# Ensure that Object-level logging for write events is enabled for S3 bucket

- Source: https://support.icompaas.com/support/solutions/articles/62000228344-ensure-that-object-level-logging-for-write-events-is-enabled-for-s3-bucket
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Security Controls](https://support.icompaas.com/support/solutions/62000065178) › [AWS Services](https://support.icompaas.com/support/solutions/folders/62000097507)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

## **Description:**

Amazon Simple Storage Service (Amazon S3) is an object storage service that offers industry-leading scalability, data availability, security, and performance. S3 object-level API operations such as GetObject, DeleteObject, and PutObject are called data events. 

## **Rationale:**

Enabling object-level logging will help you meet data compliance requirements within your organization, perform comprehensive security analysis, monitor specific patterns of user behavior in your AWS account or take immediate actions on any object-level API activity within your S3 Buckets using Amazon CloudWatch Events.

## **Impact:**

Writes actions on any object-level API activity within your S3 Buckets using Amazon CloudWatch Events will be done.

## **Default value:**

CloudTrail trails don't log data events by default.

## **Pre-Requisite:**

S3 bucket and cloud trail

**Test Plan:**

1.  Login to AWS Console and navigate to CloudTrails dashboard at [https://console.aws.amazon.com/cloudtrail/](https://console.aws.amazon.com/cloudtrail/ "https://console.aws.amazon.com/cloudtrail/")  
2.  In the left panel, click on trails and then click on the CloudTrail **Name** that you want to examine. ![](https://support.icompaas.com/assets/kb/896f64e27cea5545.png) 
3.  Review General details.
    
4.  Confirm that Multi-region trail is set to Yes.![](https://support.icompaas.com/assets/kb/2d3386567c97b076.png)
    
5.  Scroll down to Data events 
6.  Confirm that it reads: Data events: S3, Bucket Name: All current and future S3 buckets, Read: Enabled Write: Enabled![](https://support.icompaas.com/assets/kb/bd76a99f0688b851.png)

or

1.  Login to AWS Management Console and open the Amazon S3 console using [https://console.aws.amazon.com/s3/](https://console.aws.amazon.com/s3/ "https://console.aws.amazon.com/s3/")
    
2.  Click on the bucket name you want to open.
    
3.  Click on 'Properties'. ![](https://support.icompaas.com/assets/kb/e793f67c8da606fc.png) 
    
4.  Check Cloud trail data events if present.  ![](https://support.icompaas.com/assets/kb/4c34bba8fc162f55.png)  
    

  

  

**Using AWS CLI**

Using cloud trail cli commands to check S3 bucket has cloud trail data events.

aws cloudtrail list-trails  
  
aws cloudtrail get-event-selectors --region <Home region> --trail-name <trail name> --query EventSelectors\[\*\].DataResources\[\]

  

### **Implementation Plan**:

-   **AWS Console Process**
    

1.  Login to the AWS Management Console and navigate to S3 dashboard at [https://console.aws.amazon.com/s3/](https://console.aws.amazon.com/s3/ "https://console.aws.amazon.com/s3/") 
    
2.  In the left navigation panel, click buckets and then click on the S3 Bucket Name that you want to examine. 
    
3.  Click Properties tab and scroll down to CloudTrail data events section click on **configure in cloud trail.**  ![](https://support.icompaas.com/assets/kb/b9bb6edc2d1e170e.png)  
4.  You will go to cloud trail console, and you can choose an existing CloudTrail.
    
5.  Once the CloudTrail is selected, check the Write event checkbox, so that object-level logging for Write events is enabled.
    

  

**Using AWS CLI**

aws cloudtrail put-event-selectors --region <region name> --trail-name <trail name> --event-selectors '\[{ "ReadWriteType": "WriteOnly", "IncludeManagementEvents":true, "DataResources": \[{ "Type": "AWS::S3::Object", "Values": \["arn:aws:s3:::<s3 bucket name>/"\] }\] }\]'

### **Backout Plan:**

-   **AWS Console Process**
    

1.  Sign in to the AWS Management Console and open the CloudTrail console at [https://console.aws.amazon.com/cloudtrail/](https://console.aws.amazon.com/cloudtrail/ "https://console.aws.amazon.com/cloudtrail/").
    
2.  Open the **Trails** page of the CloudTrail console.
    
3.  Choose the trail name.![](https://support.icompaas.com/assets/kb/3c4e2f3897a40e56.png)
    
4.  At the top of the trail details page, choose **Delete**. ![](https://support.icompaas.com/assets/kb/fcf9bc77891806da.png) 
    

  

**Using AWS CLI**

aws cloudtrail delete-trail --name <Trail name>

## **Reference:**

[Amazon S3 CloudTrail events - Amazon Simple Storage Service](https://docs.aws.amazon.com/AmazonS3/latest/userguide/cloudtrail-logging-s3-info.html "https://docs.aws.amazon.com/AmazonS3/latest/userguide/cloudtrail-logging-s3-info.html")

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.