S3 general purpose buckets should log object-level write events

How to fix it

• Overwrites existing settings: The CLI and Terraform routes replace every event selector on the trail, so include the ones it already has, such as management events and any Lambda or DynamoDB data events.
• Affects another check: Log all events, as the Terraform route does, also clears S3.23 (reads); Log only write events leaves it failing.

In the console

CloudTrail → Trails → the multi-Region trail → Data events

Resource type

S3

Log selector template

Log all events, or Log only write events (either passes)

With the AWS CLI

aws cloudtrail put-event-selectors --trail-name <trail-arn> --event-selectors file://event-selectors.json --region <home-region>

With Terraform

resource "aws_cloudtrail" "this" {
  name                  = var.trail_name
  s3_bucket_name        = var.log_bucket
  is_multi_region_trail = true

  advanced_event_selector {
    name = "Log all S3 object events"

    field_selector {
      field  = "eventCategory"
      equals = ["Data"]
    }

    field_selector {
      field  = "resources.type"
      equals = ["AWS::S3::Object"]
    }
  }
}