S3 bucket has no server access logs

What it means

The bucket does not write server access logs to another bucket.

Why it matters

Access logs are the only record of who read what. Without them, the question after an incident — did anyone actually download this — has no answer at all, and "we think not" is not something you can tell a customer or a regulator.

How to fix it

Set `serverAccessLogsBucket` to a separate logging bucket. Do not point it at itself: that creates a feedback loop of log writes generating log entries.

See it fail

This stack trips AwsSolutions-S1 for real. Open it in the playground, press Run, and the finding appears with everything else the engine has to say about it.

Other rules