AWS CloudTrail is a key service for governance and risk auditing because it tracks all AWS account activity and actions. The logs generated by CloudTrail contain sensitive information that is stored in S3 buckets, so you need to take every precaution to protect those buckets and the integrity of the logs. If CloudTrail logs fall into the wrong hands – an attacker, a third party, or even an employee that shouldn’t have access – they could use the information to identify your weak or misconfigured areas. By using bucket policies, you can manage and monitor the access to your S3 buckets at all times. For more information, visit the AWS documentation on S3 bucket policies for CloudTrail.

CloudTrail logs are stored in an S3 bucket. That’s a particularly important S3 bucket to protect. You need to monitor the access of that S3 bucket because you need to know who has gotten into your logs and have a good understanding of why. This protects the integrity of the logs and aides in forensic investigations and incident response if you know that your logs are accurate and unadulterated.