Monitoring and logging access points for directory buckets

You can log requests made through access points and requests made to the APIs that manage access points, such as CreateAccessPoint and GetAccessPointPolicy, by using AWS CloudTrail. CloudTrail log entries for requests made through access points include the access point ARN (which includes the access point name) in the resources section of the log.

For example, suppose you have the following configuration:

The following example shows the resources section of a CloudTrail log entry for the preceding configuration:

"resources": [
 {"type": "AWS::S3Express::Object",
 
 "ARN": "arn:aws:s3express-region:123456789012:bucket/amzn-s3-demo-bucket--zone-id--x-s3/my-image.jpg"
 },
 {"accountId": "c",
 "type": "AWS::S3Express::DirectoryBucket",
 "ARN": "arn:aws::s3express:region:123456789012:bucket/amzn-s3-demo-bucket--zone-id--x-s3"
 },
 {"accountId": "123456789012",
 "type": "AWS::S3::AccessPoint",
 "ARN": "arn:aws:s3express:region:123456789012:accesspoint/my-bucket-ap--zoneID--xa-s3"
 }
 ] 

For more information about AWS CloudTrail, see What is AWS CloudTrail? in the AWS CloudTrail User Guide.

Thanks for letting us know we're doing a good job!

If you've got a moment, please tell us what we did right so we can do more of it.

Thanks for letting us know this page needs work. We're sorry we let you down.

If you've got a moment, please tell us how we can make the documentation better.