Configure bucket access logging
Access logging creates files describing requests to the bucket and stores them in a destination bucket. Configure it in Access logging; the service then produces and delivers the logs.
Prepare the destination and permissions
The tab is available for one general purpose bucket when Read bucket access logging or Set bucket access logging is enabled in the account capabilities. If both are disabled, Access logging is hidden. Open File > Accounts…, select the account, click Edit…, then open Capabilities. Under Bucket access logging, configure Read bucket access logging, Set bucket access logging, Set access log object key format and Set access log target grants only when supported by the service.
Reading must succeed, and both Read bucket access logging and Set bucket access logging are required to apply or disable logging. With no active configuration, Enable access logging is unchecked, destination and prefix are empty, no grants are defined and the proposed format is Historical simple prefix (no format element).
Credentials also need permission to read and change the configuration, such as s3:GetBucketLogging and s3:PutBucketLogging on Amazon S3. The destination bucket must allow S3 to deliver logs; additional grants on log objects do not provide that delivery permission.
On Amazon S3, use a general purpose destination bucket in the source account and Region, without Object Lock, default retention or Requester Pays, and with SSE-S3. To authorize delivery through a bucket policy, grant s3:PutObject to logging.s3.amazonaws.com under the target prefix; S3Client does not add that permission. Avoid the source bucket or a destination with access logging enabled to prevent loops. Amazon S3 logging prerequisites.
Delivery is asynchronous and does not guarantee a complete record of every request. Amazon S3 access logging documentation.
Selecting a destination with Browse… does not verify all these requirements. S3Client can read its Object Ownership setting when that reading operation is available; check Region, owner account, encryption and protection separately. See ACLs and object ownership, encryption and Object Lock.
When ACLs are enabled, delivery can also be authorized by granting WRITE and READ_ACP to the S3 Log Delivery group on the destination bucket. These permissions remain separate from grants on log objects. Amazon S3 delivery permissions.
Bucket names, prefixes and grantee identifiers must contain valid XML text. S3Client limits the configuration XML document to 64 KiB; The bucket logging XML document would exceed the 64 KiB limit. means you must reduce the configuration before applying it.
Under Account > Capabilities > Bucket access logging, the compatibility dropdown offers Strict S3 XML or Preserve known logging additions. The second option allows editing a standard logging configuration containing the known fields ObjectRollTime and RecordsBatchSize: S3Client preserves their values when you change the destination, prefix or grants. Disabling logging removes them. The interface does not offer controls to create or change these additional fields. Unknown additions leave the configuration read-only.
The service may return an explicit simple format even when Set access log object key format is disabled. This form is equivalent to the default and does not prevent editing: S3Client then saves the simple format without an explicit format element. Partitioned formats still require this capability.
Enable or change logging
- In the S3 pane, select the source bucket.
- Open Properties > Access logging. Opening the tab starts reading its settings.
- Select Enable access logging.
- Enter Destination bucket, or click its Browse… button to select a bucket.
- Enter Key prefix, which may be empty. Its Browse… button selects a prefix in a destination chosen with the browser.
- Choose Object key format.
- Configure additional grants if needed.
- Click Apply to bucket and check the result in the tab.
- Use Reload to inspect remote settings when needed.
Apply to bucket saves logging immediately. The properties dialog’s OK button does not save it. Closing properties with unapplied logging changes asks you to confirm discarding them.
Key format
| Value | Effect |
|---|---|
| Historical simple prefix (no format element) | Uses the historical simple format without sending an explicit format choice to the service. |
| Simple prefix | Explicitly requests the simple format from the service. |
| Partitioned by event time | Organizes keys by account, Region, source bucket and event date. |
| Partitioned by delivery time | Uses that structure with the delivery date. |
Simple prefix, Partitioned by event time and Partitioned by delivery time require Set access log object key format in the account capabilities. The prefix is used as entered: end it with / to group logs in a logical folder. The format changes object keys, not the fields inside log files.
Additional access to log objects
Under Additional target grants, click Add, choose a Canonical user or S3 group, then select Permission: READ, WRITE or FULL_CONTROL. Select a row and click Remove to remove it. The destination bucket owner automatically has full control of log files.
In Choose an ACL grantee, select an available grantee or enter Type and Identifier: an S3 canonical ID for Canonical user, or a group URI for S3 group. A canonical ID is not an AWS account number. Remote display name is optional for a canonical user. After OK, Target grant permission proposes READ by default. An identical existing grant is not added again.
These grants (TargetGrants) are saved through PutBucketLogging. They require Set access log target grants and remain available when Enable ACL operations for this account is unchecked: they neither read nor modify an existing object’s ACL. This capability grants no remote permissions and does not guarantee that the service will accept the configuration.
If the selected destination uses Bucket owner enforced, you cannot save TargetGrants: authorize delivery through a bucket policy following Amazon S3’s rules. Disabling ACL operations in S3Client does not remove this service restriction. Older grantees identified by email remain visible, but their presence blocks changes to the entire configuration.
Disable logging
Disable access logging removes the complete configuration, including data S3Client cannot display. It does not delete log objects already delivered.
- In Properties > Access logging, check the source bucket.
- Click Disable access logging.
- Confirm configuration removal.
- Wait for the result, then use Reload to check the state.
Clearing Enable access logging does not disable remote logging. Use Disable access logging to apply the change.
Handle conflicts and uncertain results
S3Client rereads the configuration before writing. In Bucket access logging changed, Reload remote configuration takes the remote configuration into account while retaining your input; Replace remote configuration saves your input in its place; Cancel retains it without writing. The tab’s Reload button has a different effect: it replaces your input with the remote values.
A remote configuration that S3Client cannot edit remains read-only. If the preliminary check detects this situation, your logging activation settings are not saved. You can still use Disable access logging to remove the entire configuration, including elements that are not displayed. If it has changed since it was read, confirm Disable changed access logging configuration before removal.
If the result says the configuration was accepted but its current value is not confirmed, click Reload; do not immediately submit the change again. Reading errors or account changes also require rereading or reopening the properties.
Successful configuration confirms the settings rather than log delivery. Later, check objects under the destination prefix, allowing for the service’s delivery delay.
No acceptance was confirmed. or The operation ended without confirmation. Your unsaved changes are retained. also requires rereading before another attempt. Your draft is retained, and modification actions remain blocked until reading succeeds. Missing confirmation does not guarantee that the service made no change.
Preliminary verification does not lock the configuration against another write. A change already accepted through Apply to bucket or Disable access logging is not undone by Cancel in the properties.