Audit GetObject and DeleteObject calls for a particular S3 bucket.
Record object-level operations in addition to management events.
Which setting is most appropriate?
Enable CloudTrail data events for the target S3 bucket to record object-level API operations.
Detailed explanation
Enable object data events for the bucket, covering GetObject reads and DeleteObject writes.
Enable object data events for the bucket, covering GetObject reads and DeleteObject writes.
Management events cover control-plane operations such as bucket configuration, not these object-level calls.
Management events cover control-plane operations such as bucket configuration, not these object-level calls.
Notifications can report deletion events, but do not provide a complete audit of GetObject reads.
Notifications can report deletion events, but do not provide a complete audit of GetObject reads.
Aggregated request and error counts do not provide a caller-specific audit event for each operation.
Aggregated request and error counts do not provide a caller-specific audit event for each operation.
Check official documentation
Compare the following points with the official documentation.
Review S3 object data events and read/write event selectors in CloudTrail.
Official references
What to confirm
Include both GetObject reads and DeleteObject writes for the selected bucket.
Key points
- CloudTrail data events
- GetObject
- Object-level audit
Notes
- Environment: AWS SOA-C03 exam guide and the linked AWS documentation
- Reviewed against the linked AWS documentation on 2026-10-03.
Foundation review
Control plane and data plane
Bucket configuration and object access have different event scopes. Explicitly enable S3 object data events in a trail or event data store for GetObject and DeleteObject.
Select the audit scope
Include both read and write events for the required bucket. Data events incur additional charges; advanced selectors can narrow eventName. Default event history does not display data events.