AWS awssupport documentation change
Summary
Added documentation for new 'Amazon S3 Bucket Logging' fault tolerance check including configuration validation, alert criteria, and remediation steps
Security assessment
The change documents logging configuration checks which help identify security audit gaps, but does not address a specific vulnerability. While logging supports security monitoring, the check itself focuses on fault tolerance best practices rather than patching vulnerabilities.
Diff
diff --git a/awssupport/latest/user/fault-tolerance-checks.md b/awssupport/latest/user/fault-tolerance-checks.md index 1c819b277..010eb1a18 100644 --- a//awssupport/latest/user/fault-tolerance-checks.md +++ b//awssupport/latest/user/fault-tolerance-checks.md @@ -5 +5 @@ -ALB Multi-AZAmazon Aurora MySQL cluster backtracking not enabledAmazon Aurora DB Instance AccessibilityAmazon CloudFront Origin FailoverAmazon Comprehend Endpoint Access RiskAmazon DocumentDB Single AZ ClustersAmazon DynamoDB Point-in-time RecoveryAmazon DynamoDB Table Not Included in Backup PlanAmazon EBS Not Included in AWS Backup PlanAmazon EBS SnapshotsAmazon EC2 Auto Scaling does not have ELB Health Check EnabledAmazon EC2 Auto Scaling Group has Capacity Rebalancing EnabledAmazon EC2 Auto Scaling is not deployed in multiple AZs or does not meet the minimum number of AZsAmazon EC2 Availability Zone BalanceAmazon EC2 detailed monitoring not enabledAmazon ECS AWSLogs driver in blocking modeAmazon ECS service using a single AZAmazon ECS Multi-AZ placement strategy Amazon EFS no mount target redundancyAmazon EFS not in AWS Backup planAmazon ElastiCache Multi-AZ clustersElastiCache (Redis OSS) Clusters Automatic BackupAmazon MemoryDB Multi-AZ clustersAmazon MSK brokers hosting too many partitionsAmazon MSK Cluster Multi-AZAmazon OpenSearch Service domains with less than three data nodesAmazon RDS BackupsAmazon RDS Continuous Backup Not EnabledAmazon RDS DB clusters have one DB instanceAmazon RDS DB clusters with all instances in the same Availability ZoneAmazon RDS DB clusters with all reader instances in the same Availability ZoneAmazon RDS DB Instance Enhanced Monitoring not enabledAmazon RDS DB instances have storage autoscaling turned offAmazon RDS DB instances not using Multi-AZ deploymentAmazon RDS DiskQueueDepthAmazon RDS FreeStorageSpaceAmazon RDS log_output parameter is set to tableAmazon RDS innodb_default_row_format parameter setting is unsafeAmazon RDS innodb_flush_log_at_trx_commit parameter is not 1Amazon RDS max_user_connections parameter is lowAmazon RDS Multi-AZAmazon RDS Not In AWS Backup PlanAmazon RDS Read Replicas are open in writable modeAmazon RDS resource automated backups is turned offAmazon RDS sync_binlog parameter is turned offRDS DB Cluster has no Multi-AZ replication enabledRDS Multi-AZ Standby Instance Not EnabledAmazon RDS ReplicaLagAmazon RDS synchronous_commit parameter is turned offAmazon Redshift cluster automated snapshotsAmazon Route 53 Deleted Health ChecksAmazon Route 53 Failover Resource Record SetsAmazon Route 53 High TTL Resource Record SetsAmazon Route 53 Name Server DelegationsAmazon Route 53 Resolver Endpoint Availability Zone RedundancyAmazon S3 Bucket Replication Not EnabledAmazon S3 Bucket VersioningApplication, Network, and Gateway Load Balancers Not Spanning Multiple Availability ZonesAuto Scaling available IPs in SubnetsAuto Scaling Group Health CheckAuto Scaling Group ResourcesAWS CloudHSM clusters running HSM instances in a single AZAWS Direct Connect Location ResiliencyAWS Lambda functions without a dead-letter queue configuredAWS Lambda On Failure Event DestinationsAWS Lambda VPC-enabled Functions without Multi-AZ RedundancyAWS Outposts Single Rack deploymentAWS Resilience Hub Application Component checkAWS Resilience Hub policy breachedAWS Resilience Hub resilience scoresAWS Resilience Hub assessment ageAWS Site-to-Site VPN has at least one tunnel in DOWN statusAWS STS global endpoint usage across AWS RegionsAWS Well-Architected high risk issues for reliabilityClassic Load Balancer has no multiple