S3 Object Lock on CloudTrail bucket
Description
S3 Object Lock enabled on CloudTrail logs bucket for tamper-resistant retention.
⚠️ Risk Impact
Without Object Lock, an admin can delete CloudTrail log objects + cover tracks. Object Lock prevents deletion regardless of permission level.
🔍 How EchelonGraph Detects This
EchelonGraph's Tier 1 Cloud Scanner automatically checks for this condition across all connected AWS accounts. Violations are flagged as high-severity findings with remediation guidance.
🔧 Remediation
aws s3api put-object-lock-configuration on CloudTrail bucket. Compliance mode + retention period >= compliance minimum (PCI 1yr, HIPAA 6yr).
💀 Real-World Attack Scenario
An attacker compromised an admin + deleted CloudTrail logs for the period of their activity. Without Object Lock, the deletion succeeded; forensic timeline reconstruction failed. With Object Lock, the deletion would have been blocked.
💰 Cost of Non-Compliance
Log tampering during breach: $2-5M additional forensic cost (Mandiant).
📋 Audit Questions
- 1.Object Lock on CloudTrail bucket?
- 2.Compliance mode?
- 3.Retention period meets requirements?
🎯 MITRE ATT&CK Mapping
⚡ Common Pitfalls
- ⛔Object Lock not enabled on log buckets
- ⛔Governance mode used (admin can override)
- ⛔Retention period too short
📈 Business Value
Tamper-proof log retention is foundational to forensic capability.
⏱️ Effort Estimate
30 minutes
EchelonGraph monitors Object Lock on log buckets
🔗 Cross-Framework References
Automate CIS AWS 3.6 compliance
EchelonGraph continuously monitors this control across all your cloud accounts.
Start Free →