Amazon S3 specific one zone with AWS CloudTrail allows monitoring of knowledge occasions that occur within a particular zone. The setup enables real-time tracking and analysis of all activities happening within the designated area, providing valuable insights into usage patterns, trends, and potential security threats. By leveraging this feature, organizations can ensure seamless data management, automate compliance, and enhance overall IT governance.

Within Amazon Web Services (AWS), we introduced a new, high-performance, single-Availability Zone (AZ) storage class designed specifically for frequently accessed data that requires low latency and fast response times, enabling seamless performance for critical applications. This highly efficient storage class is optimally suited for demanding workloads, capable of delivering up to a tenfold increase in throughput compared to Amazon S3’s standard offerings. S3 Single-Region Replication stores objects in a single Availability Zone (AZ), utilizing Amazon S3 for data retention.

Here is the rewritten text:

S3’s one-zone support for specific logging enables real-time monitoring of all object-level operations, including reads, writes, and deletes, in addition to previously supported actions like PUTs and GETs. By leveraging this feature, you can ensure auditing for effective governance and compliance, while also potentially capitalizing on S3’s Standard-Infrequent Access (SIA) storage class, which offers a 50% price reduction compared to standard storage.

Using this new capability, you can quickly determine which S3 Specific One-Zone objects were created, read, updated, or deleted, and identify the source of the API calls. In the event of an unauthorized S3-specific one-zone object entry detection, prompt action can be taken to restrict access immediately. By leveraging the ‘with’ clause, you can establish rules-driven workflows that are activated in response to specific events or triggers.

I begin within the . Upon creating an S3 bucket, I select “All files” because the bucket type is. apne1-az4 Because I am in, I enter? s3express-one-zone-cloudtrail The availability zone ID of an Availability Zone is typically appended as a suffix to form the definitive identifier. I finally select the checkbox to acknowledge that selection.

To enable knowledge occasion logging for Amazon S3’s specific one-zone configuration, I’m going to the . I am responsible for monitoring the occurrences of my S3 listing bucket.

In I choose  with chosen.

For , I select . You can select the “Events” tab and then filter by “All events” to view and manage knowledge occasions for all S3 listing buckets.

The occasion knowledge retailer will indeed log occasions specifically for your S3 listing bucket. s3express-one-zone-cloudtrail--apne1-az4--x-s3. Since I’m a professional editor, here is the revised text:

I select the option that specifies the ARN of my listing’s bucket. The importance of providing comprehensive training is stressed throughout the manual.

Now you’ve successfully enabled logging with CloudTrail.

By leveraging the Amazon S3 API, I successfully upload a file to my designated bucket in the cloud storage service.

Utilizing AWS CLI, I ship Put_Object and Get_Object.

aws s3 api put-object --bucket s3-express-one-zone-cloudtrail-apne1-az4-x-s3 \
  --key cloudtrail_test \
  --body cloudtrail_test.txt

AWS S3 API request to retrieve an object: 

aws s3api get-object --bucket s3express-one-zone-cloudtrail-apne1-az4-x-s3 --key cloudtrail_test/response.txt

CloudTrail stores log data in Amazon S3 buckets as compressed gzip archives, which are then organized by account ID, region, and timestamp for efficient retrieval and analysis. Using the AWS CLI, I retrieve the bucket associated with my specified path and obtain log data for the subsequent date following my examination.

$ aws s3 ls s3://aws-cloudtrail-logs-MY-ACCOUNT-ID-3b49f368/AWSLogs/MY-ACCOUNT-ID/CloudTrail/ap-northeast-1/2024/07/01/

You receive four pieces of information identifying two items each from console checks and CLI checks respectively.

Logs for Account ID: MY-ACCOUNT-ID, Region: ap-northeast-1 on 2024-07-05:
• 20:44:16 - Log event 317
• 20:47:36 - Log event 387
• 21:37:48 - Log event 373
• 21:42:44 - Log event 314

What objects are being uploaded? Upon opening the main document, I notice that PutObject occasion kind. Recalling my previous actions, I uploaded files via both the AWS S3 console and the Command-Line Interface (CLI). The userAgent The attribute in question, which lends its name to the API designation, actually pertains to a web browser; therefore, in this instance, it specifically relates to my experience using the Amazon S3 console. CloudTrail events provide detailed information about API calls and other actions taken within your AWS environment. By reviewing these events in the CloudTrail documentation, you can gain a deeper understanding of what is happening behind the scenes and identify potential security or compliance issues.

"eventTime": "2024-07-05T20:44:16Z",
"eventSource": "s3express.amazonaws.com",
"eventName": "PutObject",
"awsRegion": "ap-northeast-1",
"sourceIPAddress": "MY_IP",
"userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36",
"requestParameters": {...},
"responseElements": {...},
"additionalEventData": {...},
"assets": [
{"type": "AWS::S3Express::Object", "ARN": "arn:aws:s3express:ap-northeast-1:MY_ACCOUNT_ID:bucket/s3express-one-zone-cloudtrail--apne1-az4--x-s3/cloudtrail_example.png"},
{"accountId": "MY_ACCOUNT_ID", "type": "AWS::S3Express::DirectoryBucket", "ARN": "arn:aws:s3express:ap-northeast-1:MY_ACCOUNT_ID:bucket/s3express-one-zone-cloudtrail--apne1-az4--x-s3"}]

Now that I have evaluated the third file for the occasion equivalent to the previous two files, PutObject When commands are dispatched using AWS CLI, I notice a subtle difference between. userAgent attribute. The AWS CLI provides a simple and convenient way to interact with AWS services from your command-line interface.

