ReadonlybucketS3 bucket name to scope CloudTrail data event capture to. Accepts bucket names or SSM parameter references.
Use cases: Target specific data buckets for audit; Scope trail to sensitive data stores
AWS: CloudTrail S3 data event selector bucket target
Validation: Required; must be existing S3 bucket name or SSM parameter path
Optional ReadonlyobjectOptional S3 key prefix to further narrow event capture within the bucket. Only data events for objects under this prefix will be logged.
Use cases: Audit only a specific dataset prefix; Reduce log volume for large buckets
AWS: CloudTrail S3 data event selector object prefix filter
Validation: Optional; valid S3 key prefix string
Scoped S3 event selector targeting a specific bucket and optional key prefix. Narrows CloudTrail data event capture to only the specified S3 locations rather than logging all S3 data events account-wide.
Use cases: Cost-effective auditing of specific data buckets; Targeted compliance monitoring; Reduced log volume
AWS: CloudTrail S3 data event selector (DataResource with S3 ARN)
Validation: bucketName required; objectPrefix optional