Wondering how to enable CloudTrail event logging for S3 buckets? We can help you.

Here, at Bobcares, we assist our customers with several AWS queries as part of our AWS Support Services.

Today, let us see how our Support techs assist with this query.

How to enable CloudTrail event logging for S3 buckets?

CloudTrail stores Amazon S3 data event logs in an S3 bucket of your choosing.

Consider using a bucket in a separate AWS account to better organize events from multiple buckets you might own into a central place for easier querying and analysis.

AWS Organizations makes it easy to create an AWS account that is linked to the account owning the bucket that you are monitoring.

When you create a trail in CloudTrail, in the data events section, you can select the Select all S3 buckets in your account check box to log all object level events.

Enable logging for objects in a bucket using the console

You can use the Amazon S3 console to configure an AWS CloudTrail trail to log data events for objects in an S3 bucket.

CloudTrail supports logging Amazon S3 object-level API operations such as GetObject, DeleteObject, and PutObject.

These events are called data events.

By default, CloudTrail trails don’t log data events.

But you can configure trails to log data events for S3 buckets that you specify, or to log data events for all the Amazon S3 buckets in your AWS account.

CloudTrail does not populate data events in the CloudTrail event history.

Additionally, not all bucket-level actions are populated in the CloudTrail event history.

To configure a trail to log data events for an S3 bucket, you can use either the AWS CloudTrail console or the Amazon S3 console.

If you are configuring a trail to log data events for all the Amazon S3 buckets in your AWS account, it’s easier to use the CloudTrail console.

To enable CloudTrail data events logging for objects in an S3 bucket

1. Firstly, sign in to the AWS Management Console and open the Amazon S3 console at https://console.aws.amazon.com/s3/

2. In the Buckets list, choose the name of the bucket.

3. Then, choose Properties.

4. Under AWS CloudTrail data events, choose Configure in CloudTrail.

You can create a new CloudTrail trail or reuse an existing trail and configure Amazon S3 data events to be logged in your trail.

If you use the CloudTrail console or the Amazon S3 console to configure a trail to log data events for an S3 bucket.

The Amazon S3 console shows that object-level logging is enabled for the bucket.