Ensure the S3 bucket used to store CloudTrail logs is not publicly accessible

How to fix it

• Overwrites existing settings: Setting the ACL to private, as the Terraform and CLI routes do, removes every grant on the bucket but the owner's, not only the public ones.
• Can break clients: Keep the bucket policy statements that let CloudTrail write to this bucket, or the trail stops delivering its logs.

In the console

S3 → the bucket in the trail’s storage location → Permissions → Access control list, and Bucket policy

Everyone (public access)

Objects List cleared; a READ or FULL_CONTROL grant to this group fails the check

Authenticated Users group (anyone with an AWS account)

Objects List cleared; a READ or FULL_CONTROL grant to this group fails the check

Bucket policy

No Allow of s3:GetObject, s3:GetObjectVersion or s3:GetObjectAcl to everyone unless a Condition pins fixed values

With the AWS CLI

aws s3api put-bucket-acl --bucket <log-bucket-name> --acl private

With Terraform

resource "aws_s3_bucket_acl" "this" {
  bucket = aws_s3_bucket.cloudtrail_logs.id
  acl    = "private"
}