docs.aws.amazon.com
Open in
urlscan Pro
65.9.66.85
Public Scan
Submitted URL: https://docs.aws.amazon.com/AmazonS3/latest/dev/ServerLogs.html
Effective URL: https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerLogs.html
Submission: On June 14 via api from IL — Scanned from DE
Effective URL: https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerLogs.html
Submission: On June 14 via api from IL — Scanned from DE
Form analysis 0 forms found in the DOM
Text Content
SELECT YOUR COOKIE PREFERENCES
We use cookies and similar tools to enhance your experience, provide our
services, deliver relevant advertising, and make improvements. Approved third
parties also use these tools to help us deliver advertising and provide certain
site features.
CustomizeAccept all
CUSTOMIZE COOKIE PREFERENCES
We use cookies and similar tools (collectively, "cookies") for the following
purposes.
ESSENTIAL
Essential cookies are necessary to provide our site and services and cannot be
deactivated. They are usually set in response to your actions on the site, such
as setting your privacy preferences, signing in, or filling in forms.
PERFORMANCE
Performance cookies provide anonymous statistics about how customers navigate
our site so we can improve site experience and performance. Approved third
parties may perform analytics on our behalf, but they cannot use the data for
their own purposes.
Allow performance category
Allowed
FUNCTIONAL
Functional cookies help us provide useful site features, remember your
preferences, and display relevant content. Approved third parties may set these
cookies to provide certain site features. If you do not allow these cookies,
then some or all of these services may not function properly.
Allow functional category
Allowed
ADVERTISING
Advertising cookies may be set through our site by us or our advertising
partners and help us deliver relevant marketing content. If you do not allow
these cookies, you will experience less relevant advertising.
Allow advertising category
Allowed
Blocking some types of cookies may impact your experience of our sites. You may
review and change your choices at any time by clicking Cookie preferences in the
footer of this site. We and selected third-parties use cookies or similar
technologies as specified in the AWS Cookie Notice
.
CancelSave preferences
English
Sign In to the Console
1. AWS
2. ...
3. Documentation
4. Amazon Simple Storage Service (S3)
5. User Guide
Feedback
Preferences
Amazon Simple Storage Service
User Guide
* What is Amazon S3?
* Getting started
* Setting up
* Step 1: Create a bucket
* Step 2: Upload an object
* Step 3: Download an object
* Step 4: Copy an object
* Step 5: Delete the objects and bucket
* Next steps
* Access control
* Tutorials
* Transforming data with S3 Object Lambda
* Detecting and redacting PII data
* Hosting video streaming
* Batch-transcoding videos
* Configuring a static website
* Configuring a static website using a custom domain
* Speeding up your website with Amazon CloudFront
* Cleaning up example resources
* Working with buckets
* Buckets overview
* Naming rules
* Creating a bucket
* Viewing bucket properties
* Methods for accessing a bucket
* Emptying a bucket
* Deleting a bucket
* Setting default bucket encryption
* Enabling default encryption
* Monitoring default encryption
* Configuring Transfer Acceleration
* Getting Started
* Enabling Transfer Acceleration
* Speed Comparison tool
* Using Requester Pays
* Configuring Requester Pays
* Retrieving the requestPayment configuration
* Downloading objects in Requester Pays buckets
* Restrictions and limitations
* Working with objects
* Objects
* Creating object keys
* Working with metadata
* Editing object metadata
* Uploading objects
* Using multipart upload
* Configuring a lifecycle policy
* Uploading an object using multipart upload
* Uploading a directory
* Listing multipart uploads
* Tracking a multipart upload
* Aborting a multipart upload
* Copying an object
* Multipart upload limits
* Copying objects
* Downloading an object
* Checking object integrity
* Deleting objects
* Deleting a single object
* Deleting multiple objects
* Organizing and listing objects
* Using prefixes
* Listing objects
* Using folders
* Viewing an object overview
* Viewing object properties
* Using presigned URLs
* Sharing objects
* Uploading objects
* Deleting an object
