All checks
Medium
S3 general purpose buckets should log object-level write events
Checks that at least one CloudTrail multi-Region trail logs S3 object-level write events for every bucket, recording who wrote or deleted each object. One trail covers the whole account; a selector limited to named buckets, operations or callers does not count.
- service
- S3
- severity
- Medium
- scope
- evaluated once per account
How to fix it
In the console
CloudTrail → Trails → the multi-Region trail → Data events
With the AWS CLI
aws cloudtrail put-event-selectors --trail-name <trail-arn> --event-selectors file://event-selectors.json --region <home-region>With Terraform
resource "aws_cloudtrail" "this" {
name = var.trail_name
s3_bucket_name = var.log_bucket
is_multi_region_trail = true
advanced_event_selector {
name = "Log all S3 object events"
field_selector {
field = "eventCategory"
equals = ["Data"]
}
field_selector {
field = "resources.type"
equals = ["AWS::S3::Object"]
}
}
}See which of your accounts this check is failing on.
Book a demo