Check provider logo

CloudTrail trail records S3 object-level read events for all S3 buckets

cloudtrail_s3_dataevents_read_enabled

Severitylow
Servicecloudtrail
by Prowler
loggingforensics-ready

CloudTrail trails log S3 object-level read data events for all buckets, capturing object access (for example GetObject) via selectors targeting AWS::S3::Object

Risk

Without object-level read logging, S3 access is opaque. Attackers or insiders can exfiltrate data via GetObject without audit trails, eroding confidentiality and hindering forensics, anomaly detection, and incident response.

Run this check with Prowler CLI

prowler aws --checks cloudtrail_s3_dataevents_read_enabled

Run in Prowler Cloud

Recommendation

Enable CloudTrail data events for S3 objects with ReadOnly (or All) across all current and future buckets. Use a multi-Region trail, centralize logs in an encrypted bucket with lifecycle retention, and integrate monitoring/alerts to support defense in depth and accountable access.

Remediation

CLI

aws cloudtrail put-event-selectors --trail-name <example_resource_name> --event-selectors '[{"ReadWriteType":"ReadOnly","DataResources":[{"Type":"AWS::S3::Object","Values":["arn:aws:s3"]}]}]'

Native IaC
Terraform
Other
  1. In the AWS Console, open CloudTrail and select Trails
  2. Open your trail and go to the Data events section
  3. Add data event for S3 and choose All current and future S3 buckets
  4. Select only Read events (or All if Read-only is unavailable)
  5. Save changes

Source Code

Resource Type

AwsCloudTrailTrail

References