Server access logs contain details about when a particular bucket is accessed. This information can be used to ascertain the frequency at which a bucket is accessed and by whom it is accessed. Before I continue, an Amazon S3 bucket is a container in which you store the objects that you upload to Amazon S3. It can be considered similar to a folder that you would get in a normal filesystem.
The data gathered by these access logs contains useful information that can be used to help you identify the source of a security incident. Here are just a few of the log details that are captured:
- The identity of the requester accessing the bucket
- The name of the bucket being accessed
- A timestamp identifying when the action was carried out against the bucket
- The action that was carried out against the bucket
- The HTML response status
- Any error codes that are applicable
For a full list of log fields, please see https://docs.aws...
