Policy Packs

guardrails-samples

Ensure that S3 bucket access logging is enabled and follows a specific naming convention for enhanced security and auditing.

Enforce Access Logging Is Enabled for AWS S3 Buckets

main

aws_s3_bucket_access_logging

Define the Access Logging settings required for `AWS &gt; S3 &gt; Bucket`.&#92;n&#92;n`AWS &gt; S3 &gt; Bucket` provides access logs that capture detailed information&#92;nabout requests sent to your bucket. Each log contains information such as&#92;nthe time the request was received, the client&#39;s IP address, latencies,&#92;nrequest paths, and server responses. You can use these access logs to&#92;nanalyze traffic patterns and troubleshoot issues.&#92;n

bucketAccessLogging

AWS > S3 > Bucket > Access Logging

aws_s3_bucket_access_logging_bucket

The name of an S3 Bucket to which the Bucket&#92;naccess logs will be delivered.&#92;n&#92;nThe S3 Bucket must already exist and the S3 service must be allowed write access.&#92;nThe bucket should reside in same account and same region as of the Bucket.&#92;n&#92;nexample:&#92;n```&#92;n  testbucket&#92;n  turbotbucket&#92;n```&#92;n

bucketAccessLoggingBucket

AWS > S3 > Bucket > Access Logging > Bucket

aws_s3_bucket_access_logging_bucket_prefix

An optional S3 key prefix to which the `AWS &gt; S3 &gt; Bucket` access logs will be written.&#92;n&#92;nThe file names of the access logs use the following format:&#92;n`bucket[/prefix]/AWSLogs/aws-account-id/elasticloadbalancing/region/yyyy/mm/dd/aws-account-id_elasticloadbalancing_region_load-balancer-id_end-time_ip-address_random-string.log.gz`&#92;n

Policy	Setting	Note
AWS > S3 > Bucket > Access Logging	Check: Enabled
AWS > S3 > Bucket > Access Logging > Bucket	mybucket
AWS > S3 > Bucket > Access Logging > Key Prefix	test/123456789012/mybucket/

Policy Settings