CloudTrail is not logging S3 data events

Severity: Medium
Service: CloudTrail
Check ID: CLOUDTRAIL_S3_DATA_EVENTS_DISABLED

What this check finds

Management events (API calls) are logged by default. S3 data events (GetObject, PutObject, DeleteObject) are not. Without them, data exfiltration from S3 and ransomware deletion attacks are invisible in the audit trail.

Passing looks like: CloudTrail logs S3 data events.

How to fix it

Add a data events selector to a CloudTrail trail that covers S3.

AWS CLI

aws cloudtrail put-event-selectors --trail-name TRAIL_NAME --event-selectors '[{"ReadWriteType":"All","DataResources":[{"Type":"AWS::S3::Object","Values":["arn:aws:s3"]}]}]'

Names in capitals are placeholders for your own resource. Review a command before you run it.

AWS console

CloudTrail → Trails → select trail → Edit → Data events → S3 → Log all S3 buckets.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to CloudTrail is not logging S3 data events
Framework	Controls
CIS AWS Foundations Benchmark v5.0.0	3.8 Ensure that object-level logging for write events is enabled for S3 buckets 3.9 Ensure that object-level logging for read events is enabled for S3 buckets
PCI-DSS v4.0.1	10.2 Audit logs are implemented to support the detection of anomalies and suspicious activity
HIPAA Security Rule	164.312(b) Implement hardware, software, and procedural mechanisms to record activity
SOC 2 — Trust Services Criteria	CC7.2 Security Event Monitoring
NIST SP 800-53 Rev5 (Moderate)	AU-2 Event Logging AU-3 Content of Audit Records
NIST Cybersecurity Framework 2.0	PR.PS-04 Log records are generated for monitoring
ISO/IEC 27001:2022 Annex A	A.8.15 Logging

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More CloudTrail checks

All CloudTrail checks