Pipeline s3 bucket doesn't have server access logging enabled

[gabelton]

Similar to this issue (thanks again for sorting so quickly), a pen test highlighted that the bucket created by copilot pipeline init doesn't have server access logging enabled. Is this by design?

[KollaAdithya]

Hello @gabelton 👋

Can you explain me your use case of server access logging for PipelineArtifactBucket. Do you want to store the access logs to another S3 bucket(target).

[gabelton]

We can push back on the security recommendation, but currently when we create an s3 env addon, we also create a separate logging bucket and store access logs there. Ideally we'd do something similar for this artifact bucket too, in order to be compliant

[KollaAdithya]

I can see some of the security concerns mentioned in this doc.

Access log information can be useful in security and access audits. It can also help you learn about your customer base and understand your Amazon S3 bill.

Ask:

Store access logs(includes all the requests made on S3) of PipelineArtifactBucket to target S3 bucket(create a new S3 bucket to store these logs).

Link to doc to enable server logs: https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-server-access-logging.html

[misaka]

This has also been highlighted in a pen test on a project I'm working on.

[gabelton]

Hi again, @KollaAdithya

I don't suppose you have any rough idea of when we might expect to see this enhancement added? Our cyber team are asking