Description
debug_botocore_endpoint_logs is a diagnostic option that reports the distinct AWS API actions called during an Ansible task in its resource_actions result. It does not enable S3 server access logging. Setting it to false does not establish that bucket audit logs are absent.
Potential impact
- Without diagnostic output, identifying the API actions used by an Ansible task may be less convenient.
- Treating this output as an audit log can leave other clients’ bucket access and individual requests unaccounted for.
Remediation
- Use the diagnostic option when investigating a task’s API calls. It does not need to be enabled routinely as a security control.
- Configure S3 server access logging or the required CloudTrail data events separately for bucket access auditing.
- Verify log delivery, access permissions and retention. Diagnostic output does not replace ongoing audit collection.
Examples
These examples only compare Ansible API diagnostics. Neither configures S3 server access logging.
Before
yaml
- name: S3 버킷 생성
amazon.aws.s3_bucket:
name: mys3bucket
state: present
debug_botocore_endpoint_logs: false
debug_botocore_endpoint_logs: false disables this task’s API diagnostics. It does not turn off separately configured S3 audit logs.
After
yaml
- name: S3 버킷 생성
amazon.aws.s3_bucket:
name: mys3bucket
state: present
debug_botocore_endpoint_logs: true
debug_botocore_endpoint_logs: true enables the distinct API-action output in the task result. It is not a control that records every bucket request.