* Transforming objects
* Creating Object Lambda Access Points
* Using Amazon S3 Object Lambda Access Points
* Getting started with an AWS CloudFormation template
* Configuring IAM policies
* Writing Lambda functions
* Using AWS built functions
* Best practices and guidelines for S3 Object Lambda
* Security considerations
* S3 Object Lambda tutorials
* Working with access points
* Configuring IAM policies
* Creating access points
* Creating an access point
* Creating access points restricted to a VPC
* Managing public access
* Using access points
* Monitoring and logging
* Managing access points
* Using a bucket-style alias for your access point
* Using access points
* Restrictions and limitations
* Working with Multi-Region Access Points
* Creating Multi-Region Access Points
* Configuring AWS PrivateLink
* Using a Multi-Region Access Point
* Multi-Region Access Point permissions
* Request routing
* Bucket replication
* Supported operations
* Managing Multi-Region Access Points
* Monitoring and logging
* Using CloudTrail
* Restrictions and limitations
* Security
* Data protection
* Data encryption
* Server-side encryption
* KMS keys Stored in AWS KMS
* Specifying SSE-KMS
* Using Amazon S3 Bucket Keys
* Configuring an S3 Bucket Key for your bucket
* Configuring an S3 Bucket Key for an object
* Viewing settings for an S3 Bucket Key
* Amazon S3-managed encryption keys
* Specifying SSE-S3
* Customer-provided encryption keys
* Using client-side encryption
* Internetwork privacy
* AWS PrivateLink for Amazon S3
* Identity and access management
* Overview
* Access policy guidelines
* Request authorization
* For a bucket operation
* For an object operation
* Bucket policies and user policies
* Policies and Permissions
* Resources
* Principals
* Actions
* Conditions
* Examples
* Actions, resources, and conditions
* Bucket policies
* Adding a bucket policy
* Controlling VPC access
* Bucket policy examples
* IAM user policies
* Controlling bucket access
* User policy examples
* Example walkthroughs
* Setting up tools
* Granting permissions
* Granting cross-account permissions
* Granting object permissions
* Granting cross-account object permissions
* Using service-linked roles
* AWS managed policies
* Managing access with ACLs
* ACL overview
* Finding the canonical ID
* Configuring ACLs
* Using CORS
* CORS configuration
* Configuring CORS
* Troubleshooting CORS
* Blocking public access
* Configuring account settings
* Configuring bucket and access point settings
* Reviewing bucket access
* Verifying bucket ownership
* Controlling object ownership
* Prerequisites for disabling ACLs
* Creating a bucket
* Setting Object Ownership
* Viewing Object Ownership settings
* Disabling ACLs for all new buckets
* Troubleshooting
* Logging and monitoring
* Compliance Validation
* Resilience
* Infrastructure security
* Configuration and vulnerability analysis
* Security Best Practices
* Managing storage
* Using S3 Versioning
* S3 Versioning
* Enabling versioning on buckets
* Configuring MFA delete
* Working with versioning-enabled objects
* Adding objects
* Listing objects
* Retrieving object versions
* Retrieving version metadata
* Restoring previous versions
* Deleting object versions
* Working with delete markers
* Managing delete markers
* Deleting with MFA delete
* Configuring permissions
* Working with versioning-suspended objects
* Adding objects
* Retrieving objects
* Deleting objects
* Using AWS Backup for Amazon S3
* Working with archived objects
* Archive retrieval options
* Restoring an archived object
* Querying archived objects
* Using Object Lock
* S3 Object Lock
* Configuring Object Lock on the console
* Managing Object Lock
* Managing storage classes
* Amazon S3 Intelligent-Tiering
* How S3 Intelligent-Tiering works
* Using S3 Intelligent-Tiering
* Managing S3 Intelligent-Tiering
* Managing lifecycle
* Transitioning objects
* Expiring objects
* Setting lifecycle configuration
* Using other bucket configurations
* Configuring Lifecycle event notifications
* Lifecycle configuration elements
* Examples of S3 Lifecycle configuration
* Managing inventory
* Configuring Amazon S3 Inventory
* Setting up notifications for inventory completion
* Locating your inventory
* Querying inventory with Athena
* Converting empty version ID strings to null strings
* Replicating objects
* What's replicated?
