Description

Detects when S3 buckets used to store AWS CloudTrail logs do not have S3 access logging enabled. Without bucket logging enabled on CloudTrail buckets, there is no audit trail of who accessed, modified, or deleted CloudTrail logs, which could allow malicious activities to go unnoticed.

Detection Strategy

• Retrieves all CloudTrail trails in the AWS account using CloudTrail API

• For each trail, checks the associated S3 bucket configuration to verify if bucket logging is enabled

• Reports a vulnerability if the S3 bucket storing CloudTrail logs does not have the 'LoggingEnabled' configuration set