how to make cloud trail log files publicly readable

Question

Cloud trail is keeping all its log file in S3 bucket. Bucket's Permission: Object Access is set to "Read" for Everyone When you click on bucket and you reach the point where you see your log file.

then we see file's Permission: Object Access is not set to read or write by Everyone.

score 2 · Answer 1 · answered May 09 '17 at 01:16

You will need to create an Amazon S3 bucket policy. For example:

{
  "Version":"2012-10-17",
  "Statement":[
    {
      "Sid":"AddPerm",
      "Effect":"Allow",
      "Principal": "*",
      "Action":["s3:GetObject"],
      "Resource":["arn:aws:s3:::cloudtrail-bucket/logs/*"]
    }
  ]
}

However, making your CloudTrail logs fully public is not wise from a security viewpoint, because people could obtain information about your account that they could use to compromise security (eg instances launched, data stored, usernames). You really should only provide access to authorized users.

how to make cloud trail log files publicly readable

1 Answers1