CdW1Wjq5W6VzU9ovqBpOCheck which AWS S3 buckets have Server Access Logging enabled
Check which AWS S3 buckets have Server Access Logging enabled
This task involves checking AWS S3 buckets to determine if Server Access Logging is enabled. It's crucial for monitoring and diagnosing security incidents, as it records requests made to the S3 bucket, enhancing transparency and aiding compliance with security protocols.
inputs
outputs
# SOC2 Compliance Guideline: S3 Bucket Logging
import boto3
from botocore.exceptions import ClientError, NoCredentialsError, BotoCoreError
creds = _get_creds(cred_label)['creds']
access_key = creds['username']
secret_key = creds['password']
def is_logging_enabled(bucket_name):
"""
Check if logging is enabled for the specified S3 bucket.
"""
s3 = boto3.client('s3', aws_access_key_id=access_key,aws_secret_access_key=secret_key)
try:
# Attempt to retrieve the bucket logging configuration
logging_config = s3.get_bucket_logging(Bucket=bucket_name)
# Logging is enabled if 'LoggingEnabled' key is present in the response
return 'LoggingEnabled' in logging_config
except ClientError as e:
print(f"Error checking logging for bucket '{bucket_name}': {e}")
raise
def check_all_buckets_for_logging():
"""
Check all S3 buckets in the account to ensure logging is enabled.
"""
try:
s3 = boto3.client('s3',aws_access_key_id=access_key,aws_secret_access_key=secret_key)
buckets = s3.list_buckets().get('Buckets', [])
if not buckets:
print("No S3 buckets found in the account.")
return
for bucket in buckets:
bucket_name = bucket['Name']
if is_logging_enabled(bucket_name):
print(f"Bucket '{bucket_name}' is COMPLIANT with logging enabled.")
else:
print(f"Bucket '{bucket_name}' is NON_COMPLIANT with logging disabled.")
except NoCredentialsError:
print("No AWS credentials found. Please configure your credentials.")
except BotoCoreError as e:
print(f"An error occurred accessing AWS S3 service: {e}")
except Exception as e:
print(f"An unexpected error occurred: {e}")
check_all_buckets_for_logging()
context.skip_sub_tasks=True
copied- 1d9o2nAQm1yXauBgWKFUnAWS S3 Bucket Logging Setup and Verification
1
This task involves setting up and verifying Server Access Logging for AWS S3 buckets. It ensures that logging is active for a bucket, providing detailed records of access requests. This is crucial for security monitoring, compliance with data governance standards, and effective management of AWS resources.
inputsoutputsimport boto3 from botocore.exceptions import ClientError, BotoCoreError creds = _get_creds(cred_label)['creds'] access_key = creds['username'] secret_key = creds['password'] def enable_and_verify_logging(bucket_name, log_bucket, log_prefix): """ Enable logging for an S3 bucket and verify that it's been enabled, with additional checks. """ s3 = boto3.client('s3',aws_access_key_id=access_key,aws_secret_access_key=secret_key) # Check if required parameters are provided if not bucket_name or not log_bucket or not log_prefix: print("Error: Bucket name, logging bucket, or log prefix is missing.") return try: # Enable logging s3.put_bucket_logging( Bucket=bucket_name, BucketLoggingStatus={ 'LoggingEnabled': { 'TargetBucket': log_bucket, 'TargetPrefix': log_prefix } } ) print(f"Logging enabled for bucket '{bucket_name}'.") # Verify logging response = s3.get_bucket_logging(Bucket=bucket_name) if 'LoggingEnabled' in response: print("Logging Status: Enabled") print(f"HTTP Status Code: {response['ResponseMetadata']['HTTPStatusCode']}") print(f"Target Bucket: {response['LoggingEnabled']['TargetBucket']}") print(f"Target Prefix: {response['LoggingEnabled']['TargetPrefix']}") else: print("Logging is not enabled.") except ClientError as e: print(f"AWS ClientError: {e.response['Error']['Message']}") except BotoCoreError as e: print(f"BotoCoreError: {e}") except Exception as e: print(f"An unexpected error occurred: {e}") #bucket_name = 'encryption-test-bucket-789' #log_bucket = 'encryption-test-bucket-789' # It can be the same as bucket_name but not recommended #log_prefix = 'log-prefix/whatever' enable_and_verify_logging(bucket_name, log_bucket, log_prefix)copied1