Glossary
S3 server access logs
Per-request text logs of an S3 bucket — requester, operation, object key, status and bytes sent — delivered best effort to a target bucket or CloudWatch Logs.
S3 server access logging writes one line per request made to a bucket:
bucket owner, bucket, time, remote IP, requester (an IAM ARN, or - for
anonymous requests), operation such as REST.GET.OBJECT, object key,
HTTP status, bytes sent, user agent and more.
It is configured per bucket and is off by default. Delivery is best effort: AWS does not guarantee completeness or timeliness, and records usually arrive within a few hours. It is still a valuable, independent record of object reads, especially when CloudTrail data events were not enabled.
See S3 data exfiltration evidence. Reference: Logging requests with server access logging.