Rule: All S3 Buckets Should Log S3 Data Events in CloudTrail

Rule Description

Troubleshooting Steps (if applicable)

2. 1.

   Verify the AWS account and permissions:

   • Ensure you have the necessary permissions to enable logging for S3 buckets. Typically, the required permissions are part of the AWS managed policy "CloudTrailReadOnlyAccess" or a custom policy with similar rights.
   • Confirm that you are using the correct AWS account that you intend to monitor.
4. 2.

   Confirm the CloudTrail configuration:

   • Validate the CloudTrail settings and confirm that it is enabled for your AWS account.
   • Verify that the trail is logging the required data events. Ensure that the S3 data events are included in the trail configuration.
6. 3.

   Check S3 bucket permissions:

   • Ensure that your AWS Identity and Access Management (IAM) user or role has sufficient permissions on the S3 buckets to enable logging.
   • Grant the proper AWS Glue or CloudTrail permissions to your IAM user or role.
8. 4.

   Verify the bucket policies:

   • Check the bucket policies to ensure that they are not explicitly disallowing logging or permissions required for CloudTrail to function properly.

Necessary Code

Step-by-Step Guide for Remediation

2. 1.

   Using AWS Management Console:

   • Log in to the AWS Management Console.
   • Navigate to the CloudTrail service.
   • Select the appropriate trail that you want to modify.
   • Click on "Edit" to modify the trail settings.
   • Under the "Data events" section, make sure that "S3" is selected and the desired data events are checked.
   • Save the changes.
4. 2.

   Using AWS CLI:

   • Install and configure the AWS CLI if you haven't already.

   • Open a terminal or command prompt.

   • Run the following command to enable logging for S3 data events in CloudTrail:

     aws cloudtrail put-event-selectors --trail-name <TRAIL_NAME> --event-selectors file://<JSON_FILE_PATH>
     

     Replace

     <TRAIL_NAME>

     with the name of the CloudTrail trail and

     <JSON_FILE_PATH>

     with the path to a JSON file containing the event selectors configuration. The JSON file should include the necessary configuration for S3 data events.

     Example JSON file contents:

     [
       {
         "ReadWriteType": "All",
         "IncludeManagementEvents": false,
         "DataResources": [
           {
             "Type": "AWS::S3::Object",
             "Values": []
           }
         ]
       }
     ]
     

     Save the file with the desired configuration, and provide the path to this file in the command.
6. 3.

   Once the changes are saved in either the console or CLI, CloudTrail will start logging the specified S3 data events for all relevant S3 buckets in the AWS account. Ensure that the settings are properly propagated and validated in CloudTrail.