AZs configuredCLB Connection DrainingELB Target ImbalanceGWLB - endpoint AZ independenceLoad Balancer OptimizationNAT Gateway AZ IndependenceNetwork Firewall endpoint AZ IndependenceNetwork Firewall Multi-AZNetwork Load Balancers Cross Load BalancingNLB - Internet-facing resource in private subnetNLB Multi-AZNumber of AWS Regions in an Incident Manager replication setSingle AZ Application CheckVPC interface endpoint network interfaces in multiple AZsVPN Tunnel RedundancyActiveMQ Availability Zone RedundancyRabbitMQ Availability Zone Redundancy +ALB Multi-AZAmazon Aurora MySQL cluster backtracking not enabledAmazon Aurora DB Instance AccessibilityAmazon CloudFront Origin FailoverAmazon Comprehend Endpoint Access RiskAmazon DocumentDB Single AZ ClustersAmazon DynamoDB Point-in-time RecoveryAmazon DynamoDB Table Not Included in Backup PlanAmazon EBS Not Included in AWS Backup PlanAmazon EBS SnapshotsAmazon EC2 Auto Scaling does not have ELB Health Check EnabledAmazon EC2 Auto Scaling Group has Capacity Rebalancing EnabledAmazon EC2 Auto Scaling is not deployed in multiple AZs or does not meet the minimum number of AZsAmazon EC2 Availability Zone BalanceAmazon EC2 detailed monitoring not enabledAmazon ECS AWSLogs driver in blocking modeAmazon ECS service using a single AZAmazon ECS Multi-AZ placement strategy Amazon EFS no mount target redundancyAmazon EFS not in AWS Backup planAmazon ElastiCache Multi-AZ clustersElastiCache (Redis OSS) Clusters Automatic BackupAmazon MemoryDB Multi-AZ clustersAmazon MSK brokers hosting too many partitionsAmazon MSK Cluster Multi-AZAmazon OpenSearch Service domains with less than three data nodesAmazon RDS BackupsAmazon RDS Continuous Backup Not EnabledAmazon RDS DB clusters have one DB instanceAmazon RDS DB clusters with all instances in the same Availability ZoneAmazon RDS DB clusters with all reader instances in the same Availability ZoneAmazon RDS DB Instance Enhanced Monitoring not enabledAmazon RDS DB instances have storage autoscaling turned offAmazon RDS DB instances not using Multi-AZ deploymentAmazon RDS DiskQueueDepthAmazon RDS FreeStorageSpaceAmazon RDS log_output parameter is set to tableAmazon RDS innodb_default_row_format parameter setting is unsafeAmazon RDS innodb_flush_log_at_trx_commit parameter is not 1Amazon RDS max_user_connections parameter is lowAmazon RDS Multi-AZAmazon RDS Not In AWS Backup PlanAmazon RDS Read Replicas are open in writable modeAmazon RDS resource automated backups is turned offAmazon RDS sync_binlog parameter is turned offRDS DB Cluster has no Multi-AZ replication enabledRDS Multi-AZ Standby Instance Not EnabledAmazon RDS ReplicaLagAmazon RDS synchronous_commit parameter is turned offAmazon Redshift cluster automated snapshotsAmazon Route 53 Deleted Health ChecksAmazon Route 53 Failover Resource Record SetsAmazon Route 53 High TTL Resource Record SetsAmazon Route 53 Name Server DelegationsAmazon Route 53 Resolver Endpoint Availability Zone RedundancyAmazon S3 Bucket LoggingAmazon S3 Bucket Replication Not EnabledAmazon S3 Bucket VersioningApplication, Network, and Gateway Load Balancers Not Spanning Multiple Availability ZonesAuto Scaling available IPs in SubnetsAuto Scaling Group Health CheckAuto Scaling Group ResourcesAWS CloudHSM clusters running HSM instances in a single AZAWS Direct Connect Location ResiliencyAWS Lambda functions without a dead-letter queue configuredAWS Lambda On Failure Event DestinationsAWS Lambda VPC-enabled Functions without Multi-AZ RedundancyAWS Outposts Single Rack deploymentAWS Resilience Hub Application Component checkAWS Resilience Hub policy breachedAWS Resilience Hub resilience scoresAWS Resilience Hub assessment ageAWS Site-to-Site VPN has at least one tunnel in DOWN statusAWS STS global endpoint usage across AWS RegionsAWS Well-Architected high risk issues for reliabilityClassic Load Balancer has no multiple AZs configuredCLB Connection DrainingELB Target ImbalanceGWLB - endpoint AZ independenceLoad Balancer OptimizationNAT Gateway AZ IndependenceNetwork Firewall endpoint AZ IndependenceNetwork