Panther medium experimental python

AWS CloudTrail S3 Bucket Access Logging

This policy validates that the bucket receiving CloudTrail Logs is configured with S3 Access Logging. This audits all creation, modification, or deletion to CloudTrail audit logs.

View Source

Detection Logic

from panther_aws_helpers import BadLookup, resource_lookup


def policy(resource):
    bucket_arn = "arn:aws:s3:::" + resource["S3BucketName"]
    try:
        bucket = resource_lookup(bucket_arn)
    except BadLookup:
        return True

    return bucket["LoggingPolicy"] is not None

Field Validations

Loading…

Comments (0)

Loading comments...