Project: KICS (Provisioning / Security & Compliance)
File: ee9e50e8-b2ed-4176-ad42-8fc0cf7593f4.md

title: CloudTrail Log Files S3 Bucket with Logging Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: ee9e50e8-b2ed-4176-ad42-8fc0cf7593f4 Query name: CloudTrail Log Files S3 Bucket with Logging Disabled Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Observability URL: CloudTrail Log Files S3 Bucket should have 'logging' enabled<br> ```tf title="Positive test num. 1 - tf file" hl_lines="23" provider "aws" { region = "us-east-1" } terraform { required_providers { aws = { source = "hashicorp/aws" version = "~> 3.0" } } } data "awscalleridentity" "current" {} resource "aws_cloudtrail" "foobar" { name = "tf-trail-foobar" s3bucketname = awss3bucket.foo.id s3keyprefix = "prefix" includeglobalservice_events = false } resource "awss3bucket" "foo" { bucket = "tf-test-trail" force_destroy = true policy = <<POLICY { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSCloudTrailAclCheck", "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Action": "s3:GetBucketAcl", "Resource": "arn:aws:s3:::tf-test-trail" }, { "Sid": "AWSCloudTrailWrite", "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Action": "s3:PutObject", "Resource": "arn:aws:s3:::tf-test-trail/prefix/AWSLogs/${data.awscalleridentity.current.account_id}/*", "Condition": { "StringEquals": { "s3:x-amz-acl": "bucket-owner-full-control" } } } ] } POLICY } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="1" module "foo" { source = "terraform-aws-modules/s3-bucket/aws" version = "0.0.1" acl = "private" bucket = "foo" force_destroy = true policy = <<POLICY { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSCloudTrailAclCheck", "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Action": "s3:GetBucketAcl", "Resource": "arn:aws:s3:::tf-test-trail" }, { "Sid": "AWSCloudTrailWrite", "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Action": "s3:PutObject", "Resource": "arn:aws:s3:::tf-test-trail/prefix/AWSLogs/${data.awscalleridentity.current.account_id}/*", "Condition": { "StringEquals": { "s3:x-amz-acl": "bucket-owner-full-control" } } } ] } POLICY versioning_inputs = [ { enabled = true mfa_delete = null }, ] } resource "aws_cloudtrail" "foobar" { name = "tf-trail-foobar" s3bucketname = awss3bucket.foo.id s3keyprefix = "prefix" includeglobalservice_events = false } ``` ```tf title="Positive test num. 3 - tf file" hl_lines="21" terraform { required_providers { aws = { source = "hashicorp/aws" version = "4.2.0" } } } provider "aws" { } resource "aws_cloudtrail" "foobar2" { name = "tf-trail-foobar" s3bucketname = awss3bucket.bb.id s3keyprefix = "prefix" includeglobalservice_events = false } resource "awss3bucket" "bb" { bucket = "my-tf-example-bucket" } ``` ```tf title="Negative test num. 1 - tf file" provider "aws" { region = "us-east-1" } terraform { required_providers { aws = { source = "hashicorp/aws" version = "~> 3.0" } } } data "awscalleridentity" "current2" {} resource "aws_cloudtrail" "foobar2" { name = "tf-trail-foobar" s3bucketname = awss3bucket.foo2.id s3keyprefix = "prefix" includeglobalservice_events = false } resource "awss3bucket" "log_bucket" { bucket = "my-tf-log-bucket" acl = "log-delivery-write" } resource "awss3bucket" "foo2" { bucket = "my-tf-test-bucket" acl = "private" logging { targetbucket = awss3bucket.logbucket.id target_prefix = "log/" } } ``` ```tf title="Negative test num. 2 - tf file" module "s3_bucket" { source = "terraform-aws-modules/s3-bucket/aws" version = "0.0.1" bucket = "s3-tf-example-versioning" acl = "private" logging { targetbucket = awss3bucket.logbucket.id target_prefix = "log/" } versioning_inputs = [ { enabled = true mfa_delete = null }, ] } ``` ```tf title="Negative test num. 3 - tf file" terraform { required_providers { aws = { source = "hashicorp/aws" version = "4.2.0" } } } provider "aws" { } resource "aws_cloudtrail" "foobar2" { name = "tf-trail-foobar" s3bucketname = awss3bucket.bbb.id s3keyprefix = "prefix" includeglobalservice_events = false } resource "awss3bucket" "bbb" { bucket = "my-tf-example-bucket" } resource "awss3bucket_logging" "example" { bucket = awss3bucket.bbb.id targetbucket = awss3bucket.logbucket.id target_prefix = "log/" } ```