# 3.8 Ensure that object-level logging for write events is enabled for S3 buckets

- Source: https://support.icompaas.com/support/solutions/articles/62000233161-3-8-ensure-that-object-level-logging-for-write-events-is-enabled-for-s3-buckets
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS CIS V.4 Level 1 Benchmarks](https://support.icompaas.com/support/solutions/62000112671) › [CIS Control 3](https://support.icompaas.com/support/solutions/folders/62000169197)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

### Profile Applicability:

Level 2

## Description:

AWS S3 Object-Level API Operations (PutObject, DeleteObject, GetObject) are categorized as Data Events in AWS CloudTrail.By default, CloudTrail does not log Data Events, making it necessary to manually enable object-level logging.This control ensures that object-level logging is enabled for all S3 write operations, providing full visibility into data access and modification.

## Rationale:

Enhances security monitoring: Tracks unauthorized modifications to critical data. Meets compliance requirements: Supports audits for regulations such as PCI DSS, SOC 2, ISO 27001, NIST, and CIS benchmarks.Assists in forensic investigations: Provides historical logs of object changes.Improves accountability: Helps organizations track who accessed or modified S3 data.Without object-level logging, security teams lack visibility into unauthorized data modifications or potential insider threats.

## Impact:

-   Provides detailed auditing of all changes to S3 objects.
    
-   Helps detect unauthorized access or data leaks.
    
-   Supports security incident investigations.
    

##   

## Default Value:

-   CloudTrail does NOT log object-level API actions by default.
-   Must be manually enabled for each S3 bucket.

## Pre-Requisites:

 IAM permissions required

-   cloudtrail:UpdateTrail
    
-   cloudtrail:GetEventSelectors
    
-   cloudtrail:PutEventSelectors
    
-   s3:PutBucketLogging
    
-   s3:GetBucketLogging
    
-   s3:PutBucketPolicy
    

AWS CLI installed for automation.

## Remediation:

### Test Plan:

## Using AWS Console

Step 1: Check If Object-Level Logging Is Enabled in CloudTrail

1.  Login to AWS Console → Go to [AWS CloudTrail](https://console.aws.amazon.com/cloudtrail/)
    

    ![](https://support.icompaas.com/assets/kb/e9da421e55f70102.png)

2.  Click Trails in the left panel
    

           ![](https://support.icompaas.com/assets/kb/e0902de1c3c55b1a.png)

3.  Select the CloudTrail trail you want to check.
    

     ![](https://support.icompaas.com/assets/kb/23712b46ef082d4f.png)

4.  Scroll to Data Events.
    

   ![](https://support.icompaas.com/assets/kb/d8e131569e8a4e35.png)

5.  Confirm the configuration:
    
6.  Repeat for all regions and all trails.
    

## Using AWS CLI

Step 1: List All CloudTrail Trails

aws cloudtrail list-trails

Step 2: Verify If CloudTrail Is Multi-Region

aws cloudtrail get-trail --name <trail-name> --region <region-name>

Step 3: Check If Object-Level Logging for S3 Is Enabled

aws cloudtrail get-event-selectors --region <region-name> --trail-name <trail-name> --query EventSelectors\[\*\].DataResources\[\]

Implementation steps:

Step 1: Enable S3 Data Events in CloudTrail

1.  Login to AWS Console → Go to [AWS CloudTrail](https://console.aws.amazon.com/cloudtrail/)
    

    ![](https://support.icompaas.com/assets/kb/2edfcadb8a6b1b89.png)

2.  Click Trails in the left panel
    

         ![](https://support.icompaas.com/assets/kb/467277c70f6ec785.png)

3.  Click on the trail name
    

      ![](https://support.icompaas.com/assets/kb/cc95460f9a3b9f34.png)

4.  Click Edit under General details
    

    ![](https://support.icompaas.com/assets/kb/c9c4ffe5bf1f333d.png)

5.  Scroll down to Data events
    

    ![](https://support.icompaas.com/assets/kb/eb05b7275d45ddac.png)

6.  Select S3 → Choose Log all events
    

     ![](https://support.icompaas.com/assets/kb/a20dee8ca393a404.png)

7.  Click Save changes
    

   ![](https://support.icompaas.com/assets/kb/2b082c20d389f311.png)

Step 1: Enable Object-Level Logging for a Specific S3 Bucket

aws cloudtrail put-event-selectors --region <region-name> --trail-name <trail-name> \\
    --event-selectors '\[{
        "ReadWriteType": "WriteOnly",
        "IncludeManagementEvents": true,
        "DataResources": \[{
            "Type": "AWS::S3::Object",
            "Values": \["arn:aws:s3:::<s3-bucket-name>/"\]
        }\]
    }\]'

Step 2: Enable Object-Level Logging for ALL S3 Buckets

aws cloudtrail put-event-selectors --region <region-name> --trail-name <trail-name> \\
    --event-selectors '\[{
        "ReadWriteType": "WriteOnly",
        "IncludeManagementEvents": true,
        "DataResources": \[{
            "Type": "AWS::S3::Object",
            "Values": \["arn:aws:s3"\]
        }\]
    }\]'

This enables object-level logging for ALL current and future S3 buckets.

  

## Backout Plan:

If enabling object-level logging causes excessive costs: Disable Object-Level Logging via AWS CLI 

aws cloudtrail put-event-selectors --region <region-name> --trail-name <trail-name> \\ --event-selectors '\[{ "ReadWriteType": "None", "IncludeManagementEvents": true }\]'

Verify Logs Are Disabled

 aws cloudtrail get-event-selectors --region <region-name> --trail-name <trail-name>

If S3 object-level logging is missing, the change is successful.

##   

## References:

-   [AWS S3 CloudTrail Guide](https://docs.aws.amazon.com/AmazonS3/latest/user-guide/enable-cloudtrail-events.html)
    
-   [AWS CLI Reference (CloudTrail Events)](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/cloudtrail/put-event-selectors.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.