When access logging is enabled, SecureBucket creates a second bucket via createAccessLogBucket() (src/resources/s3-bucket/secure-bucket.ts:152-165). Tests assert the primary bucket's hardening and that a log bucket exists, but nothing asserts the log bucket's own posture — the one bucket holding audit evidence is the one nothing verifies.
What to test (template assertions against the AccessLogBucket resource)
- SSE-S3 encryption, block-public-access all-on, SSL-only bucket policy.
- Versioning enabled.
DeletionPolicy/UpdateReplacePolicy of Retain.- The 90-day
delete-old-logs lifecycle expiration rule.
Acceptance criteria
- A regression that weakens the access-log bucket fails the suite.
When access logging is enabled,
SecureBucketcreates a second bucket viacreateAccessLogBucket()(src/resources/s3-bucket/secure-bucket.ts:152-165). Tests assert the primary bucket's hardening and that a log bucket exists, but nothing asserts the log bucket's own posture — the one bucket holding audit evidence is the one nothing verifies.What to test (template assertions against the AccessLogBucket resource)
DeletionPolicy/UpdateReplacePolicyofRetain.delete-old-logslifecycle expiration rule.Acceptance criteria