CloudTrail trail records all S3 object-level API operations for all buckets
cloudtrail_s3_dataevents_write_enabled
CloudTrail trails include S3 object-level data events for write (or all) operations across all current and future buckets, via classic or advanced selectors. This records actions like PutObject, DeleteObject, and multipart uploads at the object level.
Risk
Without object-level write logging, unauthorized or accidental changes and deletions can go unobserved, undermining data integrity and availability. Forensics lose visibility into who modified or removed objects, hindering detection of ransomware, rogue automation, or insider tampering.
prowler aws --checks cloudtrail_s3_dataevents_write_enabled
Recommendation
Enable CloudTrail S3 data events for object-level write (and optionally read) across all buckets on a multi-Region trail. Apply least privilege to log storage, set lifecycle retention, and integrate alerts. Use advanced selectors to target sensitive buckets/operations for cost control and defense in depth.
Remediation
aws cloudtrail put-event-selectors --trail-name <example_resource_name> --event-selectors '[{"ReadWriteType":"WriteOnly","DataResources":[{"Type":"AWS::S3::Object","Values":["arn:aws:s3"]}]}]'
- In the AWS Console, open CloudTrail and go to Trails
- Select <your trail> and click Edit under Data events
- For Data event source, choose S3
- Select All current and future S3 buckets
- Check Write events (or All events)
- Click Save changes
Source Code
Resource Type
AwsCloudTrailTrail
References
- https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html
- https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-cloudtrail-logging-for-s3.html
- https://www.go2share.net/article/s3-bucket-logging
- https://docs.amazonaws.cn/en_us/AmazonS3/latest/userguide/cloudtrail-logging-s3-info.html
- https://docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-22