CloudTrail records S3 object-level read events

Check ID: cloudtrail_s3_dataevents_read_enabled
Provider: AWS
Service: cloudtrail
Severity: LOW
Categories: logging, forensics-ready
Resource type: AwsCloudTrailTrail

What this check verifies

CloudTrail trails log S3 object-level read data events for all buckets, capturing object access (for example GetObject) via selectors targeting AWS::S3::Object

Risk

Without object-level read logging, S3 access is opaque. Attackers or insiders can exfiltrate data via GetObject without audit trails, eroding confidentiality and hindering forensics, anomaly detection, and incident response.

Recommendation

Enable CloudTrail data events for S3 objects with ReadOnly (or All) across all current and future buckets. Use a multi-Region trail, centralize logs in an encrypted bucket with lifecycle retention, and integrate monitoring/alerts to support defense in depth and accountable access.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws cloudtrail put-event-selectors --trail-name <example_resource_name> --event-selectors '[{"ReadWriteType":"ReadOnly","DataResources":[{"Type":"AWS::S3::Object","Values":["arn:aws:s3"]}]}]'

# Terraform: enable S3 object-level READ data events for all buckets on a trail
resource "aws_cloudtrail" "<example_resource_name>" {
  name           = "<example_resource_name>"
  s3_bucket_name = "<example_resource_name>"

  event_selector {
    read_write_type = "ReadOnly"                 # CRITICAL: log read-only data events
    data_resource {
      type   = "AWS::S3::Object"                 # CRITICAL: target S3 object-level events
      values = ["arn:aws:s3"]                    # CRITICAL: apply to all S3 buckets/objects
    }
  }
}

# CloudFormation: enable S3 object-level READ data events for all buckets on a trail
Resources:
  <example_resource_name>:
    Type: AWS::CloudTrail::Trail
    Properties:
      S3BucketName: <example_resource_name>
      EventSelectors:
        - ReadWriteType: ReadOnly        # CRITICAL: log read-only data events
          DataResources:
            - Type: AWS::S3::Object      # CRITICAL: target S3 object-level events
              Values:
                - arn:aws:s3             # CRITICAL: applies to all S3 buckets/objects

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudtrail_s3_dataevents_read_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

CloudTrail logs read and write management events CloudTrail records S3 object-level write events

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires