Logging data events

Sign in to the Amazon Web Services Management Console and open the CloudTrail console at https://console.amazonaws.cn/cloudtrail/.

From the navigation pane, under Lake, choose Event data stores.

On the Event data stores page, choose the event data store you want to update.

On the details page, in Data events, choose Edit.

If you are not already logging data events, choose the Data events check box.

For Resource type, choose the resource type on which you want to log data events.

Choose a log selector template. You can choose a predefined template, or choose Custom to define your own event collection conditions.

You can choose from the following predefined templates:

(Optional) In Selector name, enter a name to identify your selector. The selector name is a descriptive name for an advanced event selector, such as "Log data events for only two S3 buckets". The selector name is listed as Name in the advanced event selector and is viewable if you expand the JSON view.

If you selected Custom, in Advanced event selectors build an expression based on the values of advanced event selector fields.

1. Choose from the following fields.

   • readOnly - readOnly can be set to equals a value of true or false. Read-only data events are events that do not change the state of a resource, such as Get* or Describe* events. Write events add, change, or delete resources, attributes, or artifacts, such as Put*, Delete*, or Write* events. To log both read and write events, don't add a readOnly selector.

   • eventName - eventName can use any operator. You can use it to include or exclude any data event logged to CloudTrail, such as PutBucket, GetItem, or GetSnapshotBlock.

   • eventSource – The event source to include or exclude. This field can use any operator.

   • eventType – The event type to include or exclude. For example, you can set this field to not equals AwsServiceEvent to exclude Amazon Web Services service events. For a list of event types, see eventType in CloudTrail record contents for management, data, and network activity events.

   • sessionCredentialFromConsole – Include or exclude events originating from an Amazon Web Services Management Console session. This field can be set to equals or not equals with a value of true.

   • userIdentity.arn – Include or exclude events for actions taken by specific IAM identities. For more information, see CloudTrail userIdentity element.

   • resources.ARN - You can use any operator with resources.ARN, but if you use equals or does not equal, the value must exactly match the ARN of a valid resource of the type you've specified in the template as the value of resources.type.

     Note

     You can't use the resources.ARN field to filter resource types that do not have ARNs.

     For more information about the ARN formats of data event resources, see Actions, resources, and condition keys for Amazon Web Services services in the Service Authorization Reference.

2. For each field, choose + Condition to add as many conditions as you need, up to a maximum of 500 specified values for all conditions. For example, to exclude data events for two S3 buckets from data events that are logged on your event data store, you can set the field to resources.ARN, set the operator for does not start with, and then paste in an S3 bucket ARN for which you do not want to log events.

   To add the second S3 bucket, choose + Condition, and then repeat the preceding instruction, pasting in the ARN for or browsing for a different bucket.

   For information about how CloudTrail evaluates multiple conditions, see How CloudTrail evaluates multiple conditions for a field.

   Note

   You can have a maximum of 500 values for all selectors on an event data store. This includes arrays of multiple values for a selector such as eventName. If you have single values for all selectors, you can have a maximum of 500 conditions added to a selector.

3. Choose + Field to add additional fields as required. To avoid errors, do not set conflicting or duplicate values for fields. For example, do not specify an ARN in one selector to be equal to a value, then specify that the ARN not equal the same value in another selector.

To add another resource type on which to log data events, choose Add data event type. Repeat steps 6 through this step to configure advanced event selectors for another resource type.

After you've reviewed and verified your choices, choose Save changes.

On the Dashboard or Trails pages of the CloudTrail console, choose the trail you want to update.

On the details page, in Data events, choose Edit.

If you are not already logging data events, choose the Data events check box.

For Resource type, choose the resource type on which you want to log data events.

Choose a log selector template. You can choose a predefined template, or choose Custom to define your own event collection conditions.

You can choose from the following predefined templates:

(Optional) In Selector name, enter a name to identify your selector. The selector name is a descriptive name for an advanced event selector, such as "Log data events for only two S3 buckets". The selector name is listed as Name in the advanced event selector and is viewable if you expand the JSON view.

If you selected Custom, in Advanced event selectors build an expression based on the values of advanced event selector fields.

1. Choose from the following fields.

   • readOnly - readOnly can be set to equals a value of true or false. Read-only data events are events that do not change the state of a resource, such as Get* or Describe* events. Write events add, change, or delete resources, attributes, or artifacts, such as Put*, Delete*, or Write* events. To log both read and write events, don't add a readOnly selector.

   • eventName - eventName can use any operator. You can use it to include or exclude any data event logged to CloudTrail, such as PutBucket, GetItem, or GetSnapshotBlock.

   • eventSource – The event source to include or exclude. This field can use any operator.

   • eventType – The event type to include or exclude. For example, you can set this field to not equals AwsServiceEvent to exclude Amazon Web Services service events. For a list of event types, see eventType in CloudTrail record contents for management, data, and network activity events.

   • sessionCredentialFromConsole – Include or exclude events originating from an Amazon Web Services Management Console session. This field can be set to equals or not equals with a value of true.

   • userIdentity.arn – Include or exclude events for actions taken by specific IAM identities. For more information, see CloudTrail userIdentity element.

