4

I have two buckets, one named A and another named logs. I went to the permissions page for A and enabled service logging, and set the target to logs bucket. According to the AWS documentation, this should enable logging.

Amazon S3 uses a special log delivery account, called the Log Delivery group, to write access logs. These writes are subject to the usual access control restrictions. You must grant the Log Delivery group write permission on the target bucket by adding a grant entry in the bucket's access control list (ACL). If you use the Amazon S3 console to enable logging on a bucket, the console both enables logging on the source bucket and updates the ACL on the target bucket to grant write permission to the Log Delivery group.

I let the buckets sit for hours before uploading a file to A, but I see no logs anywhere. Did I understand the above paragraph wrong and have to generate a bucket policy for logs? Or is there something else I'm missing?

  • It should enable logging, but check the permissions on the target bucket. It shouldn't require a bucket policy (and if you have a bucket policy, it must not inadvertently block logging), but you should see an entry in the permissions for the bucket. Check that? Also ensure that the two buckets are in the same region. The console should force that, but this could be the issue, if not. – Michael - sqlbot May 30 '18 at 12:15
  • >but you should see an entry in the permissions for the bucket Not sure what this means. Do you have an example of what it would look like? Nothing seems different than before except in LogDelivery I see Read bucket permissions and Write permissions checked. The buckets are in the same region. – jeebface May 31 '18 at 2:17
  • 1
    Well, i deleted all the buckets and tried again and it's working. Not sure why it wasnt working for the other bucket but this makes my question obsolete. – jeebface Jun 2 '18 at 1:17
0

This part of reference is wrong.

"If you use the Amazon S3 console to enable logging on a bucket, the console both enables logging on the source bucket and updates the ACL on the target bucket to grant write permission to the Log Delivery group."

It can't guaranty that it always updates the ACL on the target bucket successfully. If you logging target is in "Block public access to buckets and objects granted through new access control lists (ACLs)", update will fail. So your logging bucket won't work as expected.

You should check logging bucket. Go to Permissions, check if "S3 log delivery group" is enabled in Public Access.

New contributor
Bryan is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.