3.3 Ensure the S3 bucket used to store CloudTrail logs is not publicly accessible

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version


CloudTrail logs a record of every API call made in your AWS account. These logs file are stored in an S3 bucket. It is recommended that the bucket policy or access control list (ACL) applied to the S3 bucket that CloudTrail logs to prevent public access to the CloudTrail logs.


Allowing public access to CloudTrail log content may aid an adversary in identifying weaknesses in the affected account's use or configuration.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.


Perform the following to remove any public access that has been granted to the bucket via an ACL or S3 bucket policy:

Go to Amazon S3 console at https://console.aws.amazon.com/s3/home

Right-click on the bucket and click Properties

In the Properties pane, click the Permissions tab.

The tab shows a list of grants, one row per grant, in the bucket ACL. Each row identifies the grantee and the permissions granted.

Select the row that grants permission to Everyone or Any Authenticated User

Uncheck all the permissions granted to Everyone or Any Authenticated User (click x to delete the row).

Click Save to save the ACL.

If the Edit bucket policy button is present, click it.

Remove any Statement having an Effect set to Allow and a Principal set to '*' or {'AWS' : '*'}.

Default Value:

By default, S3 buckets are not publicly accessible

See Also