Study guide
Technical reference and lesson notes
Purpose of This Lesson
Amazon S3 server access logging records detailed information about requests made to an S3 bucket. It is useful for investigating bucket activity, auditing access patterns, and troubleshooting unexpected requests or errors.
Key Concepts
What Server Access Logging Records
S3 server access logs can include details such as:
- The requester
- The bucket receiving the request
- The request timestamp
- The requested action or operation
- The HTTP response status
- An error code, when applicable
These records provide request-level visibility rather than merely showing that a bucket was accessed.
Logging Is Disabled by Default
S3 server access logging must be explicitly enabled on the source bucket. When enabling it, configure:
- A destination bucket for the log objects
- An optional key prefix for organizing the delivered logs
- Permissions that allow the S3 log delivery mechanism to write to the destination bucket
Log delivery may not be immediate, so do not expect records to appear as soon as a request is made.
Use a Separate Destination Bucket
The destination should be different from the source bucket. Sending access logs to the same bucket can create a recursive logging loop:
- A request is made to the bucket.
- S3 writes a log object to that bucket.
- The log-object write is itself another bucket event.
- Additional log objects may be generated continuously.
A separate destination bucket prevents this circular behavior and makes it easier to manage log retention and access controls.
Destination-Bucket Permissions
The destination bucket must permit the Amazon S3 log delivery group to write log objects. In configurations using S3 bucket ACLs, this means granting the required write access to the S3 log delivery group.
Without the appropriate destination permissions, logging may be enabled but log objects will not be delivered successfully.
Cost Model
The primary cost associated with S3 server access logging is the storage used for the delivered log objects. The destination bucket should therefore have an appropriate lifecycle and retention strategy if logs do not need to remain in the S3 Standard storage class indefinitely.
Exam-Relevant Takeaways
- Server access logging is disabled by default.
- Configure a separate destination bucket; do not log a bucket to itself.
- The destination bucket requires permission for S3 log delivery to write objects.
- An optional prefix can organize logs within the destination bucket.
- Logs contain request details such as requester, operation, time, response status, and error information.
- Log delivery can be delayed; it is not necessarily real time.
- The logs themselves consume S3 storage and should be governed with retention and lifecycle policies.
Architecture Decision Guide
| Requirement | Appropriate approach |
|---|---|
| Record detailed requests made to an S3 bucket | Enable S3 server access logging |
| Avoid recursive log generation | Use a separate destination bucket |
| Organize delivered log objects | Configure a destination prefix |
| Ensure delivery succeeds | Grant the S3 log delivery group write access to the destination bucket |
| Reduce long-term log storage cost | Apply suitable lifecycle and retention policies to the destination bucket |
| Investigate why logs are not immediately visible | Account for delivery latency and verify destination permissions |
Common Exam Traps
- Using the same bucket as source and destination: This can cause recursive logging behavior. Always choose a separate destination bucket.
- Assuming logging is automatically enabled: S3 server access logging requires explicit configuration.
- Forgetting destination permissions: Selecting a target bucket alone is not sufficient; S3 must be allowed to write there.
- Expecting real-time records: Access logs can take time to appear.
- Confusing request logging with object-level audit events: Server access logging provides request records. It should not automatically be treated as a complete, real-time audit stream for every object-level activity.
- Ignoring storage costs: Delivered logs are stored as S3 objects and incur storage charges.
Real-World Engineer Notes
- Use a dedicated logging bucket when practical. This simplifies access control, retention, and monitoring.
- Restrict access to the destination bucket because access logs may expose requester information, object paths, request patterns, or error details.
- Apply lifecycle rules to transition or expire old logs according to compliance and operational requirements.
- When testing, generate requests against the source bucket and allow time for log delivery before troubleshooting.
- Verify both sides of the configuration: logging must be enabled on the source bucket, and the destination must accept writes from the S3 log delivery mechanism.
Quick Reference Summary
- Purpose: Record detailed S3 request activity.
- Default state: Disabled.
- Destination: A different S3 bucket from the source.
- Organization: Optional destination prefix.
- Required access: S3 log delivery must be able to write to the destination bucket.
- Recorded data: Requester, bucket, time, action, response status, and applicable error code.
- Timing: Delivery may be delayed.
- Cost: Storage for delivered log objects.
Flashcards
- Q: Is S3 server access logging enabled by default?
A: No. It must be explicitly enabled on the source bucket.
- Q: Where should S3 server access logs be delivered?
A: To a separately configured destination S3 bucket.
- Q: Why should the source and destination buckets be different?
A: Logging to the same bucket can create a recursive loop as log writes generate additional bucket activity.
- Q: What optional setting helps organize delivered access logs?
A: A destination key prefix.
- Q: What permission is required on the destination bucket?
A: The S3 log delivery group must be allowed to write log objects.
- Q: Name three types of information recorded in S3 server access logs.
A: Examples include the requester, request time, operation, response status, bucket name, and error code.
- Q: Are S3 server access logs delivered in real time?
A: No. Delivery can be delayed.
- Q: What direct storage consideration applies to server access logging?
A: Delivered log objects consume S3 storage and may require lifecycle management.
- Q: What configuration issue can cause logging to appear enabled but produce no logs?
A: Missing write permission for the S3 log delivery mechanism on the destination bucket.
Practice Questions
Question 1
A company enables server access logging on an S3 bucket and selects the same bucket as the logging destination. What is the primary concern with this design?
A. S3 will encrypt the logs with the wrong key.
B. The configuration can create recursive logging activity.
C. S3 will automatically delete the source objects.
D. The logs will be written only to the S3 Glacier storage class.
Correct answer: B
Explanation: Log objects written to the same bucket can generate additional bucket activity and potentially cause a recursive logging loop. A separate destination bucket is the correct design.
Question 2
An administrator enables S3 server access logging and selects a destination bucket, but no log objects appear. Which check should be performed first?
A. Confirm that the destination bucket allows the S3 log delivery group to write objects.
B. Disable versioning on the source bucket.
C. Replace the destination bucket with an Amazon CloudWatch Logs log group.
D. Add a lifecycle rule to the source bucket.
Correct answer: A
Explanation: The destination bucket must grant the required write permission to the S3 log delivery mechanism. Without it, log delivery will fail even if logging is enabled on the source bucket.
Question 3
A security team expects an S3 access log entry to appear immediately after every request. Which statement best describes the service behavior?
A. Server access logging is synchronous and always immediate.
B. Log delivery can be delayed, so records may not appear immediately.
C. Logs are generated only when an object is deleted.
D. Logs are available only if the bucket is public.
Correct answer: B
Explanation: S3 server access log delivery is not necessarily real time. A delay before log objects appear is expected and should be considered during testing and incident investigation.
Question 4
A company wants to reduce the cost of retaining S3 server access logs for several years. Which solution addresses the relevant cost driver?
A. Disable all permissions on the destination bucket.
B. Configure a lifecycle policy for the delivered log objects.
C. Send logs to the source bucket instead.
D. Remove the destination prefix.
Correct answer: B
Explanation: Delivered logs are stored as S3 objects. Lifecycle rules can transition or expire older logs based on the organization’s retention requirements.