Will It Vibe?S3 bucket without access logging
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 4 points from that category, once per scan, no matter how many places it turns up.
What it detects
An aws_s3_bucket has no logging block and no companion aws_s3_bucket_logging resource, so there is no server access log to investigate abuse or exfiltration. This is a structural heuristic and is suppressed when a logging resource is present.
Why it matters
Without access logging there is no record of who read or wrote objects, so a data exposure cannot be scoped or investigated after the fact. Server access logs are the primary forensic trail for a bucket. This check is a heuristic and is suppressed when a companion aws_s3_bucket_logging resource is present.
How to fix it
Add an aws_s3_bucket_logging resource pointing at a dedicated log-target bucket (not the bucket being logged). Restrict and encrypt the log bucket, and set a lifecycle policy to age logs out. Consider enabling CloudTrail data events for object-level auditing on sensitive buckets.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo