---
title: S3 bucket access logging should be enabled on the CloudTrail S3 bucket
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > S3 bucket access logging should be
  enabled on the CloudTrail S3 bucket
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# S3 bucket access logging should be enabled on the CloudTrail S3 bucket
 
## Description{% #description %}

AWS S3 buckets used as CloudTrail log destinations should have server access logging enabled with a target bucket configured for log delivery. Server access logs record each request made to the bucket, including request type, resources accessed, and request time, which supports security monitoring and incident response for the CloudTrail log store. This rule evaluates only buckets referenced by a CloudTrail trail and fails when no logging target bucket is configured.

## Remediation{% #remediation %}

1. Identify the CloudTrail bucket with `aws cloudtrail describe-trails --query 'trailList[*].S3BucketName'`.
1. In the [Amazon S3 console](https://console.aws.amazon.com/s3), open the bucket's **Properties**, edit **Server access logging**, enable it, and select a target bucket and prefix. Alternatively, apply a logging configuration with `aws s3api put-bucket-logging --bucket <bucket-name> --bucket-logging-status file://<file>.json`, as described in [Enabling Amazon S3 server access logging](https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-server-access-logging.html).

## References{% #references %}

- [Enabling Amazon S3 server access logging](https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-server-access-logging.html)
- [Logging requests with server access logging](https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerLogs.html)
- [CIS Amazon Web Services Benchmarks](https://www.cisecurity.org/benchmark/amazon_web_services)