Logging requests for S3 Tables using server access logging

Server access logging for S3 Tables provides detailed records for the requests that are made to a table bucket. When you enable server access logging on a table bucket, Amazon S3 generates a log record for every request that is made to that table bucket, and delivers the log files to a general purpose bucket that you specify. These logs can help you with security and access auditing, access analysis, and cost attribution.

Server access logging is configured at the table bucket level. By default, Amazon S3 doesn't collect server access logs for table buckets. When you enable logging on a table bucket, Amazon S3 logs requests for all namespaces and tables in that table bucket.

This topic describes server access logging for S3 Tables. If you want to enable server access logging for general purpose buckets instead, see Logging requests with server access logging.

How server access logging works for S3 Tables

You turn server access logging on or off at the table bucket level. To enable or update logging, you use the PutTableBucketLogging operation with a tableBucketLoggingStatus that contains a loggingEnabled element. The loggingEnabled element specifies the following values:

To view the current logging configuration for a table bucket, use the GetTableBucketLogging operation. After you enable logging, it might take a few hours before Amazon S3 begins delivering log files to the destination general purpose bucket.

Best-effort log delivery

S3 Tables server access log records are delivered on a best-effort basis. Most requests for a table bucket that is properly configured for logging result in a delivered log record. Most log records are delivered within a few hours of the time that they are recorded, but they can be delivered more frequently.

The completeness and timeliness of server logging is not guaranteed. The log record for a particular request might be delivered long after the request was actually processed, or it might not be delivered at all. You might even see a duplicate log record. The purpose of server logs is to give you an idea of the nature of traffic against your table bucket. Although log records are rarely lost or duplicated, be aware that server logging is not meant to be a complete accounting of all requests.

For guaranteed and more complete audit logging, use Amazon CloudTrail. CloudTrail captures all API calls for S3 Tables as events. For more information, see Logging with Amazon CloudTrail for S3 Tables.

Logging status changes take effect over time

Changes to the logging status of a table bucket take time to actually affect the delivery of log files. For example, if you enable logging for a table bucket, some requests made in the following hour might be logged, and others might not. Suppose that you change the destination bucket for logging from bucket A to bucket B. For the next hour, some logs might continue to be delivered to bucket A, whereas others might be delivered to the new destination bucket B. In all cases, the new settings eventually take effect without any further action on your part.

Destination general purpose bucket requirements

Before you enable server access logging, confirm that the destination general purpose bucket meets the following requirements:

For simpler log management, we recommend that you deliver logs to a general purpose bucket that you use only for server access logs.

Permissions for server access logging

Server access logging for S3 Tables requires two kinds of permissions: a bucket policy on the destination general purpose bucket that lets Amazon S3 deliver log files, and Amazon Identity and Access Management permissions for the user or role that configures logging.

Destination bucket policy

Amazon S3 delivers log files by using the logging service principal (logging.s3.amazonaws.com). You must grant this service principal the s3:PutObject permission on the destination general purpose bucket. This uses the service principal model rather than the legacy log delivery access control list (ACL) group.

If you use the Amazon S3 console to enable server access logging, the console automatically updates the bucket policy on the destination general purpose bucket to grant this permission. If you enable logging with the Amazon SDKs, the Amazon Command Line Interface (Amazon CLI), or the Amazon S3 REST API, you must add the bucket policy to the destination general purpose bucket yourself.

The following example bucket policy grants the s3:PutObject permission to the logging service principal. To use this bucket policy, replace the user input placeholders with your own information.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "S3TablesServerAccessLogsPolicy",
            "Effect": "Allow",
            "Principal": {
                "Service": "logging.s3.amazonaws.com"
            },
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::amzn-s3-demo-logging-bucket/logs/*",
            "Condition": {
                "ArnLike": {
                    "aws:SourceArn": "arn:aws:s3tables:us-east-1:111122223333:bucket/amzn-s3-demo-table-bucket"
                },
                "StringEquals": {
                    "aws:SourceAccount": "111122223333"
                }
            }
        }
    ]
}

