Set up the cloudtrail integration.
Ensure that an AWS CloudTrail trail has file integration validation enabled.
AWS CloudTrail file integration validation can verify whether files were modified or changed once delivered to an S3 bucket.
Follow the Enabling Log File Integrity Validation for CloudTrail docs to enable validation.
aws cloudtrail describe-trails
update-trail on any returned trail name above to enable-log-file-validation.
aws cloudtrail update-trail --name GlobalTrailName --enable-log-file-validation