New featureMedium

Amazon S3 server access logs now deliver to Amazon CloudWatch Logs and Amazon S3 Tables

Amazon S3 now delivers server access logs to CloudWatch Logs, enabling instant querying, alarms, cross-account and cross-Region aggregation, and KMS encryption. Logs can also be mirrored to S3 Tables in Apache Iceberg format at no additional storage cost, allowing direct SQL querying with Athena, Redshift, and other Iceberg-compatible engines.

Amazon S3 now supports delivering server access logs to Amazon CloudWatch Logs, providing instant querying, alarms, cross-account and cross-Region aggregation, and AWS Key Management Service (KMS) encryption for access log data. Logs can also be mirrored to Amazon S3 Tables in Apache Iceberg format at no additional storage cost. With delivery to CloudWatch Logs, users can set alarms on error rates, monitor traffic patterns, investigate access incidents across accounts and Regions, and correlate S3 access activity with other operational data. Logs mirrored to S3 Tables are immediately queryable with standard SQL in Amazon Athena, Amazon Redshift, and other Iceberg-compatible query engines, enabling auditing of access patterns, analysis of usage trends, and identification of cost drivers across buckets over time. S3 server access logs delivery to CloudWatch Logs is available today in all AWS Regions except AWS China Regions and AWS GovCloud (US) Regions.

Read the original AWS announcement

Related articles and terms

Why CloudWatch Logs Costs More Than You Expect - The Cost Structure of Ingestion, Storage, and AnalysisThis article explains the pricing structure where CloudWatch Logs ingestion costs over 20 times more than storage, the cost explosions caused by VPC Flow Logs and Lambda logs, and optimization strategies using the Infrequent Access class and S3 export.Amazon CloudWatchA service that provides monitoring, log management, and alarms for AWS resources and applicationsBuilding a Security Data Lake with Amazon Security Lake - Unified Analysis in OCSF FormatLearn about Security Lake's automatic aggregation of CloudTrail, VPC Flow Logs, and Route 53 logs, OCSF normalization, and integration with subscribers.Amazon Security LakeA service that automatically normalizes security data from CloudTrail, VPC Flow Logs, Route 53 Resolver logs, and other sources into OCSF format, centralizing it in an S3-based security data lakeThe Integration Power of the AWS Observability Stack - Operational Transparency Through CloudWatch, X-Ray, and CloudTrailThis article examines the integration level of the AWS observability stack centered on CloudWatch, X-Ray, and CloudTrail, comparing it with Azure Monitor and GCP Cloud Logging to explain how the three pillars of metrics, traces, and logs drive differences in operational quality.