RQL query for S3 Bucket activity

[Junaid-Khan]

Does anyone know how to write a query to look for S3 bucket activity i.e someone logging in to S3 buckets and performing some task as creating objects etc. 

[AShah12 · Accepted solution]

You will need to have cloudtrail - data events (s3) enabled for the logs to appear. 

[Junaid-Khan]

Thanks, I do have cloud trail enabled. Just can't seem to find the right attribute to build the query. Here is my attempt. 

event where cloud.account IN ( 'SRA-B2B San Jose' ) AND operation IN ( 'GetBucketLogging' ) ADDCOLUMN $.requestParameters.bucketName

[ebeuerlein]

By default, cloudtrail records s3 bucket operations only.  You would need to enable object logging per bucket to capture detailed events.

Refer here for the various API calls that are enabled by default for cloudtrail: https://docs.aws.amazon.com/AmazonS3/latest/dev/cloudtrail-logging.html

[lpingali]

---

@ebeuerlein wrote:

By default, cloudtrail records s3 bucket operations only.  You would need to enable object logging per bucket to capture detailed events.

Refer here for the various API calls that are enabled by default for cloudtrail: https://docs.aws.amazon.com/AmazonS3/latest/dev/cloudtrail-logging.html

---

Junaid,
Once you have enabled object logging for the bucket in the specific account, try the following RQL to see if you get the results. 

event where cloud.account = 'SRA-B2B San Jose' AND operation = 'GetBucketLogging' 

[Junaid-Khan]

Thank You, 

I do have object level logging enabled on the S3's but still don't see the query executing anything. I get a blank page. 

event where cloud.account = 'SRA-B2B San Jose' AND cloud.service = 's3.amazonaws.com' AND operation = 'GetBucketLogging'

[ebeuerlein]

It depends on when you made the change - you may need to widen the time range to capture the exact event of when it was changed.

[lpingali]

Junaid,

Please try this RQL to get information on specific actions on S3 buckets:

event where cloud.account = 'SRA-B2B San Jose' AND operation IN ('DeleteBucket', 'PutBucketAcl', 'PutBucketLogging', 'PutBucketPolicy')

You can add more options from the drop down options.