Analyze historical cloudtrail data for S3


In cloudtrail, we only monitor management event only, we have one public accessable bucket, now we want to search cloudtrail log with S3 bucket access attempt(access denied) event and who download S3 bucket object, how can we search those events?

asked 2 years ago636 views
1 Answer

The default setting for CloudTrail is to find only management events. As you mentioned you only have Management events enabled. Check to ensure that you have the data events enabled for your account. With an S3 bucket that is generating a high workload, you could quickly generate thousands of logs in a short amount of time. Be mindful of how long you choose to enable CloudTrail data events for a busy bucket.

You have several options to consume and analyze CloudTrail logs. A couple of options that spring to mind are Athena and CloudWatch. See links below for further info

answered 2 years ago
  • I create a trail to log all S3 read/write events, then using command line: aws s3 cp bucket to local drive, but when i check logstream, all eventcategory is management, no data event. so how to identify those s3 bucket copy activities? is some configuration wrong? why no data event?

  • Can you double-check that your trail has Data events enabled? From the CLI you can use 'aws cloudtrail get-event-selectors --trail-name <your-trail> --region <your-region>' to check that the eventCategory is 'Data'.

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions