S3 bucket should have access logging enabled

What it checks

S3 bucket: access logging is not configured.

Where it applies

Terraform: aws_s3_bucket_logging

CloudFormation: AWS::S3::Bucket

How to fix it

1. Create or designate a central log-archive bucket with strict access controls
2. Add an aws_s3_bucket_logging resource pointing at the archive bucket

Frameworks

• AWS FSBP S3.9
• SOC 2 CC7.2
• PCI-DSS v4.0.1/10.2.1
• HIPAA 164.312(b)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules