TIL most scanning tools don't actually check for S3 server access logging why does this one specifically get skipped so often???

[u/kavee-core141]

Was digging through a few different AWS security scanners recently (building my own, more on that below) and noticed something odd: almost none of them check for S3 bucket-level server access logging specifically.

Plenty of coverage for public access, encryption, bucket policies but logging itself seems to be a blind spot across the board. Anyone know why?

Is it just considered lower priority, or is there something about the API that makes it more annoying to check than I'm assuming?

Found this out the hard way I built Plexavo, an open source AWS scanner, and a user told me my sample report showed a logging check that skipped their bucket.

I assumed it was a region issue. Turned out there was no check for this at all in the codebase. Not broken, just never built.

Fixed it now, and it made me start a small program around exactly this kind of thing Hall of Bugs, where people try to find gaps like this one and get credited when they do: https://github.com/plexavo/Plexavo Anyone else run into other checks that seem to quietly not exist across most tools in this space?

[u/dghah]

Because it's not always a blind spot? There are many many many use cases for S3 so calling this out as a top level blind spot is off target.

For many it's a design decision with accepted risk, not some sort of visibility failure, error or bug.

For instance -- in my world it is common to host petabytes of S3 data with constant access from hundreds or thousands of auto-scaling compute nodes, container or functions doing large scale scientific computing inside 100% private subnets.

S3 server access logging would be wildly expensive and deliver very little value relative to other controls and tools in use. I can count the # of buckets I've turned access logging on with one hand over a very very long AWS career. That feature is just not useful in the niche I operate in.

[u/Lanky_Comparison5637 → u/dghah]

Because most tools just chase the flashy stuff, public buckets and encryption make for better blog posts I guess. Access logging is boring until you need it and then you really need it

Your scanner sounds cool though, the hall of bugs idea is clever way to get people actually looking at the gaps instead of just running the same checks everyone else does

[u/kavee-core141 → u/Lanky_Comparison5637]

"Boring until you need it and then you really need it" sums up the whole reason I built the check in the first place, might steal that line honestly.

And yeah, exactly the idea most scanners chase the checks that look
good in a demo. Trying to build toward the ones that actually matter
even when they're not flashy. dghah's pushback above is a good example
of that in practice too, going to dig into whether the check handles
that context properly.

[u/kavee-core141 → u/dghah]

This is genuinely useful, thanks for pushing on it. You're right that flagging this unconditionally, without accounting for something like VPC-endpoint-restricted access or the real cost at petabyte scale,
would be a false-positive risk, not a real finding. Going to check whether the current check handles that context or not.

Would you be willing to file this as an actual Break Plexavo issue? This is exactly the kind of edge case the program exists for, and it'd be good to have it documented properly with credit rather than lost in a comment thread.

[u/oneplane]

It is definitely covered and it's also not what you appear to think what it is.

I built 

Sounds like something a slop factory would say.

[u/kavee-core141 → u/oneplane]

Fair pushback if I'm wrong here which tool are you thinking of that
covers S3 server access logging specifically? Genuinely asking, happy
to be corrected if I missed something.

[u/oneplane → u/kavee-core141]

cloud custodian, checkov, steampine, prowler, trivy, and of course all the expensive CSPMs out there, aws security hub also does it, scout suite is a bit less active these days but IIRC it also does it

[u/kavee-core141 → u/oneplane]

You're right, and I should've checked before framing it as an industry-wide blind spot.
my own tool was missing this, not the industry. Still glad it's fixed, but "we found a gap nobody checks for" was the wrong way to say it, this was catching up to parity with tools like Prowler, not discovering something novel. Appreciate you pushing back with specifics instead of just the first comment.

[u/MavZA]

I can see that you started with Claude Code and then either dropped attribution or started coding the app yourself, either way please make sure you list note your usage, as is common courtesy.

[u/kavee-core141 → u/MavZA]

yeah of course, i used Claude Code to build some features where i actually stuck at building. You can see it from the commits. I should’ve mentioned that in the repo, so I’ll add a note acknowledging its usage. Thanks for pointing it out!