---
title: Object-level logging should be enabled for S3 bucket write events
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Object-level logging should be enabled
  for S3 bucket write events
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Object-level logging should be enabled for S3 bucket write events
 
## Description{% #description %}

AWS accounts should have at least one multi-region, actively logging CloudTrail trail that records S3 object-level write data events. S3 object-level API operations such as `PutObject` and `DeleteObject` are data events that CloudTrail does not log by default. This check passes when a trail uses advanced event selectors with the S3 "Log all events" template (`eventCategory` = `Data`, `resources.type` = `AWS::S3::Object`, with no `readOnly` filter or `readOnly` = `false`), or basic event selectors with `AWS::S3::Object` on the all-buckets value `arn:aws:s3` or `arn:aws:s3:::` (in any AWS partition) and a read/write type of `WriteOnly` or `All`. A basic selector value scoped to specific buckets does not pass, because it leaves other buckets unlogged. Selectors that narrow scope (for example, `eventName`, `eventType`, or `resources.ARN`) do not satisfy the check.

## Remediation{% #remediation %}

1. In the CloudTrail console, open a multi-region trail, edit **Data events**, select **S3** as the data event type, and choose the **Log all events** log selector template, as described in [Logging data events](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html).
1. Alternatively, run `aws cloudtrail put-event-selectors --region <region-name> --trail-name <trail-name> --advanced-event-selectors '[{"Name": "Management events", "FieldSelectors": [{"Field": "eventCategory", "Equals": ["Management"]}]}, {"Name": "S3 write data events", "FieldSelectors": [{"Field": "eventCategory", "Equals": ["Data"]}, {"Field": "resources.type", "Equals": ["AWS::S3::Object"]}, {"Field": "readOnly", "Equals": ["false"]}]}]'` as described in the [put-event-selectors CLI reference](https://docs.aws.amazon.com/cli/latest/reference/cloudtrail/put-event-selectors.html). The command replaces all of the trail's existing selectors, so include any other selectors the trail needs, and keep the all-management-events selector so the trail still logs read and write management events. Enabling object-level logging may significantly increase event volume and cost.

## References{% #references %}

- [Logging data events with CloudTrail](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html)
- [Enabling CloudTrail event logging for S3 buckets and objects](https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-cloudtrail-logging-for-s3.html)
- [CIS Amazon Web Services Benchmarks](https://www.cisecurity.org/benchmark/amazon_web_services)