Permissions to configure logging

To configure server access logging, the user or role that makes the request must have permission to call the s3tables:PutTableBucketLogging and s3tables:GetTableBucketLogging actions on the table bucket. The following example Amazon Identity and Access Management policy grants these permissions. To use this policy, replace the user input placeholders with your own information.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ConfigureS3TablesServerAccessLogging",
            "Effect": "Allow",
            "Action": [
                "s3tables:PutTableBucketLogging",
                "s3tables:GetTableBucketLogging"
            ],
            "Resource": "arn:aws:s3tables:us-east-1:111122223333:bucket/amzn-s3-demo-table-bucket"
        }
    ]
}

Enabling or updating server access logging

You can enable or update server access logging for a table bucket by using the Amazon S3 console, the Amazon Command Line Interface (Amazon CLI), the Amazon SDKs, or the Amazon S3 REST API.

aws s3tables put-table-bucket-logging \
    --table-bucket-arn arn:aws:s3tables:us-east-1:111122223333:bucket/amzn-s3-demo-table-bucket \
    --table-bucket-logging-status '{
        "loggingEnabled": {
            "targetBucket": "amzn-s3-demo-logging-bucket",
            "targetPrefix": "logs/",
            "targetObjectKeyFormat": {
                "partitionedPrefix": {
                    "partitionDateSource": "EventTime"
                }
            }
        }
    }'

aws s3tables get-table-bucket-logging \
    --table-bucket-arn arn:aws:s3tables:us-east-1:111122223333:bucket/amzn-s3-demo-table-bucket

{
    "tableBucketLoggingStatus": {
        "loggingEnabled": {
            "targetBucket": "amzn-s3-demo-logging-bucket",
            "targetPrefix": "logs/",
            "targetObjectKeyFormat": {
                "partitionedPrefix": {
                    "partitionDateSource": "EventTime"
                }
            }
        }
    }
}

{
    "tableBucketLoggingStatus": {}
}

aws s3tables put-table-bucket-logging \
    --table-bucket-arn arn:aws:s3tables:us-east-1:111122223333:bucket/amzn-s3-demo-table-bucket \
    --table-bucket-logging-status '{}'

import boto3

client = boto3.client('s3tables')

table_bucket_arn = 'arn:aws:s3tables:us-east-1:111122223333:bucket/amzn-s3-demo-table-bucket'

# Enable or update server access logging.
client.put_table_bucket_logging(
    tableBucketARN=table_bucket_arn,
    tableBucketLoggingStatus={
        'loggingEnabled': {
            'targetBucket': 'amzn-s3-demo-logging-bucket',
            'targetPrefix': 'logs/',
            'targetObjectKeyFormat': {
                'partitionedPrefix': {
                    'partitionDateSource': 'EventTime'
                }
            }
        }
    }
)

# View the current logging configuration.
response = client.get_table_bucket_logging(tableBucketARN=table_bucket_arn)
print(response['tableBucketLoggingStatus'])

# Disable server access logging.
client.put_table_bucket_logging(
    tableBucketARN=table_bucket_arn,
    tableBucketLoggingStatus={}
)

PUT /buckets/arn%3Aaws%3As3tables%3Aus-east-1%3A111122223333%3Abucket%2Famzn-s3-demo-table-bucket/logging HTTP/1.1
Host: s3tables.us-east-1.amazonaws.com
Content-Type: application/json

{
    "tableBucketLoggingStatus": {
        "loggingEnabled": {
            "targetBucket": "amzn-s3-demo-logging-bucket",
            "targetPrefix": "logs/",
            "targetObjectKeyFormat": {
                "partitionedPrefix": {
                    "partitionDateSource": "EventTime"
                }
            }
        }
    }
}

GET /buckets/arn%3Aaws%3As3tables%3Aus-east-1%3A111122223333%3Abucket%2Famzn-s3-demo-table-bucket/logging HTTP/1.1
Host: s3tables.us-east-1.amazonaws.com

PUT /buckets/arn%3Aaws%3As3tables%3Aus-east-1%3A111122223333%3Abucket%2Famzn-s3-demo-table-bucket/logging HTTP/1.1
Host: s3tables.us-east-1.amazonaws.com
Content-Type: application/json