* Setting up replication
* Replication configuration
* Setting up permissions
* Replication examples
* Configuring for buckets in the same account
* Configuring for buckets in different accounts
* Changing replica owner
* Replicating encrypted objects
* Using S3 Replication Time Control
* Managing replication rules
* Replicate existing objects
* Configuring IAM policies
* Batch Replication for a first replication rule or new destination
* Batch Replication for existing replication rules
* Additional configurations
* Monitoring progress
* Viewing replication metrics using the Amazon S3 console
* Using S3 Replication Time Control
* Best practices and guidelines for S3 RTC
* Replicating delete markers
* Replicating metadata changes
* Changing the replica owner
* Replicating encrypted objects
* Getting replication status
* Troubleshooting
* Additional considerations
* Using object tags
* Access control
* Managing object tags
* Using cost allocation tags
* Billing and usage reporting
* Billing reports
* Usage report
* Understanding billing and usage reports
* Using Amazon S3 Select
* S3 Select examples
* SQL Reference
* SELECT Command
* Data Types
* Operators
* Reserved Keywords
* SQL Functions
* Aggregate Functions (Amazon S3 Select only)
* Conditional Functions
* Conversion Functions
* Date Functions
* String Functions
* Using Batch Operations
* Granting permissions
* Creating a job
* Supported operations
* Copy objects
* Examples that use Batch Operations to copy objects
* Using an inventory report to copy objects across AWS accounts
* Using a CSV manifest to copy objects across AWS accounts
* Using Batch Operations to encrypt objects with Bucket Keys
* Invoke AWS Lambda function
* Replace all object tags
* Delete all object tags
* Replace access control list
* Restore objects
* Object Lock retention
* Object Lock legal hold
* Managing jobs
* Listing jobs
* Viewing job details
* Assigning job priority
* Tracking job status and completion reports
* Examples of tracking using Amazon EventBridge
* Examples of completion reports
* Using tags
* Creating a job
* Deleting tags
* Putting job tags
* Getting job tags
* Controlling permissions
* Managing S3 Object Lock
* Enabling Object Lock
* Setting retention
* Setting retention compliance
* Setting retention governance
* Turning off legal hold
* S3 Batch Operations tutorial
* Monitoring Amazon S3
* Monitoring tools
* Logging options
* Logging with CloudTrail
* CloudTrail events
* Example log files
* Enabling CloudTrail
* Identifying S3 requests
* Logging server access
* Enabling server access logging
* Log format
* Deleting log files
* Identifying S3 requests
* Monitoring metrics with CloudWatch
* Metrics and dimensions
* Accessing CloudWatch metrics
* CloudWatch metrics configurations
* Creating a metrics configuration for all objects
* Filtering by prefix, object tag, or access point
* Deleting a metrics filter
* Amazon S3 Event Notifications
* Notification types and destinations
* Using SQS, SNS, and Lambda
* Granting permissions
* Enabling notifications in the S3 console
* Walkthrough: Configuring SNS or SQS
* Configuring notifications using object key name filtering
* Event message structure
* Using EventBridge
* EventBridge permissions
* Enabling EventBridge
* EventBridge event message structure
* Amazon EventBridge mapping and troubleshooting
* Using analytics and insights
* Storage Class Analysis
* Configuring storage class analysis
* S3 Storage Lens
* Understanding S3 Storage Lens
* Working with Organizations
* S3 Storage Lens permissions
* Viewing storage metrics
* Viewing metrics on the dashboards
* Viewing metrics in a data export
* Encrypting metrics exports
* What is an export manifest?
