How to control actions on the S3 bucket and Alerts with CloudWatch and CloudTrail
Tags: s3, cloudtrail, cloudwatc, sns
Published: 2023-08-07 23:23:42

In this article, I am going to show how to create a CloudTrail trail that tracks the activity of an S3 bucket. We will then  create a CloudWatch log group to search through the activity logs that describe the API actions on that S3 bucket. Additionally, we will create a CloudWatch metric filter and CloudWatch alarm to notify us whenever there are uploads or downloads of an S3 object on that bucket.

Please visit my **[GitHub Repository for S3 articles](https://github.com/awsmine/S3_projects)** on various topics being updated on constant basis.

_**Let’s get started!**_


# Objectives:

**1.** Create S3 bucket and Upload Objects

**2.** Create a CloudTrail Trail

**3.** Create and Configure a CloudWatch Log Group with Your CloudTrail Trail

**4.** Create and Configure a CloudWatch Alarm with Your CloudTrail Trail 

# Pre-requisites:
- AWS user account with admin access, not a root account.

# Resources Used:

***[What is Amazon CloudWatch?](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/WhatIsCloudWatch.html)***

***[What Is AWS CloudTrail?](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html)***

***[What is Amazon SNS?](https://docs.aws.amazon.com/sns/latest/dg/welcome.html)***

# Steps for implementation to this project:

## 1. Create S3 bucket and Upload Objects

- Create a simple s3 bucket - ***`mybucket-123456`***
- Upload a file - ***`000-employee-1`***

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/hamtfgdkyn9wjeacl97z.png)

## 2. Create a CloudTrail Trail

- Create a CloudTrail Trail - ***`s3-bucket-123456-trail`*** for the ***`Data Events`*** in S3 bucket


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ju00vmcwedptwqcy2wwm.png)



![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8dv8ml50hgsd58o65667.png)




![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8jlcyv9a4634qvqediku.png)



![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3nvq1mvh3yey1vta4mp0.png)


## 3. Create and Configure a CloudWatch Log Group with Your CloudTrail Trail


- setup CloudWatch Logs
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/fz5s2lylbbi5vvf8olj9.png)


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/erin8naqny34pmxn24v1.png)

- Configure a CloudWatch Log Group with Your CloudTrail Trail

#### 1. upload a new file into s3 bucket



![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/b37lngu2qo3xd2dbnss5.png)


#### 2. view Cloudwatch log events


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/n50biefafb0hbm7ebpsu.png)


#### 3. Create filter


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4u72ur9z5thqx0h31ysm.png)

#### 4. Test Pattern Results


- Found 6 matches out of 11 event(s) in the sample log.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/24tm345dyes9h0jaw0wx.png)

- Next

#### 5. Assign Filter

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/w6uwnvpvdovsyn9vdcgl.png)


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/crg9as8rk0q4dwqt6rr8.png)

- Next

- Summary


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/26z8xajpmkes1fv1clgg.png)

- Create metric filter




## 4. Create and Configure a CloudWatch Alarm with Your CloudTrail Trail 


- Create Alarm

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/te5baqag9nhyuzjhd18b.png)


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/utnpn90hlkoi8z7z6xjm.png)


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/lzxshb2ehmth4kymf921.png)


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/lsrdz1nmi985jnof8uul.png)


- confirm your email


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/luvfma9lvcdkyiraol7w.png)

- Confirm Subscription


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/k2mr30uwm0rsaibw7oo9.png)


- Next


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/fq549oltnm5ellor9zd0.png)

- Click Next
- Click Create Alarm 

## Cleanup


- Delete S3 bucket
- Delete CloudTrail
- Delete Cloudwatch

## What we have done so far
- we have created and configured a CloudTrail trail and a CloudWatch Logs log stream in order to set up monitoring and access alerts for an S3 bucket. 
- Specifically, we have created the trail for monitoring access to the S3 bucket, the CloudWatch Logs log stream to allow searching and filtering of the logs, and then a CloudWatch metric filter and alarm on that metric filter to generate an alert whenever there is any access to an S3 bucket.