Locking Down Log Storage Buckets

CloudTrail, Config, and Flow Logs ultimately store data in S3 buckets. That bucket is the crown jewel of your audit trail, so it deserves the strongest protections. If the bucket is secure, an attacker who compromises a workload still cannot reach the evidence of what they did.

The first control is S3 Block Public Access, ensuring the log bucket is never exposed to the internet. A publicly readable log bucket leaks sensitive operational detail to anyone. Enabling Block Public Access at the account and bucket level closes this risk decisively.