Firewall Multi-AZNetwork Load Balancers Cross Load BalancingNLB - Internet-facing resource in private subnetNLB Multi-AZNumber of AWS Regions in an Incident Manager replication setSingle AZ Application CheckVPC interface endpoint network interfaces in multiple AZsVPN Tunnel RedundancyActiveMQ Availability Zone RedundancyRabbitMQ Availability Zone Redundancy @@ -122,0 +123,2 @@ You can use the following checks for the fault tolerance category. + * [Amazon S3 Bucket Logging](./fault-tolerance-checks.html#amazon-s3-bucket-logging) + @@ -3382,0 +3385,85 @@ Specify IP addresses in at least two Availability Zones for redundancy. +## Amazon S3 Bucket Logging + +**Description** + + +###### Important + +This check is deprecated in the commercial [AWS Regions](https://docs.aws.amazon.com/https://docs.aws.amazon.com/glossary/latest/reference/glos-chap.html?icmpid=docs_homepage_addtlrcs#region). + +Checks the logging configuration of Amazon Simple Storage Service (Amazon S3) buckets. + +When server access logging is enabled, detailed access logs are delivered hourly to a bucket that you choose. An access log record contains details about each request, such as the request type, the resources specified in the request, and the time and date the request was processed. By default, bucket logging is not enabled. You should enable logging if you want to perform security audits or learn more about users and usage patterns. + +When logging is initially enabled, the configuration is automatically validated. However, future modifications can result in logging failures. This check examines explicit Amazon S3 bucket permissions, but it does not examine associated bucket policies that might override the bucket permissions. + +**Check ID** + + +`BueAdJ7NrP` + +**Alert Criteria** + + + * Yellow: The bucket does not have server access logging enabled. + + * Yellow: The target bucket permissions do not include the root account, so Trusted Advisor cannot check it. + + * Red: The target bucket does not exist. + + * Red: The target bucket and the source bucket have different owners. + + * Red: The log deliverer does not have write permissions for the target bucket. + + + + +**Recommended Action** + + +Enable bucket logging for most buckets. See [Enabling Logging Using the Console](https://docs.aws.amazon.com/AmazonS3/latest/dev/enable-logging-console.html) and [Enabling Logging Programmatically](https://docs.aws.amazon.com/AmazonS3/latest/dev/enable-logging-programming.html). + +If the target bucket permissions do not include the root account and you want Trusted Advisor to check the logging status, add the root account as a grantee. See [Editing Bucket Permissions](https://docs.aws.amazon.com/AmazonS3/latest/UG/EditingBucketPermissions.html). + +If the target bucket does not exist, select an existing bucket as a target or create a new one and select it. See [Managing Bucket Logging](https://docs.aws.amazon.com/AmazonS3/latest/UG/ManagingBucketLogging.html). + +If the target and source have different owners, change the target bucket to one that has the same owner as the source bucket. See [Managing Bucket Logging](https://docs.aws.amazon.com/AmazonS3/latest/UG/ManagingBucketLogging.html). + +If the log deliverer does not have write permissions for the target (write not enabled), grant Upload/Delete permissions to the Log Delivery group. See [Editing Bucket Permissions](https://docs.aws.amazon.com/AmazonS3/latest/UG/EditingBucketPermissions.html). + +**Additional Resources** + + + * [Working with Buckets](https://docs.aws.amazon.com/AmazonS3/latest/UG/BucketOperations.html) + + * [Server Access Logging](https://docs.aws.amazon.com/AmazonS3/latest/dev/ServerLogs.html) + + * [Server Access Log Format](https://docs.aws.amazon.com/AmazonS3/latest/dev/LogFormat.html) + + * [Deleting Log Files](https://docs.aws.amazon.com/AmazonS3/latest/dev/deleting-log-files-lifecycle.html) + + + + +**Report columns** + + + * Status + + * Region + + * Bucket Name + + * Target Name + + * Target Exists + + * Same Owner + + * Write Enabled + + * Reason + + + +