Ingest S3 bucket access logs using the Observe Lambda forwarder.

1. Amazon S3 Access Key Id
2. What Is Amazon S3

Configure an AWS IAM user with the required permissions to access your S3 bucket. This one-time setup involves establishing access permissions on a bucket and associating the required permissions with an IAM user. You can then access an external (i.e. S3) stage that points to the bucket with the AWS key and secret key. Amazon S3 Security Access Controls. There are 3 ways to control access to your data stored in S3 – S3 Access Control Lists (ACLs), S3 Bucket Policies and User based policies. S3 Access Control Lists – There are 2 types of S3 ACLs – Bucket and Object. Bucket ACLs allow you to control access at the bucket level, and Object ACLs control.

Enable S3 access logging¶

S3 bucket access logging is disabled by default. If needed, first enable logging for the desired bucket:

1. Navigate to S3 in the AWS Console

2. Select the bucket you’d like to get access logs for

3. Click on “Properties”

4. Under “Server access logging”, click “Edit”

5. Select “Enable” and provide the log destination bucket in “Target bucket”

6. Click “Save changes”

See the AWS access logging documentation for full details.

Amazon S3 Access Key Id

Forward logs using Lambda¶

Install the Observe Lambda Forwarder. You may use either the CloudFormation or Terraform install, see the Lambda forwarder documentation for instructions. (You only need to install the forwarder once.)

For each log bucket (“Target bucket”), add a trigger so the forwarder can send access logs as they are generated.

1. Navigate to Lambda in the AWS Console

2. Select the Observe Lambda function (created by the forwarder installation process)

3. Select “Add Trigger”, then search for “S3”

4. Configure the trigger with the following settings:

   • Bucket: the log bucket

   • Event type: the desired events to send, such as “All object create events”

   • Prefix or Suffix if desired (optional)

5. Click “Add” to save.

Note

What Is Amazon S3

S3 access logs may take some time to be created in the target bucket. For details, see the AWS documentation about best-effort delivery.