Glossary
CloudTrail data events
High-volume, resource-level CloudTrail events such as S3 GetObject or Lambda Invoke — not logged by default, and the only CloudTrail proof of which S3 objects were read.
Data events are CloudTrail records of operations on or within a
resource: S3 object reads and writes (GetObject, PutObject,
DeleteObject), Lambda Invoke, DynamoDB item operations and more. They
are separate from management events (configuration changes such as
CreateUser).
Trails and event data stores do not log data events by default, and they are billed separately. They must be selected explicitly, ideally with advanced event selectors limited to sensitive buckets.
Without S3 data events or S3 server access logs, you cannot tell which objects were downloaded — see S3 data exfiltration evidence. Reference: Logging data events.