S3 Server Access Logging

Via AWS Console

Enable server access logging for an S3 bucket For deeper technical details, refer to the Amazon S3 Server Access Logging guide.

Via AWS Command Line Interface

1. Create a logging.json file with these contents, replacing <stack-internal-bucket> with your stack's internal bucket name, and <stack> with the name of your cumulus stack.

   {
     "LoggingEnabled": {
       "TargetBucket": "<stack-internal-bucket>",
       "TargetPrefix": "<stack>/ems-distribution/s3-server-access-logs/"
     }
   }

2. Add the logging policy to each of your protected and public buckets by calling this command on each bucket.

   aws s3api put-bucket-logging --bucket <protected/public-bucket-name> --bucket-logging-status file://logging.json

3. Verify the logging policy exists on your buckets.

   aws s3api get-bucket-logging --bucket <protected/public-bucket-name>