I enabled object-level logging for my Amazon S3 bucket. Where can I find the events in the CloudTrail event history?

Last updated: 2019-09-26

I followed the instructions to enable object-level logging for an S3 bucket with AWS CloudTrail Data Events. I found the object-level log in my Amazon Simple Storage Service (Amazon S3) bucket. However, I can't find the object-level API action in the CloudTrail event history.

Short Description

CloudTrail logs bucket-level actions as management events by default. You can also configure a trail to log data events for an Amazon S3 bucket. CloudTrail does not populate data events in CloudTrail event history. Additionally, not all bucket-level actions are populated in CloudTrail event history.

Note: If you have other data sources configured for the same S3 bucket as your trail, the logs are combined with CloudTrail events.

For more information, see Logging Amazon S3 API Calls by Using AWS CloudTrail.

Resolution

Use Amazon CloudWatch log filter patterns and AWS Athena to query CloudTrail logs.

Use CloudWatch log filter patterns to view bucket level activity

1.    Follow steps 1-4 in Search Log Data Using Filter Patterns.

2.    In Filter, paste the following example syntax, and then choose enter on your device:

{$.eventName = “DeleteBucket”}

CloudTrail log data filters the bucket-level API call DeleteBucket.

Use Athena to query CloudTrail logs

1.    Open the Athena console, and then choose Query Editor.

2.    Choose Run advanced queries in Amazon Athena.

3.    Enter a query similar to the following, and then choose Run query.

Note: Replace example-cloudtrail-log with your CloudTrail log.

SELECT *
FROM example-cloudtrail-log
WHERE eventname = 'GetBucketAcl’;

This example query filters the S3 bucket API call GetBucketAcl.

For more information, see Analyze Security, Compliance, and Operational Activity Using AWS CloudTrail and Amazon Athena.