S3 Access Logs
Whenever you or your users store or access different objects in Amazon S3, you, as the security professional, may need to know who is accessing the different files, when and where they are accessed, and from what location.
You can capture all the access logs and records of who accessed the various objects in a particular bucket via a simple setting in S3. One caveat is that the access logs for an S3 bucket cannot be stored in the same bucket as the items they are tracking. This means that you need to create a new bucket for storing those logs. You can use a single bucket to track multiple S3 buckets’ access logs. Changing the access policy so that no users besides the security and audit teams or the service role that retrieves the logs may access this bucket is considered best practice.
The access logs are usually pushed to the secondary storage bucket on a best-effort basis, and this can result in a delay of a few hours before delivering the logs to the...
