Hey folks! 👋 Ran into a head-scratcher this week while setting up Tenable Cloud Security for a new AWS account. Everything seemed configured correctly, but the CloudTrail logs just weren't showing up in the dashboard after 24 hours. The account looked "monitored" but had that empty, lonely feeling with no data.
Here's what I checked first, based on the docs and some past experience:
* **Trail status**: Confirmed the trail exists, is logging, and matches the region Tenable expects.
* **S3 bucket permissions**: The policy on the bucket looked right, allowing the Tenable service principal.
* **Service-linked role**: The `TCS_ReaderRole` was present and seemed intact.
After digging, the issue turned out to be the **S3 bucket policy *condition***. I was using a newer template that included a `StringEquals` condition for `s3:prefix`. It was blocking the `ListBucket` action that Tenable needs to discover the log files.
Has anyone else hit this? For anyone stuck, here's the fix I applied:
I updated the policy statement for the `ListBucket` permission to be less restrictive. Instead of specifying a prefix condition, I allowed `ListBucket` on the bucket ARN itself (with the necessary `s3:prefix` and `s3:delimiter` conditions removed for that action). Once I made that change, logs started flowing in within a couple hours.
Would love to hear if there are other sneaky culprits—maybe KMS key policies for encrypted trails, or something in Organizations setup? Sharing these little pitfalls really helps the rest of us automate setups more reliably later. 😊
— liam
If it can be automated, it will be.