> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # CloudTrail Logging Bucket Should Not Be Publicly Accessible ### More Info: AWS CloudTrail logging buckets should not be publicly accessible. Using an overly permissive or insecure set of permissions for your CloudTrail logging S3 buckets could provide malicious users access to your AWS account log data which can increase exponentially the risk of unauthorized access. ### Risk Level Critical ### Address Security ### Compliance Standards * APRA CPS 234 (Australia) * AWS Startup Security Baseline * AWS Well Architected Framework * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS AWS * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * Cloudanix Best Practice * DPDPA * Digital Operational Resilience Act (EU) * Essential 8 * GDPR * HIPAA * HITRUST CSF * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST CSF * NIST SP 800-171 * NYDFS 23 NYCRR 500 * PCI * SOC2 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework * StateRAMP * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation 1. **Sign in to the AWS Management Console**. 2. **Navigate to the CloudTrail service**. 3. **Select Trails from the navigation pane**. 4. **Identify Trails with Publicly Accessible Buckets**: * Review each trail listed in the CloudTrail console and identify those with publicly accessible S3 buckets. 5. **Review Bucket ACL and Bucket Policy**: * Click on each trail to view its details. * Under the "S3 bucket" section, review the bucket ACL and bucket policy for any grants to "AllUsers" or "AuthenticatedUsers" with "FULL\_CONTROL" permission. 6. **Remove Public Access**: * If there are grants allowing public access, you need to remove them: * Modify the bucket ACL to remove any grants allowing public access. * Delete the bucket policy if it allows public access. 7. **Repeat for Other Trails**: * Repeat the above steps for all trails with publicly accessible S3 buckets. # 1. **Identify CloudTrail Trails with Publicly Accessible Buckets**: ```bash theme={null} aws cloudtrail describe-trails --query "trailList[?contains(S3BucketName, 'public-accessible-bucket')]" --output json ``` Replace `'public-accessible-bucket'` with the name of the bucket you're investigating. 2. **Remove Public Access from S3 Bucket ACL**: ```bash theme={null} aws s3api put-bucket-acl --bucket BUCKET_NAME --acl private ``` Replace `BUCKET_NAME` with the name of the S3 bucket. 3. **Remove Bucket Policy** (if exists): ```bash theme={null} aws s3api delete-bucket-policy --bucket BUCKET_NAME ``` Replace `BUCKET_NAME` with the name of the S3 bucket. 4. **Repeat for Other Trails**: * If there are multiple CloudTrail trails with publicly accessible S3 buckets, repeat the above steps for each of them. These steps will remove public access from the S3 buckets associated with the CloudTrail trails using the AWS CLI. Ensure that you have appropriate IAM permissions to modify S3 bucket ACLs and policies. Here's a Python script to identify and remediate CloudTrail trails with publicly accessible S3 buckets: ```python theme={null} import boto3 class CloudTrailChecker: def __init__(self): self.cloudtrail_client = boto3.client('cloudtrail') self.s3_client = boto3.client('s3') def get_publicly_accessible_trails(self): failures = [] response = self.cloudtrail_client.describe_trails() for trail in response['trailList']: if self.is_trail_public(trail): failures.append(trail) return failures def is_trail_public(self, trail): bucket_name = trail.get("S3BucketName", "") bucket_acl = self.s3_client.get_bucket_acl(Bucket=bucket_name) bucket_policy = self.s3_client.get_bucket_policy(Bucket=bucket_name) for grant in bucket_acl.get("Grants", []): if grant.get("Grantee", {}).get("URI", "") in [ "http://acs.amazonaws.com/groups/global/AllUsers", "http://acs.amazonaws.com/groups/global/AuthenticatedUsers", ] and grant.get("Permission", None) == "FULL_CONTROL": return True statements = bucket_policy.get("Policy", {}).get("Statement", []) for statement in statements: if statement.get("Effect", "") == "Allow" and statement.get("Principal", "") == "*": return True return False def remediate_public_trail(self, trail_name): bucket_name = self.cloudtrail_client.describe_trails(trailNameList=[trail_name])['trailList'][0]['S3BucketName'] # Remove public access from bucket ACL self.s3_client.put_bucket_acl( Bucket=bucket_name, ACL='private' ) # Remove public access from bucket policy self.s3_client.delete_bucket_policy( Bucket=bucket_name ) print(f"Public access has been removed from the CloudTrail trail {trail_name}.") # Instantiate the class checker = CloudTrailChecker() # Get trails with publicly accessible buckets public_trails = checker.get_publicly_accessible_trails() # Remediate public trails for trail in public_trails: checker.remediate_public_trail(trail['Name']) ``` This Python script identifies CloudTrail trails with publicly accessible S3 buckets and provides a placeholder for the remediation logic. You would need to implement the logic to modify the bucket ACL and bucket policy to remove public access. Make sure to have appropriate IAM permissions for managing CloudTrail trails if you're using AWS CLI or Python script. ```hcl theme={null} # CloudTrail trail writing to an S3 bucket resource "aws_cloudtrail" "cloudtrail" { name = "CLOUDTRAIL_NAME" s3_bucket_name = aws_s3_bucket.cloudtrail_logs.bucket # ...other required arguments... } # CloudTrail logs S3 bucket resource "aws_s3_bucket" "cloudtrail_logs" { bucket = "CLOUDTRAIL_LOG_BUCKET_NAME" # ...other required arguments... } # Enable S3 Block Public Access on the CloudTrail bucket # (matches: aws s3api put-public-access-block ... BlockPublicAcls=true, IgnorePublicAcls=true, # BlockPublicPolicy=true, RestrictPublicBuckets=true) resource "aws_s3_bucket_public_access_block" "cloudtrail_logs" { bucket = aws_s3_bucket.cloudtrail_logs.id block_public_acls = true ignore_public_acls = true block_public_policy = true restrict_public_buckets = true } # OPTIONAL: If you currently have an aws_s3_bucket_policy that makes the bucket public, # remove the public "Principal": "*" statements or the entire policy. # This example keeps only the minimum CloudTrail permissions and is NOT public: resource "aws_s3_bucket_policy" "cloudtrail_logs" { bucket = aws_s3_bucket.cloudtrail_logs.id policy = jsonencode({ Version = "2012-10-17" Statement = [ { Sid = "AWSCloudTrailWrite" Effect = "Allow" Principal = { Service = "cloudtrail.amazonaws.com" } Action = "s3:PutObject" Resource = "${aws_s3_bucket.cloudtrail_logs.arn}/AWSLogs/ACCOUNT_ID/*" Condition = { StringEquals = { "s3:x-amz-acl" = "bucket-owner-full-control" } } }, { Sid = "AWSCloudTrailAclCheck" Effect = "Allow" Principal = { Service = "cloudtrail.amazonaws.com" } Action = "s3:GetBucketAcl" Resource = aws_s3_bucket.cloudtrail_logs.arn } ] }) } ``` Enabling `aws_s3_bucket_public_access_block` as shown will block all current and future public access to the CloudTrail bucket (via ACLs or bucket policies), matching the verified CLI remediation and is irreversible from the bucket’s perspective until you change these flags. `terraform plan` should show creation (or update) of `aws_s3_bucket_public_access_block.cloudtrail_logs` with all four attributes set to `true`, and any removal/adjustment of public statements from `aws_s3_bucket_policy.cloudtrail_logs` if you manage it. ### Additional Reading: * [https://docs.aws.amazon.com/awscloudtrail/latest/userguide/create-s3-bucket-policy-for-cloudtrail.html](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/create-s3-bucket-policy-for-cloudtrail.html)