How to find out where the S3 ListObjects requests came from

Question

In the last two days, my billing increased a lot due to lots of S3 ListObjects api requests. I'm sure it wasn't originated by my services.

I'd like to know how can I figure out where are these requests coming from, and which buckets were accessed?

I had no clue on this issue.

Then I enabled CloudTrail service, but still didn't find out where S3 ListObjects came from.

Accepted Answer

you can enable S3 Server Access Logging and analyze the generated logs. S3 Server Access Logging provides detailed records for the requests made to your S3 buckets

bucket > properties > Server access logging
Download the log files from the destination bucket.
Look for entries with the "REST.GET.BUCKET" operation, which corresponds to the ListObjects API request.

How to find out where the S3 ListObjects requests came from

Relevant content