* S3 Storage Lens export schema
* Monitor S3 Storage Lens metrics in CloudWatch
* S3 Storage Lens metrics and dimensions
* Enabling CloudWatch publishing
* Using CloudWatch
* Using Amazon S3 Storage Lens to optimize your storage costs
* Metrics glossary
* Working with S3 Storage Lens
* Using the S3 console
* Viewing a dashboard
* Creating and updating dashboards
* Creating a dashboard
* Updating a dashboard
* Disabling or deleting a dashboard
* Disabling a dashboard
* Deleting a dashboard
* Working with AWS Organizations
* Enabling trusted access in your organization
* Disabling trusted access in your organization
* Registering delegated admins
* Deregistering delegated admins
* Using the AWS CLI
* Using the SDK for Java
* Tracing requests using X-Ray
* Hosting a static website
* Website endpoints
* Enabling website hosting
* Configuring an index document
* Configuring a custom error document
* Setting permissions for website access
* Logging web traffic
* Configuring a redirect
* Developing with Amazon S3
* Making requests
* Making requests over IPv6
* Using dual-stack endpoints
* Making requests using the AWS SDKs
* Using AWS account or IAM user credentials
* Using IAM user temporary credentials
* Using federated user temporary credentials
* Making requests using the REST API
* Virtual hosting of buckets
* Request redirection and the REST API
* Using the AWS CLI
* Using the AWS SDKs
* Using the AWS SDK for Java
* Using the AWS SDK for .NET
* Using the AWS SDK for PHP and Running PHP Examples
* Using the AWS SDK for Ruby - Version 3
* Using the AWS SDK for Python (Boto)
* Using the AWS Mobile SDKs for iOS and Android
* Using the AWS Amplify JavaScript Library
* Using the AWS SDK for JavaScript
* Using the REST API
* Request routing
* Error handling
* The REST error response
* The SOAP error response
* Amazon S3 error best practices
* Reference
* Appendix a: Using the SOAP API
* Common SOAP API elements
* Authenticating SOAP requests
* Setting access policy with SOAP
* Appendix b: Authenticating requests (AWS signature version 2)
* Authenticating requests using the REST API
* Signing and authenticating REST requests
* Browser-based uploads using POST
* HTML forms
* Upload examples
* POST with adobe flash
* Optimizing Amazon S3 performance
* Performance Guidelines
* Performance Design Patterns
* What is S3 on Outposts?
* Setting up your Outpost
* How S3 on Outposts is different
* Getting started with S3 on Outposts
* Setting up IAM
* Using the S3 console
* Using the AWS CLI and SDK for Java
* Networking for S3 on Outposts
* Working with S3 on Outposts buckets
* Creating a bucket
* Adding tags
* Creating and managing a lifecycle configuration
* Using the console
* Using the AWS CLI and SDK for Java
* Using bucket policies
* Adding a bucket policy
* Viewing a bucket policy
* Deleting a bucket policy
* Listing buckets
* Getting a bucket
* Deleting your bucket
* Working with access points
* Creating an access point
* Viewing access point configuration
* Listing access points
* Deleting an access point
* Adding an access point policy
* Viewing an access point policy
* Working with endpoints
* Creating an endpoint
* Listing endpoints
* Deleting an endpoint
* Working with S3 on Outposts objects
* Copying an object
* Getting an object
* Listing objects
* Deleting objects
* Using HeadBucket
* Performing a multipart upload
* Security
* Data encryption
* AWS PrivateLink for S3 on Outposts
* Managing S3 on Outposts storage
* CloudWatch metrics
* Amazon CloudWatch Events
* CloudTrail logs
* Sharing S3 on Outposts
* Other services
* Developing with S3 on Outposts
* S3 on Outposts APIs
* Configuring S3 control client
* Code examples
* Actions
* Add CORS rules to a bucket
* Add a lifecycle configuration to a bucket
* Add a policy to a bucket
* Copy an object from one bucket to another
* Create a bucket
* Delete CORS rules from a bucket
* Delete a policy from a bucket
* Delete an empty bucket
* Delete an object
* Delete multiple objects
* Delete the lifecycle configuration of a bucket
* Delete the website configuration from a bucket
* Determine the existence and content type of an object
* Determine the existence of a bucket
* Get CORS rules for a bucket
* Get an object from a bucket
* Get the ACL of a bucket
* Get the ACL of an object
* Get the Region location for a bucket
* Get the lifecycle configuration of a bucket
* Get the policy for a bucket
* Get the website configuration for a bucket
* List buckets
* List in-progress multipart uploads
* List object versions in a bucket
* List objects in a bucket
* Restore an archived copy of an object
* Set a new ACL for a bucket
* Set the ACL of an object
* Set the website configuration for a bucket
* Upload an object to a bucket
* Scenarios
* Create a presigned URL
