S3 bucket has no server access logging

What it checks

S3 bucket: server access logging is not enabled and the bucket is not a log destination.

Where it applies

Terraform: aws_s3_bucket

CloudFormation: AWS::S3::Bucket

How to fix it

1. Create or pick a dedicated log bucket with restricted access.
2. Add an aws_s3_bucket_logging resource referencing this bucket, with target_bucket set to the log bucket.

Frameworks

• AWS FSBP S3.9
• SOC 2 CC7.2
• PCI-DSS v4.0.1/10.2.1
• HIPAA 164.312(b)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules