Description

Detects S3 buckets that have server access logging disabled. Server access logging provides detailed records of requests made to buckets, which is critical for security auditing, compliance, and incident investigation. Without logging enabled, there is no audit trail of bucket access and potential security incidents.

Detection Strategy

• Examines all S3 buckets in the AWS account

• Checks if the bucket has the LoggingEnabled configuration set

• Reports a vulnerability if a bucket does not have any logging configuration enabled

• Each vulnerable bucket is reported individually with its bucket ARN