Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket

How to fix it

• Affects another check: This also clears S3.9 for the log bucket, which reads the same server access logging setting.

In the console

S3 → the bucket in the trail’s storage location → Properties → Server access logging

Server access logging

Enable

Destination bucket

Another bucket, same Region and account, no Object Lock, letting logging.s3.amazonaws.com write (the console adds it)

With the AWS CLI

aws s3api put-bucket-logging --bucket <log-bucket-name> --bucket-logging-status '{"LoggingEnabled":{"TargetBucket":"<access-log-bucket-name>","TargetPrefix":"s3-access-logs/"}}'

With Terraform

resource "aws_s3_bucket_logging" "this" {
  bucket        = var.log_bucket_name
  target_bucket = var.access_log_bucket_name
  target_prefix = "s3-access-logs/"
}