Record who reads and writes objects in a particular S3 bucket.
Management events alone do not capture the required object-level data events.
Which setting is most appropriate?
Enable CloudTrail data events for the target S3 bucket to record object-level API operations such as GetObject and PutObject.
Detailed explanation
DNS query logs record name resolution, not S3 API calls.
DNS query logs record name resolution, not S3 API calls.
CloudTrail data events record object-level S3 API activity and its calling principal.
CloudTrail data events record object-level S3 API activity and its calling principal.
Lifecycle history does not provide a complete audit trail of object reads, writes, and callers.
Lifecycle history does not provide a complete audit trail of object reads, writes, and callers.
A CPU metric does not identify S3 object operations or their principals.
A CPU metric does not identify S3 object operations or their principals.
Check official documentation
Compare the following points with the official documentation.
AWS CloudTrailのデータイベントとS3オブジェクト操作の公式説明を確認する。
What to confirm
管理イベントとデータイベントの監査対象を区別できる。
Key points
- AWS CloudTrail
- Data event
- S3 object operation
Notes
- Environment: AWS公式CloudTrailドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Audit granularity
CloudTrail data events provide object-level activity that management events alone do not capture.
Observability layers
Metrics and DNS logs can complement an audit trail but do not identify every S3 object caller and API.