- 最新
- 最多得票
- 最多評論
The reason why it's done is because it's AWS best practice to enable logging on all S3 buckets. However, the logging bucket is, and should be, the one exception to that rule for the reasons you've pointed out. It therefore means that a customer should implement other controls to ensure that undesired access or actions cannot be taken against the logging bucket as no actions will be recorded.
At this time, it's a configuration that customers can remove but AWS implements to provide a "secure by default" configuration, even if it may cause a undesired circular pattern which has a detrimental effect on customers. There is a mechanism by which you can request this be updated and addressed by working with your account manager or through a support ticket.
相關內容
- 已提問 5 個月前
- AWS 官方已更新 3 年前
- AWS 官方已更新 2 年前
For anyone running into this now. The issue raised here have been addressed. Please check out - https://aws.amazon.com/about-aws/whats-new/2023/02/aws-control-tower-logging-exceptions-global-services-region-deny/