title: AWS S3 log for DeleteObject?
body: <p>How to use AWS services like CloudTrail or CloudWatch to check which user performed event <code>DeleteObject</code>?</p>
  
  <p>I can use S3 Event to send a Delete event to SNS to notify an email address that a specific file has been deleted from the S3 bucket but <strong>the message does not contain the username that did it</strong>.</p>
  
  <p>I can use CloudTrail to log all events related to an S3 bucket to another bucket, but I tested and it logs many details, and only event <code>PutObject</code> but not <code>DeleteObject</code>.</p>
  
  <p>Is there any easy way to monitor an S3 bucket to find out which user deleted which file?</p>
  
  <blockquote>
    <p>Upate 19 Aug</p>
  </blockquote>
  
  <p>Following Walt's answer below, I was able to log the <code>DeleteObject</code> event. However, I can only get the file name (<code>requestParameters.key
  </code>) for <code>PutObject</code>, but not for <code>DeleteObjects</code>.</p>
  
  <pre><code>| # | @timestamp | userIdentity.arn | eventName | requestParameters.key |
  | - | ---------- | ---------------- | --------- | --------------------- |
  | 1 | 2019-08-19T09:21:09.041-04:00 | arn:aws:iam::ID:user/me | DeleteObjects |
  | 2 | 2019-08-19T09:18:35.704-04:00 | arn:aws:iam::ID:user/me | PutObject |test.txt |
  </code></pre>
  
  <p>It looks like other people have had the same issue and AWS is working on it: <a href="https://forums.aws.amazon.com/thread.jspa?messageID=799831" rel="nofollow noreferrer">https://forums.aws.amazon.com/thread.jspa?messageID=799831</a></p>