Secure S3 Audit Trails and CloudTrail Loop Prevention
Specification & Description
Enable S3 server access logging for buckets tagged as sensitive while explicitly prohibiting logging on CloudTrail buckets to prevent infinite recursive logging loops and associated cost spikes.
Technical Specifications
AWS S3 server access logging is critical for auditing sensitive data access. However, enabling server access logging on a bucket that also serves as a target for AWS CloudTrail (or as its own logging target) creates an infinite recursive loop: every log delivery is recorded as an access event, which triggers a new log delivery. This results in massive storage growth and uncontrolled costs. This control mandates tagging for sensitive buckets to ensure audit trails exist where necessary, while enforcing a guardrail to prevent logging on the central CloudTrail log archive bucket.
Security Rationale
Tag-driven selective logging focuses forensic visibility on critical data (PII, financial, source code) without the overhead of logging every low-risk utility bucket. Prohibiting logging on the CloudTrail bucket is a mandatory operational safety guardrail to avoid service-wide log bombardment and financial loss from recursive storage events.
Policy Exceptions (1)
Central logging buckets are exempt to prevent recursive loops.
Operational & Implementation Notes
Enabling server access logging on a bucket that receives its own logs or receives frequent CloudTrail logs will cause exponential log growth. Always use a separate, dedicated logging bucket that does not have logging enabled for itself.