We need to monitor object-level access and changes in one of our S3 buckets with cloudtrail (specifically with cloudtrail, not s3 access logs).

The cloudtrail documentation indicates in a small note that maximum 250 data resources can be watched. (See https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html#creating-data-event-selectors-with-the-AWS-CLI)

Does that mean that at most 250 objects from our bucket will be watched, or can I set a watch on the whole bucket, and get reports on the 1000+ objects we have in there?


No, DataResource is defined as

The Amazon S3 buckets or AWS Lambda functions that you specify in your event selectors for your trail to log data events. Data events provide information about the resource operations performed on or within a resource itself. These are also known as data plane operations. You can specify up to 250 data resources for a trail.

In the API documentation.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.