging for NIST 800-53 Revision 5 Compliance

Description:

Troubleshooting Steps:

2. 1.
   Check if S3 bucket logging is already enabled for the appropriate buckets.
4. 2.
   Ensure the IAM role associated with the bucket has the necessary permissions to write logs.
6. 3.
   Verify if the bucket policy allows the logging permissions.

Necessary Codes:

Step-by-step Guide for Enabling S3 Bucket Logging:

2. 1.

   Method 1: AWS Management Console

   • Open the AWS Management Console and navigate to the Amazon S3 service.
   • Select the relevant bucket for which you want to enable logging.
   • Click on the "Properties" tab.
   • Under the "Server access logging" section, click on the "Edit" button.
   • Enable server access logging by selecting the target bucket and specifying the log file prefix.
   • Click on the "Save" button to apply the log settings.
4. 2.

   Method 2: AWS CLI

   • Install and configure the AWS CLI if not already done.

   • Open the command-line interface (CLI) and run the following command to enable S3 bucket logging:

     aws s3api put-bucket-logging --bucket <bucket-name> --bucket-logging-status file://logging-configuration.json
     

     In the "logging-configuration.json" file, specify the target bucket and log file prefix.

     Example content of the "logging-configuration.json" file:

     {
       "LoggingEnabled": {
         "TargetBucket": "<log-bucket-name>",
         "TargetPrefix": "<log-prefix>"
       }
     }
     

   • Verify the S3 bucket logging configuration by running the following command:

     aws s3api get-bucket-logging --bucket <bucket-name>
     

Remediation:

2. 1.

   Identify the S3 buckets that need to have logging enabled based on the NIST 800-53 Revision 5 compliance requirements.

4. 2.

   Choose one of the methods mentioned above to enable S3 bucket logging for each relevant bucket:

   • Method 1: AWS Management Console
   • Method 2: AWS CLI
6. 3.

   Validate the S3 bucket's logging configuration to ensure it is successfully enabled by using the appropriate AWS CLI command.

8. 4.

   Repeat the above steps for all the identified relevant buckets until S3 bucket logging is enabled for each one.