Question

A security engineer configured a multi-Region CloudTrail trail to deliver logs to an S3 bucket and created an Athena table pointing to the bucket prefix. After several days, queries against the Athena table return zero rows even though the S3 bucket contains many CloudTrail log object files under the correct prefix. The engineer confirms the trail is active and logs are being written. What is the MOST likely cause of the empty query results?

Accepted Answer

The Athena table's LOCATION or partition definitions do not match the actual S3 key path (account ID, Region, and date structure) where CloudTrail writes the objects.

Answer

CloudTrail log file integrity validation is enabled, which prevents Athena from reading the compressed log objects.

Answer

The trail is not configured to log management events, so the delivered objects contain no queryable records.

Answer

S3 server-side encryption with SSE-S3 blocks Athena from decrypting the CloudTrail objects at query time.