Why does AWS Control Tower enable access logging on the access logging bucket?

Question

After setting up AWS Control Tower I noticed that the S3 access logging bucket created under the Log Archive account, has logging enabled (and logging to the same bucket). This creates a situation where even doing nothing, the log bucket fills with recursive logs - any time a file is written to the log bucket, it generate another event to log to the log bucket. This just creates clutter and increased cost - is there any value in doing this? Or is this a bug/oversight?

niris
6 months ago
For anyone running into this now. The issue raised here have been addressed. Please check out - https://aws.amazon.com/about-aws/whats-new/2023/02/aws-control-tower-logging-exceptions-global-services-region-deny/

Answer

The reason why it's done is because it's AWS best practice to enable logging on all S3 buckets.  However, the logging bucket is, and should be, the one exception to that rule for the reasons you've pointed out.  It therefore means that a customer should implement other controls to ensure that undesired access or actions cannot be taken against the logging bucket as no actions will be recorded.

At this time, it's a configuration that customers can remove but AWS implements to provide a "secure by default" configuration, even if it may cause a undesired circular pattern which has a detrimental effect on customers.   There is a mechanism by which you can request this be updated and addressed by working with your account manager or through a support ticket.

Why does AWS Control Tower enable access logging on the access logging bucket?

Relevant content