# Ensure that Object-level logging for read events is enabled for S3 bucket

- Source: https://support.icompaas.com/support/solutions/articles/62000228346-ensure-that-object-level-logging-for-read-events-is-enabled-for-s3-bucket
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Security Controls](https://support.icompaas.com/support/solutions/62000065178) › [AWS Services](https://support.icompaas.com/support/solutions/folders/62000097507)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

## **Description:**

Amazon Simple Storage Service (Amazon S3) is an object storage service that offers industry-leading scalability, data availability, security, and performance. S3 object-level API operations such as GetObject, DeleteObject, and PutObject are called data events.

## **Rationale:**

Enabling object-level logging will help you meet data compliance requirements within your organization, perform comprehensive security analysis, monitor specific patterns of user behavior in your AWS account or take immediate actions on any object-level API activity using Amazon CloudWatch Events.

## **Impact:**

Reads any object-level API activity within your S3 Buckets using Amazon CloudWatch Events.

## **Default value:**

CloudTrail trails don't log data events by default.

## **Pre-Requisite:**

S3 bucket and cloud trail

## **Remediation:**

### **Test Plan:**

-   **AWS Console Process**
    

1.  Login to the AWS Management Console and navigate to S3 dashboard at [https://console.aws.amazon.com/s3/](https://console.aws.amazon.com/s3/ "https://console.aws.amazon.com/s3/") 
    
2.  In the left navigation panel, click buckets and then click on the S3 Bucket Name that you want to examine. ![](https://support.icompaas.com/assets/kb/1c58eae760293f1f.png) 
    
3.  Click Properties tab to see in detail bucket configuration.  ![](https://support.icompaas.com/assets/kb/a337a4723f6f9d43.png)  
    
4.  If the current status for Object-level logging is set to Disabled, then object-level logging of read events for the selected s3 bucket is not set. 
5.  If the current status for Object-level logging is set to Enabled, but the Read event check-box is unchecked, then object-level logging of read events for the selected s3 bucket is not set.

  

**Using AWS CLI**

aws cloudtrail describe-trails --region <region-name> --output table --query trailList\[\*\].Name  
  
aws cloudtrail get-event-selectors --region <region-name> --trail-name <trail-name> --query EventSelectors\[\*\].DataResources\[\]

### **Implementation Plan**:

-   **AWS Console Process**
    

1.  Login to the AWS Management Console and navigate to S3 dashboard at [https://console.aws.amazon.com/s3/](https://console.aws.amazon.com/s3/ "https://console.aws.amazon.com/s3/") 
    
2.  In the left navigation panel, click buckets and then click on the S3 Bucket Name that you want to examine. ![](https://support.icompaas.com/assets/kb/837828417c804428.png) 
    
3.  Click Properties tab to see in detail bucket configuration.  ![](https://support.icompaas.com/assets/kb/925d99c24069f0f6.png)  
    
4.  Click on the Object-level logging setting, enter the CloudTrail name for the recording activity. You can choose an existing Cloudtrail or create a new one by navigating to the Cloudtrail console link [https://console.aws.amazon.com/cloudtrail/](https://console.aws.amazon.com/cloudtrail/ "https://console.aws.amazon.com/cloudtrail/") 
5.  Once the Cloudtrail is selected, check the Read event checkbox, so that object-level logging for Read events is enabled.

  

**Using AWS CLI**

**To enable object-level data events logging for S3 buckets within your AWS account, run put-event-selectors command using the name of the trail that you want to reconfigure as identifier:** 

aws cloudtrail put-event-selectors --region <region-name> --trail-name <trail-name> --event-selectors '\[{ "ReadWriteType": "ReadOnly", "IncludeManagementEvents":true, "DataResources": \[{ "Type": "AWS::S3::Object", "Values": \["arn:aws:s3:::/"\] }\] }\]'

### **Backout Plan:**

-   **AWS Console Process**
    

1.  Sign in to the AWS Management Console and open the CloudTrail console at [https://console.aws.amazon.com/cloudtrail/](https://console.aws.amazon.com/cloudtrail/ "https://console.aws.amazon.com/cloudtrail/").
    
2.  Open the **Trails** page of the CloudTrail console.
    
3.  Choose the trail name.![](https://support.icompaas.com/assets/kb/6e6c50d83272255b.png)
    
4.  At the top of the trail details page, choose **Delete**. ![](https://support.icompaas.com/assets/kb/d5a69a6084151016.png) 
    

  

**Using AWS CLI**

aws cloudtrail delete-trail --name <Trail name>

## **Reference:**

[Amazon S3 CloudTrail events - Amazon Simple Storage Service](https://docs.aws.amazon.com/AmazonS3/latest/userguide/cloudtrail-logging-s3-info.html "https://docs.aws.amazon.com/AmazonS3/latest/userguide/cloudtrail-logging-s3-info.html")

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.