Locking logs files in S3 of the Log archive account

[Martinagsr]

Does it can be a good idea to activate S3 Object lock when creating the logging bucket?

Prevent admin, security or anyone to replace or modify log's files.

[Brian969]

Hi, Sorry for the delay!

You can enable if desired (manually), why have we not done it to-date?

• WORM is not required for many "Medium" level security control profiles;
• some services didn't/don't support object lock with their logs;
• CloudTrail also provides file hashes to further protect file integrity;
• turning on hard/firm compliance feature when a new customer may not fully understand their retention requirements can cause 1-way door challenges;
• no writable IAM roles should exist in log-archive account;
• bucket versioning is enabled, saving all file versions;
• log filenames all contain unique hashes
• these buckets are SCP protected

All this said, if you are comfortable, you can manually enable without impact to the ASEA automation.

[Martinagsr]

Hi,

No need to have a writable IAM role, the bucket policy permit everyone in the organisation.
It can be enable only by AWS after the creation.