Using AWS config to automate non-compliance S3 server access logging policy

In the Creating custom dashboards to monitor Data Lake services recipe, we learned that the S3 Storage Lens provides a general dashboard to observe your S3 activities. One of the best practices for more comprehensive monitoring and auditing of your bucket is enabling S3 server access logging. This feature gives you detailed records of the requests made to the buckets, which is helpful in scenarios wherein you need to detect potential security weaknesses and incidents. This recipe will teach you to use AWS Config and AWS SSM to enforce this feature.

You can use the idea in this recipe to create more enforcement not only for S3 but also for other resources in your Data Lake.

Getting ready

Ensure that you enable AWS Config and AWS SSM in your account. You also need to finish setting up the AWS SSM role as covered in the Setting up System Manager to remediate non-compliant AWS Config rules recipe.

Besides...