---
title: Object-level logging should be enabled for S3 bucket read events
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Object-level logging should be enabled
  for S3 bucket read events
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Object-level logging should be enabled for S3 bucket read events
 
## Description{% #description %}

AWS accounts should have at least one multi-region, actively logging CloudTrail trail that records S3 object-level read data events (such as `GetObject`). Data events are not logged by default, and without them object-level API activity on S3 buckets is not recorded for security analysis or compliance. A trail passes when it uses advanced event selectors with `eventCategory` = `Data` and `resources.type` = `AWS::S3::Object` (the "Log all events" template, or a `readOnly` selector that includes `true`) without additional narrowing selectors such as `eventName`, or when it uses basic event selectors with an `AWS::S3::Object` data resource on the all-buckets value `arn:aws:s3` or `arn:aws:s3:::` (in any AWS partition) and a `ReadOnly` or `All` read/write type. A basic selector value scoped to specific buckets does not pass, because it leaves other buckets unlogged.

## Remediation{% #remediation %}

1. In the CloudTrail console, open a multi-region trail, edit **Data events**, select **S3** as the data event type, and choose the **Log all events** log selector template, as described in [Logging data events](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html).
1. Alternatively, run `aws cloudtrail put-event-selectors --region <region-name> --trail-name <trail-name> --advanced-event-selectors '[{"Name": "Management events", "FieldSelectors": [{"Field": "eventCategory", "Equals": ["Management"]}]}, {"Name": "S3 read data events", "FieldSelectors": [{"Field": "eventCategory", "Equals": ["Data"]}, {"Field": "resources.type", "Equals": ["AWS::S3::Object"]}, {"Field": "readOnly", "Equals": ["true"]}]}]'` as described in the [put-event-selectors CLI reference](https://docs.aws.amazon.com/cli/latest/reference/cloudtrail/put-event-selectors.html). The command replaces all of the trail's existing selectors, so include any other selectors the trail needs, and keep the all-management-events selector so the trail still logs read and write management events.

## References{% #references %}

- [Logging data events with CloudTrail](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html)
- [AWS CLI put-event-selectors](https://docs.aws.amazon.com/cli/latest/reference/cloudtrail/put-event-selectors.html)
- [AdvancedEventSelector API reference](https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_AdvancedEventSelector.html)
- [CIS Amazon Web Services Benchmarks](https://www.cisecurity.org/benchmark/amazon_web_services)