Question

A security engineer configures a new CloudTrail trail to deliver logs to a centralized S3 bucket in a dedicated logging account. The trail is created successfully in the source account, but no log files ever appear in the destination bucket. CloudTrail shows no delivery errors in the console for the first few hours. The bucket has default SSE-S3 encryption enabled and a bucket policy that was recently modified to add a condition requiring the aws:SecureTransport key. What is the MOST likely cause of the missing log files?

Accepted Answer

The S3 bucket policy does not grant the CloudTrail service principal (cloudtrail.amazonaws.com) the s3:PutObject and s3:GetBucketAcl permissions required to write log files.

Answer

CloudTrail cannot deliver logs to an S3 bucket that uses SSE-S3 encryption; the bucket must use SSE-KMS with a key policy granting CloudTrail access.

Answer

Cross-account log delivery from a source account to a logging account is not supported by CloudTrail and requires an organization trail instead.

Answer

The aws:SecureTransport condition blocks CloudTrail because the service delivers logs over unencrypted HTTP connections.