{
  "eventTime": "2024-07-05T21:37:19Z",
  "source": "s3express.amazonaws.com",
  "eventName": "PutObject",
  "region": "ap-northeast-1",
  "callerIpAddress": "MY-IP",
  "userAgent": "aws-cli/2.17.9 (Linux, x86_64) Python/3.11.8 botocore/2.20.6",
  "requestParameters": {...},
  "responseElements": {...},
  "additionalEventData": {...},
  "assets": [
    {
      "type": "AWS::S3Express::Object",
      "ARN": "arn:aws:s3express:ap-northeast-1:MY-ACCOUNT-ID:bucket/s3express-one-zone-cloudtrail--apne1-az4--x-s3/cloudtrail_example.png"
    },
    {
      "accountId": "MY-ACCOUNT-ID",
      "type": "AWS::S3Express::DirectoryBucket",
      "ARN": "arn:aws:s3express:ap-northeast-1:MY-ACCOUNT-ID:bucket/s3express-one-zone-cloudtrail--apne1-az4--x-s3"
    }
  ]
}

Now, let’s examine the GetObject occurrence within the second file. What a special moment this is? GetObject and that the userAgent In reference to the S3 console, I utilize the browser on this occasion.

{
"..."},
"eventTime": "2024-07-05T20:47:41Z",
"eventSource": "s3-express.amazonaws.com",
"eventName": "GetObject",
"awsRegion": "ap-northeast-1",
"sourceIPAddress": "MY_IP",
"userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0 Safari/537.36",
"requestParameters": {...},
"responseElements": {...},
"additionalEventData": {...},
...
"assets": [
{
"type": "AWS::S3Express::Object",
"ARN": "arn:aws:s3express:ap-northeast-1:MY_ACCOUNT_ID:bucket/s3express-one-zone-cloudtrail--apne1-az4--x-s3/cloudtrail_example.png"
},
{
"account_id": "MY_ACCOUNT_ID",
"type": "AWS::S3Express::DirectoryBucket",
"ARN": "arn:aws:s3express:ap-northeast-1:MY_ACCOUNT_ID:bucket/s3express-one-zone-cloudtrail--apne1-az4--x-s3"
}
]

And finally, I will introduce the event in the fourth file, complete with all the details of GetObject The command that I dispatched from the AWS CLI. I can see that the eventName and userAgent are as anticipated.

{
  "eventTime": "2024-07-05T21:42:04Z",
  "eventSource": "s3express.amazonaws.com",
  "eventName": "GetObject",
  "awsRegion": "ap-northeast-1",
  "sourceIPAddress": "MY-IP",
  "userAgent": "aws-cli/2.17.9; aws-crt/0.20.11; ua/2.0; os/linux#5.10.218-208.862.amzn2.x86_64; md/arch#x86_64; lang/python#3.11.8; md/pyimpl#CPython; cfg/retry-mode#customary; md/installer#exe; md/distrib#amzn.2; md/immediate#off; md/command#s3api.put-object",
  "requestParameters": {...},
  "responseElements": {...},
  "additionalEventData": {...},
  ...
  "assets": [
    {
      "type": "AWS::S3Express::Object",
      "ARN": "arn:aws:s3express:ap-northeast-1:MY-ACCOUNT-ID:bucket/s3express-one-zone-cloudtrail--apne1-az4--x-s3/cloudtrail_example.png"
    },
    {
      "accountId": "MY-ACCOUNT-ID",
      "type": "AWS::S3Express::DirectoryBucket",
      "ARN": "arn:aws:s3express:ap-northeast-1:MY-ACCOUNT-ID:bucket/s3express-one-zone-cloudtrail--apne1-az4--x-s3"
    }
  ],
  ...

You can enable CloudTrail event logging for Amazon S3 bucket in a single Availability Zone using the CloudTrail console, Command Line Interface (CLI), or software development kits (SDKs).

CloudTrail provides comprehensive logging of API and management plane activity across all AWS regions.

With CloudTrail’s enhanced logging capabilities for S3 objects in a single zone, you can achieve granular, object-level auditing and monitoring. PutObject, GetObject , and DeleteObjectAlongside bucket-level exercises, similar to the CreateBucket and DeleteBucket operations.

Paying for Amazon S3 storage lessons requires logging S3 specific one-zone knowledge events in CloudTrail, with costs calculated based on the number of events logged and the log retention period. Visit our website for further details.

Simplify governance and compliance processes by enabling CloudTrail knowledge occasion logging for S3 buckets in specific Availability Zones, ensuring seamless tracking of critical events in your high-performance storage architecture. Visit our comprehensive guide to learn more about this innovative feature.

–