How can I audit deleted or missing objects from my Amazon S3 bucket?
Last updated: 2022-02-23
There's an object or file that's missing from my Amazon Simple Storage Service (Amazon S3) bucket. Where can I find information about how the object or file was deleted? How can I prevent future accidental deletions?
To find out how an S3 object was deleted, you can review either server access logs or AWS CloudTrail logs.
Note: Logging must be enabled on the bucket before the deletion event occurs. You receive logs only for events that occurred after logging was enabled.
Server access logs track S3 operations performed manually or as part of a lifecycle configuration. To enable server access logging, see How do I enable server access logging for an S3 bucket? For more information on how to analyze server access logs, see How do I analyze my Amazon S3 server access logs using Athena?
CloudTrail logs can track object-level data events in an S3 bucket, such as GetObject, DeleteObject, and PutObject. To enable CloudTrail logs for object-level events, see How do I enable object-level logging for an S3 bucket with AWS CloudTrail data events? For more information on how to find specific events, see I enabled object-level logging for my Amazon S3 bucket. Where can I find the events in the CloudTrail event history?
Note: By default, CloudTrail records bucket-level events. To get logs for object-level operations like GetObject, DeleteObject, and PutObject, you must configure object-level logging. Object-level logging incurs additional charges, so be sure to review the pricing for CloudTrail data events.
To prevent or mitigate future accidental deletions, consider the following features: