Can I see any kind of changelogs? And is it also possible to see the IP addresses (with or without the access tokens) that were used?
It looks like S3's Server Access Logging includes modification requests. You can't select what to log though, so you'd need to log all access (including anonymous downloads) and then filter the logs. Objects can't be modified via CloudFront, so you don't need to worry about that.