Amazon S3 audit logging, Part 1: Analyzing server access logs with Amazon Athena for performance insights

This article demonstrates how to analyze Amazon S3 server access logs using Amazon Athena with partition projection for cost-effective performance insights and security investigations.

• S3 server access logs capture HTTP request details, performance metrics, and network context for every bucket request
• Enable centralized logging by configuring buckets to deliver logs to a dedicated S3 bucket with structured key format
• Create Athena tables with partition projection to eliminate AWS Glue crawlers and reduce query costs up to 90%
• Eight query patterns provided: access analysis, IP security investigation, multi-bucket comparison, regional analysis, error troubleshooting, performance optimization, cost attribution, and popular content identification
• Always use partition pruning by filtering on account, region, source_bucket, and timestamp columns to minimize data scanned
• Server access logs don't capture user identity, metadata changes, or session context—use CloudTrail and S3 Metadata journal tables for complete audit coverage
• Implement S3 Lifecycle policies to transition logs to cheaper storage classes and manage retention based on compliance requirements

This is Part 1 of a three-part series on S3 audit logging mechanisms, providing practical implementation guidance for HTTP-level access analysis and troubleshooting.