Set up the cloudtrail integration.
Ensure that an AWS CloudTrail trail has file integration validation enabled.
AWS CloudTrail file integration validation can verify whether files were modified or changed once delivered to an S3 bucket.
aws cloudtrail describe-trails
update-trail on any returned trail name above to enable-log-file-validation.
aws cloudtrail update-trail --name GlobalTrailName --enable-log-file-validation