aws cloudtrail describe-trails --query "trailList[?contains(S3BucketName, 'public-accessible-bucket')]" --output json

aws s3api put-bucket-acl --bucket BUCKET_NAME --acl private

aws s3api delete-bucket-policy --bucket BUCKET_NAME

import boto3

class CloudTrailChecker:
    def __init__(self):
        self.cloudtrail_client = boto3.client('cloudtrail')
        self.s3_client = boto3.client('s3')

    def get_publicly_accessible_trails(self):
        failures = []
        response = self.cloudtrail_client.describe_trails()
        for trail in response['trailList']:
            if self.is_trail_public(trail):
                failures.append(trail)
        return failures

    def is_trail_public(self, trail):
        bucket_name = trail.get("S3BucketName", "")
        bucket_acl = self.s3_client.get_bucket_acl(Bucket=bucket_name)
        bucket_policy = self.s3_client.get_bucket_policy(Bucket=bucket_name)
        
        for grant in bucket_acl.get("Grants", []):
            if grant.get("Grantee", {}).get("URI", "") in [
                "http://acs.amazonaws.com/groups/global/AllUsers",
                "http://acs.amazonaws.com/groups/global/AuthenticatedUsers",
            ] and grant.get("Permission", None) == "FULL_CONTROL":
                return True
        
        statements = bucket_policy.get("Policy", {}).get("Statement", [])
        for statement in statements:
            if statement.get("Effect", "") == "Allow" and statement.get("Principal", "") == "*":
                return True
        
        return False

    def remediate_public_trail(self, trail_name):
        bucket_name = self.cloudtrail_client.describe_trails(trailNameList=[trail_name])['trailList'][0]['S3BucketName']
        
        # Remove public access from bucket ACL
        self.s3_client.put_bucket_acl(
            Bucket=bucket_name,
            ACL='private'
        )
        
        # Remove public access from bucket policy
        self.s3_client.delete_bucket_policy(
            Bucket=bucket_name
        )
        
        print(f"Public access has been removed from the CloudTrail trail {trail_name}.")

# Instantiate the class
checker = CloudTrailChecker()

# Get trails with publicly accessible buckets
public_trails = checker.get_publicly_accessible_trails()

# Remediate public trails
for trail in public_trails:
    checker.remediate_public_trail(trail['Name'])

# CloudTrail trail writing to an S3 bucket
resource "aws_cloudtrail" "cloudtrail" {
  name           = "CLOUDTRAIL_NAME"
  s3_bucket_name = aws_s3_bucket.cloudtrail_logs.bucket
  # ...other required arguments...
}

# CloudTrail logs S3 bucket
resource "aws_s3_bucket" "cloudtrail_logs" {
  bucket = "CLOUDTRAIL_LOG_BUCKET_NAME"
  # ...other required arguments...
}

# Enable S3 Block Public Access on the CloudTrail bucket
# (matches: aws s3api put-public-access-block ... BlockPublicAcls=true, IgnorePublicAcls=true,
#  BlockPublicPolicy=true, RestrictPublicBuckets=true)
resource "aws_s3_bucket_public_access_block" "cloudtrail_logs" {
  bucket = aws_s3_bucket.cloudtrail_logs.id

  block_public_acls       = true
  ignore_public_acls      = true
  block_public_policy     = true
  restrict_public_buckets = true
}

# OPTIONAL: If you currently have an aws_s3_bucket_policy that makes the bucket public,
# remove the public "Principal": "*" statements or the entire policy.
# This example keeps only the minimum CloudTrail permissions and is NOT public:
resource "aws_s3_bucket_policy" "cloudtrail_logs" {
  bucket = aws_s3_bucket.cloudtrail_logs.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid       = "AWSCloudTrailWrite"
        Effect    = "Allow"
        Principal = { Service = "cloudtrail.amazonaws.com" }
        Action    = "s3:PutObject"
        Resource  = "${aws_s3_bucket.cloudtrail_logs.arn}/AWSLogs/ACCOUNT_ID/*"
        Condition = {
          StringEquals = {
            "s3:x-amz-acl" = "bucket-owner-full-control"
          }
        }
      },
      {
        Sid       = "AWSCloudTrailAclCheck"
        Effect    = "Allow"
        Principal = { Service = "cloudtrail.amazonaws.com" }
        Action    = "s3:GetBucketAcl"
        Resource  = aws_s3_bucket.cloudtrail_logs.arn
      }
    ]
  })
}