Restrict public read to server access logging folder in S3 - amazon-web-services

Question

I have a public S3 bucket with read-only access. Then I enabled server access logging to the current bucket but I'm afraid that other users could view the access log anonymously for their own use so I put a deny policy to the /access-logs folder. However, server access logging now is not working since I put Deny effect to the statement as documented in here. Is there any method to enable logging while restrict the access folder only to the bucket owner?
{
"Version": "2012-10-17",
"Id": "S3-Console-Auto-Gen-Policy-1234567",
"Statement": [
{
"Sid": "S3PolicyStmt-DO-NOT-MODIFY-1234567",
"Effect": "Allow",
"Principal": {
"Service": "logging.s3.amazonaws.com"
},
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::example-bucket/*"
},
{
"Sid": "PublicReadGetObject",
"Effect": "Allow",
"Principal": "*",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::example-bucket/*"
},
{
"Sid": "RestrictAccessLOgs",
"Effect": "Deny",
"Principal": "*",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::example-bucket/access-logs/*"
}
]
}

Answer 1

You should not put the logs in the same bucket as Coward Anon user said. You can use one bucket to store logs from many different buckets but one should not store logs from itself.
Your target bucket should not have server access logging enabled. You can have logs delivered to any bucket that you own that is in the same Region as the source bucket, including the source bucket itself. However, this would cause an infinite loop of logs and is not recommended. For simpler log management, we recommend that you save access logs in a different bucket.
It's much simpler to do it and set your logs bucket to private (default).
Not recommended, this is just to get you to know about NotPrincipal
{
"Sid": "RestrictAccessLOgs",
"Effect": "Deny",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::example-bucket/access-logs/*",
"NotPrincipal": {
"Service": ["logging.s3.amazonaws.com"]
}
}