All checks
Medium
S3 general purpose buckets should log object-level read events
Checks that at least one CloudTrail multi-Region trail logs S3 object-level read events for every bucket, recording who read each object. One trail covers the whole account; a selector limited to named buckets, operations or callers does not count.
- service
- S3
- severity
- Medium
- scope
- evaluated once per account
How to fix it
In the console
CloudTrail → Trails → the multi-Region trail → Data events
With the AWS CLI
aws cloudtrail put-event-selectors --trail-name <trail-arn> --event-selectors file://event-selectors.json --region <home-region>With Terraform
resource "aws_cloudtrail" "this" {
name = var.trail_name
s3_bucket_name = var.log_bucket
is_multi_region_trail = true
event_selector {
read_write_type = "All"
data_resource {
type = "AWS::S3::Object"
values = ["arn:aws:s3"]
}
}
}See which of your accounts this check is failing on.
Book a demo