Question

A security engineer configured an organization trail in CloudTrail to log all management events to a central S3 bucket. During an investigation, the team notices that API calls made in the us-west-2 region for a member account are appearing in the logs, but Amazon S3 object-level GetObject and PutObject calls made against buckets in that account are completely absent from the delivered log files. The trail is confirmed to be logging and delivering files successfully. What is the MOST likely reason the S3 object-level activity is missing?

Accepted Answer

The trail is only configured to log management events; data events for S3 must be explicitly enabled on the trail.

Answer

S3 object-level operations are only captured by VPC Flow Logs, not by CloudTrail.

Answer

The organization trail does not apply to member accounts, so their S3 activity is never recorded.

Answer

CloudTrail log file integrity validation stripped the S3 object-level events because they failed digest verification.