Project: KICS (Provisioning / Security & Compliance)
File: a8fc2180-b3ac-4c93-bd0d-a55b974e4b07.md

title: S3 Bucket Object Level CloudTrail Logging Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: a8fc2180-b3ac-4c93-bd0d-a55b974e4b07 Query name: S3 Bucket Object Level CloudTrail Logging Disabled Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Observability URL: S3 Bucket object-level CloudTrail logging should be enabled for read and write events<br> ```tf title="Positive test num. 1 - tf file" hl_lines="9" data "awscalleridentity" "current" {} resource "aws_cloudtrail" "example" { name = "tf-trail-foobar" s3bucketname = awss3bucket.foo.id s3keyprefix = "prefix" includeglobalservice_events = false event_selector { includemanagementevents = true data_resource { type = "AWS::S3::Object" values = ["arn:aws:s3:::"] } } } resource "awss3bucket" "foo" { bucket = "tf-test-trail" force_destroy = true policy = <<POLICY { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSCloudTrailAclCheck", "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Action": "s3:GetBucketAcl", "Resource": "arn:aws:s3:::tf-test-trail" }, { "Sid": "AWSCloudTrailWrite", "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Action": "s3:PutObject", "Resource": "arn:aws:s3:::tf-test-trail/prefix/AWSLogs/${data.awscalleridentity.current.account_id}/*", "Condition": { "StringEquals": { "s3:x-amz-acl": "bucket-owner-full-control" } } } ] } POLICY } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="10" data "awscalleridentity" "current2" {} resource "aws_cloudtrail" "example2" { name = "tf-trail-foobar" s3bucketname = awss3bucket.foo2.id s3keyprefix = "prefix" includeglobalservice_events = false event_selector { readwritetype = "ReadOnly" includemanagementevents = true data_resource { type = "AWS::S3::Object" values = ["arn:aws:s3:::"] } } } resource "awss3bucket2" "foo" { bucket = "tf-test-trail" force_destroy = true policy = <<POLICY { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSCloudTrailAclCheck", "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Action": "s3:GetBucketAcl", "Resource": "arn:aws:s3:::tf-test-trail" }, { "Sid": "AWSCloudTrailWrite", "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Action": "s3:PutObject", "Resource": "arn:aws:s3:::tf-test-trail/prefix/AWSLogs/${data.awscalleridentity.current2.account_id}/*", "Condition": { "StringEquals": { "s3:x-amz-acl": "bucket-owner-full-control" } } } ] } POLICY } ``` ```tf title="Negative test num. 1 - tf file" data "awscalleridentity" "current3" {} resource "aws_cloudtrail" "example3" { name = "tf-trail-foobar" s3bucketname = awss3bucket.foo3.id s3keyprefix = "prefix" includeglobalservice_events = false event_selector { readwritetype = "All" includemanagementevents = true data_resource { type = "AWS::S3::Object" values = ["arn:aws:s3:::"] } } } resource "awss3bucket" "foo3" { bucket = "tf-test-trail" force_destroy = true policy = <<POLICY { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSCloudTrailAclCheck", "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Action": "s3:GetBucketAcl", "Resource": "arn:aws:s3:::tf-test-trail" }, { "Sid": "AWSCloudTrailWrite", "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Action": "s3:PutObject", "Resource": "arn:aws:s3:::tf-test-trail/prefix/AWSLogs/${data.awscalleridentity.current3.account_id}/*", "Condition": { "StringEquals": { "s3:x-amz-acl": "bucket-owner-full-control" } } } ] } POLICY } ```