   • resources.ARN - You can use any operator with resources.ARN, but if you use equals or does not equal, the value must exactly match the ARN of a valid resource of the type you've specified in the template as the value of resources.type.

     Note

     You can't use the resources.ARN field to filter resource types that do not have ARNs.

     For more information about the ARN formats of data event resources, see Actions, resources, and condition keys for Amazon Web Services services in the Service Authorization Reference.

2. For each field, choose + Condition to add as many conditions as you need, up to a maximum of 500 specified values for all conditions. For example, to exclude data events for two S3 buckets from data events that are logged on your event data store, you can set the field to resources.ARN, set the operator for does not start with, and then paste in an S3 bucket ARN for which you do not want to log events.

   To add the second S3 bucket, choose + Condition, and then repeat the preceding instruction, pasting in the ARN for or browsing for a different bucket.

   For information about how CloudTrail evaluates multiple conditions, see How CloudTrail evaluates multiple conditions for a field.

   Note

   You can have a maximum of 500 values for all selectors on an event data store. This includes arrays of multiple values for a selector such as eventName. If you have single values for all selectors, you can have a maximum of 500 conditions added to a selector.

3. Choose + Field to add additional fields as required. To avoid errors, do not set conflicting or duplicate values for fields. For example, do not specify an ARN in one selector to be equal to a value, then specify that the ARN not equal the same value in another selector.

To add another resource type on which to log data events, choose Add data event type. Repeat steps 4 through this step to configure advanced event selectors for the resource type.

After you've reviewed and verified your choices, choose Save changes.

Sign in to the Amazon Web Services Management Console and open the CloudTrail console at https://console.amazonaws.cn/cloudtrail/.

Open the Trails page of the CloudTrail console and choose the trail name.

For Data events, choose Edit.

For Amazon S3 buckets:

1. For Data event source, choose S3.

2. You can choose to log All current and future S3 buckets, or you can specify individual buckets or functions. By default, data events are logged for all current and future S3 buckets.

   Note

   Keeping the default All current and future S3 buckets option enables data event logging for all buckets currently in your Amazon account and any buckets you create after you finish creating the trail. It also enables logging of data event activity performed by any user or role in your Amazon account, even if that activity is performed on a bucket that belongs to another Amazon account.

   If you are creating a trail for a single Region (done by using the Amazon CLI), selecting the Select all S3 buckets in your account option enables data event logging for all buckets in the same Region as your trail and any buckets you create later in that Region. It will not log data events for Amazon S3 buckets in other Regions in your Amazon account.

3. If you leave the default, All current and future S3 buckets, choose to log Read events, Write events, or both.

4. To select individual buckets, empty the Read and Write check boxes for All current and future S3 buckets. In Individual bucket selection, browse for a bucket on which to log data events. To find specific buckets, type a bucket prefix for the bucket you want. You can select multiple buckets in this window. Choose Add bucket to log data events for more buckets. Choose to log Read events, such as GetObject, Write events, such as PutObject, or both.

   This setting takes precedence over individual settings you configure for individual buckets. For example, if you specify logging Read events for all S3 buckets, and then choose to add a specific bucket for data event logging, Read is already selected for the bucket you added. You cannot clear the selection. You can only configure the option for Write.

   To remove a bucket from logging, choose X.

To add another resource type on which to log data events, choose Add data event type.

For Lambda functions:

1. For Data event source, choose Lambda.

2. In Lambda function, choose All regions to log all Lambda functions, or Input function as ARN to log data events on a specific function.

   To log data events for all Lambda functions in your Amazon account, select Log all current and future functions. This setting takes precedence over individual settings you configure for individual functions. All functions are logged, even if all functions are not displayed.

   Note

   If you are creating a trail for all Regions, this selection enables data event logging for all functions currently in your Amazon account, and any Lambda functions you might create in any Region after you finish creating the trail. If you are creating a trail for a single Region (done by using the Amazon CLI), this selection enables data event logging for all functions currently in that Region in your Amazon account, and any Lambda functions you might create in that Region after you finish creating the trail. It does not enable data event logging for Lambda functions created in other Regions.

   Logging data events for all functions also enables logging of data event activity performed by any user or role in your Amazon account, even if that activity is performed on a function that belongs to another Amazon account.

3. If you choose Input function as ARN, enter the ARN of a Lambda function.

   Note

   If you have more than 15,000 Lambda functions in your account, you cannot view or select all functions in the CloudTrail console when creating a trail. You can still select the option to log all functions, even if they are not displayed. If you want to log data events for specific functions, you can manually add a function if you know its ARN. You can also finish creating the trail in the console, and then use the Amazon CLI and the put-event-selectors command to configure data event logging for specific Lambda functions. For more information, see Managing trails with the Amazon CLI.

To add another resource type on which to log data events, choose Add data event type.

For DynamoDB tables:

1. For Data event source, choose DynamoDB.

2. In DynamoDB table selection, choose Browse to select a table, or paste in the ARN of a DynamoDB table to which you have access. A DynamoDB table ARN uses the following format:

   arn:partition:dynamodb:region:account_ID:table/table_name

   To add another table, choose Add row, and browse for a table or paste in the ARN of a table to which you have access.

Choose Save changes.