* Getting started with buckets and objects
* Manage versioned objects in batches with a Lambda function
* Remove delete markers from versioned objects
* Use a transfer manager to upload and download files
* Work with versioned objects
* Cross-service examples
* Build an Amazon Transcribe app
* Convert text to speech and back to text
* Create an Amazon Textract explorer application
* Detect PPE in images
* Detect entities in text extracted from an image
* Detect faces in an image
* Detect objects in images
* Detect people and objects in a video
* Save EXIF and other image information
* Troubleshooting
* Troubleshooting Amazon S3 by Symptom
* Getting Amazon S3 Request IDs for AWS Support
* Document history
* AWS glossary
Logging requests using server access logging - Amazon Simple Storage Service
AWSDocumentationAmazon Simple Storage Service (S3)User Guide
How do I enable log delivery?Log object key formatHow are logs delivered?Best
effort server log deliveryBucket logging status changes take effect over time
LOGGING REQUESTS USING SERVER ACCESS LOGGING
PDFRSS
Server access logging provides detailed records for the requests that are made
to a bucket. Server access logs are useful for many applications. For example,
access log information can be useful in security and access audits. It can also
help you learn about your customer base and understand your Amazon S3 bill.
Note
Server access logs don't record information about wrong-region redirect errors
for Regions that launched after March 20, 2019. Wrong-region redirect errors
occur when a request for an object or bucket is made outside the Region in which
the bucket exists.
HOW DO I ENABLE LOG DELIVERY?
To enable log delivery, perform the following basic steps. For details, see
Enabling Amazon S3 server access logging.
1. Provide the name of the target bucket. This bucket is where you want Amazon
S3 to save the access logs as objects. Both the source and target buckets
must be in the same AWS Region and owned by the same account.
You can have logs delivered to any bucket that you own that is in the same
Region as the source bucket, including the source bucket itself. But for
simpler log management, we recommend that you save access logs in a
different bucket.
When your source bucket and target bucket are the same bucket, additional
logs are created for the logs that are written to the bucket. We do not
recommend doing this because it could result in a small increase in your
storage billing. In addition, the extra logs about logs might make it harder
to find the log that you are looking for. If you choose to save access logs
in the source bucket, we recommend that you specify a prefix for all log
object keys so that the object names begin with a common string and the log
objects are easier to identify.
Key prefixes are also useful to distinguish between source buckets when
multiple buckets log to the same target bucket.
2. (Optional) Assign a prefix to all Amazon S3 log object keys. The prefix
makes it simpler for you to locate the log objects. For example, if you
specify the prefix value logs/, each log object that Amazon S3 creates
begins with the logs/ prefix in its key.
logs/2013-11-01-21-32-16-E568B2907131C0C0
The key prefix can also help when you delete the logs. For example, you can
set a lifecycle configuration rule for Amazon S3 to delete objects with a
specific key prefix. For more information, see Deleting Amazon S3 log files.
3. (Optional) Set permissions in target grants so that others can access the
generated logs. By default, only the bucket owner always has full access to
the log objects. If your target bucket (where your server access logs are
stored) uses the bucket owner enforced setting for S3 Object Ownership to
disable access control lists (ACLs), you can't grant permissions in target
grants that use ACLs. However, you can update your bucket policy for the
target bucket to grant access to others. For more information, see Identity
and access management in Amazon S3 and Permissions for log delivery.
LOG OBJECT KEY FORMAT
Amazon S3 uses the following object key format for the log objects it uploads in
the target bucket:
TargetPrefixYYYY-mm-DD-HH-MM-SS-UniqueString/
In the key, YYYY, mm, DD, HH, MM, and SS are the digits of the year, month, day,
hour, minute, and seconds (respectively) when the log file was delivered. These
dates and times are in Coordinated Universal Time (UTC).
A log file delivered at a specific time can contain records written at any point
before that time. There is no way to know whether all log records for a certain
time interval have been delivered or not.
The UniqueString component of the key is there to prevent overwriting of files.
It has no meaning, and log processing software should ignore it.
