Amazon S3 audit logging, Part 2: Centralized logging and analysis of S3 data events in AWS CloudTrail for security and compliance

This article explains how to configure AWS CloudTrail data events for S3 to track user identity and access patterns, then analyze logs using Amazon Athena with partition projection for cost-effective security investigations.

• CloudTrail data events capture full IAM identity context for S3 operations including user, role, MFA status
• Set up organization-wide CloudTrail trail delivering logs to centralized S3 bucket with lifecycle policies
• Create Athena table with partition projection to query millions of events without provisioning infrastructure
• Eight query patterns provided: user activity, cross-account access, failed attempts, bucket activity, deletes, assumed roles, data transfer, source IP analysis
• Partition pruning on account, region, timestamp columns reduces query costs by minimizing data scanned
• Security best practices include log file validation, KMS encryption, S3 Object Lock for tamper-proof retention
• CloudTrail charges $0.10 per 100,000 data events; no free tier unlike management events

This post provides practical guidance for implementing identity-driven S3 audit logging to support security investigations and compliance requirements, complementing server access logs and metadata tracking covered in the three-part series.