S3 bucket access logging is not enabled on S3 buckets that store CloudTrail log files Affecting S3 service in AWS

Configure the aws_s3_bucket logging block to specify a target_bucket to receive access log objects.

For detailed instructions, see below:

• Find the S3 bucket used for CloudTrail logging by cross-referencing the aws_cloudtrail s3_bucket_name field with the logging aws_s3_bucket bucket field.
• Ensure that the aws_s3_bucket has a logging block that specifies a target_bucket that will receive the log objects, and optionally, a target_prefix.

Example configuration:

resource "aws_s3_bucket" "cloudtrail_bucket" {
  bucket = "cloudtrail-bucket"
  logging {
    target_bucket = "${aws_s3_bucket.log_bucket.id}"
    target_prefix = "log/"
  }
  # other required fields here
}

Configure the AWS::CloudTrail::Trail LoggingConfiguration block to specify a DestinationBucketName to receive access log objects.

For detailed instructions, see below:

• Find the S3 bucket used for CloudTrail logging by cross-referencing the AWS::CloudTrail::Trail S3BucketName field with the logging AWS::S3::Bucket BucketName field.
• Ensure that the AWS::S3::Bucket has a LoggingConfiguration block that specifies a DestinationBucketName that will receive the log objects, and optionally, a LogFilePrefix.

Example configuration:

JSON example configuration:

{
  "Type": "AWS::S3::Bucket",
  "Properties": {
    "LoggingConfiguration": {
      "DestinationBucketName": {
        "Ref": "LoggingBucket"
      },
      "LogFilePrefix": "testing-logs"
    }
  }
  # other required fields here
}

YAML example configuration:

Type: AWS::S3::Bucket
Properties:
  LoggingConfiguration:
    DestinationBucketName: !Ref LoggingBucket
    LogFilePrefix: testing-logs
# other required fields here