Operational Excellence

Checks the logging configuration of Amazon Simple Storage Service buckets.

Activating server access logging delivers detailed hourly access logs to a specified Amazon S3 bucket. Access logs contain request details including type, specified resources, and processing time/date. Logging is turned off by default. Customers should activate access logging to perform security audits or analyze user behavior and usage patterns.

When logging is initially activated, the configuration is automatically validated. However, future modifications can result in logging failures. Note that currently this check doesn’t examine Amazon S3 bucket write permissions.

c1fd6b96l4

Activate server access logging for all relevant Amazon S3 buckets. Server access logs provide an audit trail that can be used to understand bucket access patterns and investigate suspicious activity. Activating logging on all applicable buckets will improve visibility into access events across your Amazon S3 environment. See Enabling Logging Using the Console and Enabling Logging Programmatically.

If the target bucket permissions do not include the root account and you want Trusted Advisor to check the logging status, add the root account as a grantee. See Editing Bucket Permissions.

If the target bucket does not exist, select an existing bucket as a target or create a new one and select it. See Managing Bucket Logging.

If the target and source have different owners, change the target bucket to one that has the same owner as the source bucket. See Managing Bucket Logging.

Working with buckets

Server access logging

Server access log format

Deleting log files

Checks for Amazon Elastic Compute Cloud (Amazon EC2) instances running on Nitro system version 4 using outdated Elastic Network Adapter (ENA) drivers. To take advantage of the Nitro performance improvements using the accelerated path, you must update your ENA driver to a version compatible with NitroV4, as outlined in the Amazon EC2 Instance Types guide. To make this change directly, update your driver, or you can update your operating system to a version that is configured with a compatible driver.

For Nitro system version 5 and later based instances, the minimum driver versions in the Amazon EC2 Instance Types guide are required. Amazon recommends upgrading to the latest ENA driver version to benefit from performance improvements, bug fixes, and security enhancements. Starting with Nitro system version 5 or later, outdated ENA drivers fail to bind to instances after launch, which prevents network communication.

c17gc3v72d

Yellow: Amazon EC2 instances on Nitro system version 4 are using ENA driver versions older than Linux 2.2.9 or Windows 2.2.3.

Update to newer ENA drivers (Linux 2.2.9+, Windows 2.2.3+, DPDK ENA PMD v2.2.0+) to access accelerated path features that are unavailable in older versions. DPDK users can either move to DPDK 20.11+ (which includes DPDK ENA PMD v2.2.0+) or apply DPDK ENA PMD backports directly from GitHub without changing their DPDK release.

For existing instances, perform this update when it's convenient to reboot your instance. Update your operating system or ENA driver to the latest supported version for your operating system, and then reboot your instance. For Linux instances, update to ENA driver version 2.2.9 or later. For Windows instances, update to version 2.2.3 or later.

For new instance launches, build and use updated AMIs with the latest ENA drivers preinstalled using Amazon EC2 Image Builder.