> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # AWS Config Log File Delivery Should Be Configured ### More Info: Ensure that the log files (history files and snapshots) generated by AWS Config are delivered without any failures to designated S3 bucket in order to store logging data for auditing purposes. ### Risk Level Medium ### Address Security ### Compliance Standards * APRA CPS 234 (Australia) * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * DPDPA * Digital Operational Resilience Act (EU) * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST SP 800-171 * NYDFS 23 NYCRR 500 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation To remediate the misconfiguration "AWS Config Log File Delivery Should Be Configured" in AWS, you can follow the below steps: 1. Open the AWS Management Console and navigate to the AWS Config service. 2. Click on the "Settings" button in the left-hand menu. 3. Scroll down to the "Resource Types to Record" section and click on the "Edit" button. 4. Check the box next to "AWS::S3::Bucket" to enable logging for S3 buckets. 5. Click on the "Save" button to save the changes. This will enable AWS Config to log all changes made to S3 buckets in your AWS account. You can also configure logging for other resource types by checking the appropriate boxes in the "Resource Types to Record" section. # To remediate the misconfiguration of AWS Config Log File Delivery, please follow the below steps: Step 1: Open the AWS CLI and run the following command to create an S3 bucket that will store the AWS Config logs: ``` aws s3 mb s3:// --region ``` Note: Replace `` with a unique name for your S3 bucket and `` with the region where you want to create the bucket. Step 2: Run the following command to create an IAM role that AWS Config will use to access the S3 bucket: ``` aws iam create-role --role-name AWSConfigServiceRole --assume-role-policy-document file://trust-policy.json ``` Note: Create a file named `trust-policy.json` with the following content: ``` { "Version": "2012-10-17", "Statement": [ { "Sid": "", "Effect": "Allow", "Principal": { "Service": "config.amazonaws.com" }, "Action": "sts:AssumeRole" } ] } ``` Step 3: Run the following command to attach the required policy to the IAM role: ``` aws iam attach-role-policy --policy-arn arn:aws:iam::aws:policy/service-role/AWSConfigRole --role-name AWSConfigServiceRole ``` Step 4: Run the following command to enable AWS Config and specify the S3 bucket and IAM role: ``` aws configservice put-delivery-channel --delivery-channel '{"s3BucketName":"","snsTopicARN":"","configSnapshotDeliveryProperties":{"deliveryFrequency":"Six_Hours"}}' --name default --s3-key-prefix logs/ --role-arn arn:aws:iam:::role/AWSConfigServiceRole ``` Note: Replace `` with the name of the S3 bucket you created in Step 1 and `` with your AWS account ID. Step 5: Verify that AWS Config is enabled and the S3 bucket and IAM role are configured correctly by running the following command: ``` aws configservice describe-delivery-channels ``` This should return a JSON object that includes the details of the delivery channel you just created. By following the above steps, you can remediate the misconfiguration of AWS Config Log File Delivery. To remediate the AWS Config Log File Delivery misconfiguration using Python, you can follow these steps: 1. Import the necessary AWS SDK libraries in your Python script. For example, you can use the `boto3` library to interact with AWS services. ```python theme={null} import boto3 ``` 2. Create a `boto3` client for AWS Config service. ```python theme={null} config_client = boto3.client('config') ``` 3. Check if the AWS Config Log File Delivery is enabled or not. ```python theme={null} response = config_client.describe_delivery_channels() if len(response['DeliveryChannels']) == 0: print("AWS Config Log File Delivery is not enabled.") else: print("AWS Config Log File Delivery is enabled.") ``` 4. If AWS Config Log File Delivery is not enabled, create a new delivery channel. ```python theme={null} response = config_client.put_delivery_channel( DeliveryChannel={ 'name': 'my-delivery-channel', # replace with your own delivery channel name 's3BucketName': 'my-s3-bucket', # replace with your own S3 bucket name 'configSnapshotDeliveryProperties': { 'deliveryFrequency': 'One_Hour' # or 'Three_Hours', 'Six_Hours', 'Twelve_Hours', 'TwentyFour_Hours' } } ) print("AWS Config Log File Delivery is enabled now.") ``` Note: Replace `my-delivery-channel` and `my-s3-bucket` with your own delivery channel name and S3 bucket name respectively. 5. Verify that the AWS Config Log File Delivery is enabled. ```python theme={null} response = config_client.describe_delivery_channels() if len(response['DeliveryChannels']) == 0: print("AWS Config Log File Delivery is not enabled.") else: print("AWS Config Log File Delivery is enabled.") ``` 6. Run the Python script to remediate the AWS Config Log File Delivery misconfiguration. This should enable the AWS Config Log File Delivery and remediate the misconfiguration. ```hcl theme={null} resource "aws_s3_bucket" "config_logs" { bucket = "CONFIG_LOGS_BUCKET_NAME" # replace with your existing Config logs bucket name } data "aws_iam_account_alias" "current" {} resource "aws_s3_bucket_policy" "config_logs_policy" { bucket = aws_s3_bucket.config_logs.id policy = jsonencode({ Version = "2012-10-17" Statement = [ { Sid = "AWSConfigBucketPermissionsCheck" Effect = "Allow" Principal = { Service = "config.amazonaws.com" } Action = "s3:GetBucketAcl" Resource = "arn:aws:s3:::CONFIG_LOGS_BUCKET_NAME" # replace with your bucket name }, { Sid = "AWSConfigBucketDelivery" Effect = "Allow" Principal = { Service = "config.amazonaws.com" } Action = "s3:PutObject" Resource = "arn:aws:s3:::CONFIG_LOGS_BUCKET_NAME/AWSLogs/AWS_ACCOUNT_ID/Config/*" # replace AWS_ACCOUNT_ID Condition = { StringEquals = { "s3:x-amz-acl" = "bucket-owner-full-control" } } } ] }) } ``` Replace: * `CONFIG_LOGS_BUCKET_NAME` with the S3 bucket used by your AWS Config delivery channel. * `AWS_ACCOUNT_ID` with your 12-digit AWS account ID. This Terraform resource **replaces the entire existing bucket policy** on that S3 bucket; if you already have other statements, merge them into the `Statement` array instead of overwriting them. After applying, `terraform plan` should show either creation of `aws_s3_bucket_policy.config_logs_policy` or an in-place policy update whose JSON includes the two `AWSConfigBucketPermissionsCheck` and `AWSConfigBucketDelivery` statements. ### Additional Reading: * [https://docs.aws.amazon.com/config/latest/developerguide/security-logging-and-monitoring.html](https://docs.aws.amazon.com/config/latest/developerguide/security-logging-and-monitoring.html)