The trailing slash / is required to denote the end of the prefix.
HOW ARE LOGS DELIVERED?
Amazon S3 periodically collects access log records, consolidates the records in
log files, and then uploads log files to your target bucket as log objects. If
you enable logging on multiple source buckets that identify the same target
bucket, the target bucket will have access logs for all those source buckets.
However, each log object reports access log records for a specific source
bucket.
Amazon S3 uses a special log delivery account to write server access logs. These
writes are subject to the usual access control restrictions. We recommend that
you update the bucket policy on the target bucket to grant access to the logging
service principal (logging.s3.amazonaws.com) for access log delivery. However,
you can also grant access for access log delivery to the S3 log delivery group
through your bucket access control list (ACL). Granting access to the S3 log
delivery group using your bucket ACL is not recommended.
When you enable server access logging and grant access for access log delivery
through your bucket policy, you update the bucket policy on the target bucket to
allow s3:PutObject access for the logging service principal. If you use the
Amazon S3 console to enable server access logging on a bucket, the console
automatically updates the bucket policy on the target bucket to grant these
permissions to the logging service principal. For more information about
granting permissions for server access log delivery, see Permissions for log
delivery.
Bucket owner enforced setting for S3 Object Ownership
If the target bucket uses the bucket owner enforced setting for Object
Ownership, ACLs are disabled and no longer affect permissions. You must update
the bucket policy on the target bucket to grant access to the logging service
principal. For more information about Object Ownership, see Grant access to S3
log delivery group for server access logging.
BEST EFFORT SERVER LOG DELIVERY
Server access log records are delivered on a best effort basis. Most requests
for a bucket that is properly configured for logging result in a delivered log
record. Most log records are delivered within a few hours of the time that they
are recorded, but they can be delivered more frequently.
The completeness and timeliness of server logging is not guaranteed. The log
record for a particular request might be delivered long after the request was
actually processed, or it might not be delivered at all. The purpose of server
logs is to give you an idea of the nature of traffic against your bucket. It is
rare to lose log records, but server logging is not meant to be a complete
accounting of all requests.
It follows from the best-effort nature of the server logging feature that the
usage reports available at the AWS portal (Billing and Cost Management reports
on the AWS Management Console) might include one or more access requests that do
not appear in a delivered server log.
BUCKET LOGGING STATUS CHANGES TAKE EFFECT OVER TIME
Changes to the logging status of a bucket take time to actually affect the
delivery of log files. For example, if you enable logging for a bucket, some
requests made in the following hour might be logged, while others might not. If
you change the target bucket for logging from bucket A to bucket B, some logs
for the next hour might continue to be delivered to bucket A, while others might
be delivered to the new target bucket B. In all cases, the new settings
eventually take effect without any further action on your part.
For more information about logging and log files, see the following sections:
Topics
* Enabling Amazon S3 server access logging
* Amazon S3 server access log format
* Deleting Amazon S3 log files
* Using Amazon S3 access logs to identify requests
Javascript is disabled or is unavailable in your browser.
To use the Amazon Web Services Documentation, Javascript must be enabled. Please
refer to your browser's Help pages for instructions.
Document Conventions
Identifying S3 requests
Enabling server access logging
Did this page help you? - Yes
Thanks for letting us know we're doing a good job!
If you've got a moment, please tell us what we did right so we can do more of
it.
Did this page help you? - No
Thanks for letting us know this page needs work. We're sorry we let you down.
If you've got a moment, please tell us how we can make the documentation better.
Did this page help you?
YesNo
Provide feedback
Edit this page on GitHub
Next topic:Enabling server access logging
Previous topic:Identifying S3 requests
Need help?
* Try AWS re:Post
* Connect with an AWS IQ expert
PrivacySite termsCookie preferences
© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
On this page
--------------------------------------------------------------------------------
* How do I enable log delivery?
* Log object key format
* How are logs delivered?
* Best effort server log delivery
* Bucket logging status changes take effect over time
DID THIS PAGE HELP YOU? - NO
Thanks for letting us know this page needs work. We're sorry we let you down.
If you've got a moment, please tell us how we can make the documentation better.
Feedback