S3 general purpose buckets should log object-level read events

How to fix it

• Overwrites existing settings: The CLI and Terraform routes replace every event selector on the trail, so include the ones it already has, such as management events and any Lambda or DynamoDB data events.
• Affects another check: Log all events, as the Terraform route does, also clears S3.22 (writes); Log only read events leaves it failing.

In the console

CloudTrail → Trails → the multi-Region trail → Data events

Resource type

S3

Log selector template

Log all events, or Log only read events (either passes)

With the AWS CLI

aws cloudtrail put-event-selectors --trail-name <trail-arn> --event-selectors file://event-selectors.json --region <home-region>

With Terraform

resource "aws_cloudtrail" "this" {
  name                  = var.trail_name
  s3_bucket_name        = var.log_bucket
  is_multi_region_trail = true

  event_selector {
    read_write_type = "All"

    data_resource {
      type   = "AWS::S3::Object"
      values = ["arn:aws:s3"]
    }
  }
}