how to get ObjectKey from eventname of 'DeleteObjects'

Question

'DeleteObjects''s requestparameters is  like '{"bucketName":"demo-bucket","Host":"s3.us-east-2.amazonaws.com","delete":""}' ,  how can i get deleted ObjectKey

Answer

Hello. Create a table in Athena that's mapped to the location of your CloudTrail logs in S3.

The table can be set up with a command like this (although the actual columns and types might differ based on the exact structure and version of your CloudTrail logs):

CREATE EXTERNAL TABLE cloudtrail_logs (
   eventversion STRING,
   useridentity STRUCT<
      type: STRING,
      principalid: STRING,
      arn: STRING,
      accountid: STRING,
      invokedby: STRING,
      accesskeyid: STRING,
      userName: STRING,
      sessioncontext: STRUCT<
         attributes: STRUCT<
            mfaauthenticated: STRING,
            creationdate: STRING
         >,
         sessionIssuer: STRUCT<
            type: STRING,
            principalId: STRING,
            arn: STRING, 
            accountId: STRING,
            userName: STRING
         >
      >
   >,
   eventtime STRING,
   eventsource STRING,
   eventname STRING,
   awsregion STRING,
   sourceipaddress STRING,
   useragent STRING,
   errorcode STRING,
   errormessage STRING,
   requestparameters STRING,
   responseelements STRING,
   additionaleventdata STRING,
   eventid STRING,
   eventtype STRING,
   apiVersion STRING,
   readOnly STRING,
   resources ARRAY<STRUCT<
      ARN: STRING,
      accountId: STRING,
      type: STRING
   >>,
   serviceeventdetails STRING,
   sharedeventid STRING,
   vpcendpointid STRING
)
ROW FORMAT SERDE 'com.amazon.emr.hive.serde.CloudTrailSerde'
STORED AS INPUTFORMAT 'com.amazon.emr.cloudtrail.CloudTrailInputFormat'
OUTPUTFORMAT 'org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat'
LOCATION 's3://YOUR_CLOUDTRAIL_BUCKET/AWSLogs/YOUR_ACCOUNT_ID/CloudTrail/';

Replace YOUR_CLOUDTRAIL_BUCKET and YOUR_ACCOUNT_ID with your specific S3 bucket and AWS account ID where CloudTrail logs are stored.

Query Deleted Object Keys:

SELECT 
   json_extract(requestparameters, '$.delete.objects') AS deleted_objects
FROM 
   cloudtrail_logs
WHERE 
   eventname = 'DeleteObjects' 
   AND eventsource = 's3.amazonaws.com'
   AND json_extract(requestparameters, '$.bucketName') = 'demo-bucket';

This will give you the list of deleted objects for the demo-bucket bucket.

Regards, Andrii

Answer

-> To find out how an S3 object was deleted, you can review either server access logs or AWS CloudTrail logs.
->[ https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-cloudtrail-logging-for-s3.html]()

Once you get the information in CloudTrail Logs, you can run Athena query to fetch the information- https://docs.aws.amazon.com/athena/latest/ug/cloudtrail-logs.html

Answer

`DeleteObjects` requires `Bucket` and `Delete` if you use AWS SDK. In `Delete` structure, you specify the object keys that you want to delete in `Objects` property. Here's a sample `DeleteObjects` request in Node.js.

```js
const command = new DeleteObjectsCommand({
  Bucket: "my-bucket",
  Delete: {
    Objects: [{ Key: "test.txt" }, { Key: "test2.txt" }],
  },
});
```

**References:**

- https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/s3/command/DeleteObjectsCommand/
- https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteObjects.html

how to get ObjectKey from eventname of 'DeleteObjects'

Relevant content