{
    "tableBucketLoggingStatus": {}
}

Disabling server access logging

To disable server access logging, send a PutTableBucketLogging request with an empty logging status. There is no separate operation to delete the logging configuration. With the Amazon CLI, run the put-table-bucket-logging command with --table-bucket-logging-status '{}'. With Boto3, call put_table_bucket_logging with tableBucketLoggingStatus={}.

aws s3tables put-table-bucket-logging \
    --table-bucket-arn arn:aws:s3tables:us-east-1:111122223333:bucket/amzn-s3-demo-table-bucket \
    --table-bucket-logging-status '{}'

To disable logging by using the Amazon S3 console, choose the table bucket, choose Properties, and in the Server access logging section choose Edit. Then choose Disable, and choose Save changes.

When you disable logging, Amazon S3 stops generating log records for the table bucket. Log files that were already delivered to the destination general purpose bucket are not affected.

Log delivery location and key format

Amazon S3 delivers log files to the destination general purpose bucket by using a key that identifies the source table bucket. Log objects use the following key format:

s3://targetBucket/targetPrefixaccountId/region/tableBucketName/YYYY/MM/DD/YYYY-MM-DD-hh-mm-ss-UniqueString

The following example shows a delivered log object key:

s3://amzn-s3-demo-logging-bucket/logs/111122223333/us-east-1/amzn-s3-demo-table-bucket/2026/10/28/2026-10-28-00-00-00-4520D3E0684DC910

The key format uses the following parts:

The partitionDateSource value in the partitionedPrefix element of targetObjectKeyFormat controls how Amazon S3 chooses the date:

Server access log format for S3 Tables

Server access logs for S3 Tables are delivered in space-delimited text format. Each log record represents one request and contains 25 fields in the following order:

table_bucket_arn [request_time] table_arn namespace_name table_name key object_size remote_ip requester request_id operation http_status error_code bytes_sent total_time turnaround_time "referer" "user_agent" signature_version cipher_suite authentication_type host_header tls_version request_time_iso source_region

In a log record, the request_time field is enclosed in square brackets, and the referer and user_agent fields are enclosed in double quotation marks. A hyphen (-) indicates a field that doesn't apply to the request.

The following table describes each field.

The following example shows a log record for a GetTable request.

arn:aws:s3tables:us-east-2:111122223333:bucket/amzn-s3-demo-table-bucket [28/Oct/2026:13:46:35 +0000] arn:aws:s3tables:us-east-2:111122223333:bucket/amzn-s3-demo-table-bucket/table/cdae79fb-03e3-49dc-92c7-10e279e37e8f sal_ns events - - 15.248.6.88 arn:aws:sts::111122223333:assumed-role/Admin/example-session c4e215be-ad2b-4b55-a190-4225aada1885 S3Tables.GetTable 200 - 735 49 49 "-" "aws-cli/2.34.34" SigV4 TLS_AES_128_GCM_SHA256 AuthHeader s3tables.us-east-2.amazonaws.com TLSv1.3 2026-10-28T13:46:35.634Z us-west-2

Managing log retention

A destination general purpose bucket that receives server access logs can accumulate many log objects over time. You can use Amazon S3 Lifecycle configuration to set rules so that Amazon S3 automatically deletes log objects after a specified period. If you specified a prefix in your logging configuration, you can scope the lifecycle rule to that prefix. For example, if your log objects have the prefix logs/, you can create a lifecycle rule to delete all objects with that prefix after a specified number of days. For more information, see Managing the lifecycle of objects.

Keep the following behavior in mind when you manage log retention:

Charges for server access logging

There is no additional S3 Tables charge for generating and delivering server access logs. You pay the standard Amazon S3 charges for the destination general purpose bucket, including storage of the delivered log files, requests, and data transfer for accessing the log files. You can delete the log files at any time. For current rates, see Amazon S3 pricing.

Querying server access logs by using Amazon Athena

You can analyze S3 Tables server access logs by using Amazon Athena. The following example shows how to create a database and table in Athena, and then query the delivered log files. Replace the user input placeholders with your own information. For more information about using Athena with S3 Tables, see Querying Amazon S3 tables with Athena.