Question

A financial services company must produce an audit trail showing every individual GetObject and PutObject API call made against a specific S3 bucket that stores regulated customer data. Their existing CloudTrail trail already captures management events across all regions, but auditors report they cannot see object-level read and write activity for the bucket. What is the most appropriate way to meet this requirement?

Accepted Answer

Configure CloudTrail data events for the S3 bucket to log object-level (S3 data plane) API activity.

Answer

Enable S3 server access logging on the bucket and deliver logs to a separate logging bucket.

Answer

Enable S3 Event Notifications to send object create and delete events to an SQS queue for review.

Answer

Turn on CloudTrail Insights events on the existing trail to detect unusual API call rates.