CODEWITHSUNDEEP
amazon-web-servicesamazon-s3access-logamazon-cloudtrail
BharathKumarMurugan
BharathKumarMurugan

Reputation: 417

How to get list of users who are accessing the objects in S3 Buckets?

Scenario: My client have 80+ S3 Buckets and 1000+ applications is running in their AWS account. I want to get the list of IAM users/roles who are accessing the objects in all the S3 Buckets.

Method 1: Initially I tried to fetch it from CloudTrail Event History, but no luck.enter image description here From the above image, you can see CloudTrail is failing to log the object level logging.

Method 2: I created a CloudTrail Trails to log the activities. But it captures all management level activities happening through out the account which makes me hard to find the S3 logs alone(I already mentioned that there is 80+ Buckets & 1000+ applications in the account).

Method 3: S3 Server Access Log: If I enable this option, it creates log entry for every action happening to the objects. (that is: When I attempt to read a log file, it creates an another log. It keeps on doubling the count of logs)

If anyone have a solution to find the list of IAM users/roles who are accessing the S3 bucket objects and in an effective way, please help me.

Thanks in advance.

Upvotes: 1

Views: 2093

Answers (1)

1efty
1efty

Reputation: 925

  1. For each bucket, configure object-level logging.
  2. Once that is complete, you can use the CloudTrail API to filter events and extract IAM identities making the requests.
aws cloudtrail lookup-events --lookup-attributes AttributeKey=ResourceType,AttributeValue=AWS::S3::Object --query Events[*].Username

Upvotes: 4

Related Questions