Amazon S3 server access log format

The canonical user ID of the owner of the source bucket. The canonical user ID is another form of the AWS account ID. For more information about the canonical user ID, see AWS account identifiers in the AWS General Reference. For information about how to find the canonical user ID for your account, see Finding the canonical user ID for your AWS account.

Example entry

79a59df900b949e55d96a1e698fbacedfd6e09d98eacf8f8d5218e7cd47ef2be

The name of the bucket that the request was processed against. If the system receives a malformed request and cannot determine the bucket, the request will not appear in any server access log.

Example entry

amzn-s3-demo-bucket1

The time at which the request was received; these dates and times are in Coordinated Universal Time (UTC). The format, using strftime() terminology, is as follows: [%d/%b/%Y:%H:%M:%S %z]

Example entry

[06/Feb/2019:00:00:38 +0000]

The apparent IP address of the requester. Intermediate proxies and firewalls might obscure the actual IP address of the machine that's making the request.

Example entry

192.0.2.3

The canonical user ID of the requester, or a - for unauthenticated requests. If the requester was an IAM user, this field returns the requester's IAM user name along with the AWS account that the IAM user belongs to. This identifier is the same one used for access control purposes.

Example entry

79a59df900b949e55d96a1e698fbacedfd6e09d98eacf8f8d5218e7cd47ef2be

If the requester is using an assumed role, this field returns the assumed IAM role.

Example entry

arn:aws:sts::123456789012:assumed-role/roleName/test-role

A string generated by Amazon S3 to uniquely identify each request.

Example entry

3E57427F33A59F07

The operation listed here is declared as SOAP.operation, REST.HTTP_method.resource_type, WEBSITE.HTTP_method.resource_type, or BATCH.DELETE.OBJECT, or S3.action.resource_type for S3 Lifecycle and logging.

Example entry

REST.PUT.OBJECT

The key (object name) part of the request.

Example entry

/photos/2019/08/puppy.jpg

The Request-URI part of the HTTP request message.

Example Entry

"GET /amzn-s3-demo-bucket1/photos/2019/08/puppy.jpg?x-foo=bar HTTP/1.1"

The numeric HTTP status code of the response.

Example entry

200

The Amazon S3 Error responses , or - if no error occurred.

Example entry

NoSuchBucket

The number of response bytes sent, excluding HTTP protocol overhead, or - if zero.

Example entry

2662992

The total size of the object in question.

Example entry

3462992

The number of milliseconds that the request was in flight from the server's perspective. This value is measured from the time that your request is received to the time that the last byte of the response is sent. Measurements made from the client's perspective might be longer because of network latency.

Example entry

70

The number of milliseconds that Amazon S3 spent processing your request. This value is measured from the time that the last byte of your request was received until the time that the first byte of the response was sent.

Example entry

10

The value of the HTTP Referer header, if present. HTTP user-agents (for example, browsers) typically set this header to the URL of the linking or embedding page when making a request.

Example entry

"http://www.example.com/webservices"

The value of the HTTP User-Agent header.

Example entry

"curl/7.15.1"

The version ID in the request, or - if the operation doesn't take a versionId parameter.

Example entry

3HL4kqtJvjVBH40Nrjfkd

The x-amz-id-2 or Amazon S3 extended request ID.

Example entry

s9lzHYrFp76ZVxRcpX9+5cjAnEH2ROuNkd2BHfIa6UkFVdtjf5mKR3/eTPFvsiP/XV/VLi31234=

The signature version, SigV2 or SigV4, that was used to authenticate the request or a - for unauthenticated requests.

Example entry

SigV2

The Secure Sockets Layer (SSL) cipher that was negotiated for an HTTPS request or a - for HTTP.

Example entry

ECDHE-RSA-AES128-GCM-SHA256

The type of request authentication used: AuthHeader for authentication headers, QueryString for query string (presigned URL), or a - for unauthenticated requests.

Example entry

AuthHeader

The endpoint used to connect to Amazon S3.

Example entry

s3.us-west-2.amazonaws.com

Some earlier Regions support legacy endpoints. You might see these endpoints in your server access logs or AWS CloudTrail logs. For more information, see Legacy endpoints. For a complete list of Amazon S3 Regions and endpoints, see Amazon S3 endpoints and quotas in the Amazon Web Services General Reference.

The Transport Layer Security (TLS) version negotiated by the client. The value is one of following: TLSv1.1, TLSv1.2, TLSv1.3, or - if TLS wasn't used.

Example entry

TLSv1.2

The Amazon Resource Name (ARN) of the access point of the request. If the access point ARN is malformed or not used, the field will contain a -. For more information about access points, see Using access points. For more information about ARNs, see Amazon Resource Name (ARN) in the AWS Reference Guide.

Example entry

arn:aws:s3:us-east-1:123456789012:accesspoint/example-AP

A string that indicates whether the request required an access control list (ACL) for authorization. If the request required an ACL for authorization, the string is Yes. If no ACLs were required, the string is -. For more information about ACLs, see Access control list (ACL) overview. For more information about using the aclRequired field to disable ACLs, see Controlling ownership of objects and disabling ACLs for your bucket.

Example entry

Yes

The canonical user ID of the bucket that stores the object being copied. The canonical user ID is another form of the AWS account ID. For more information about the canonical user ID, see AWS account identifiers in the AWS General Reference. For information about how to find the canonical user ID for your account, see Finding the canonical user ID for your AWS account.

Example entry

79a59df900b949e55d96a1e698fbacedfd6e09d98eacf8f8d5218e7cd47ef2be

The name of the bucket that stores the object that's being copied.

Example entry

amzn-s3-demo-bucket1

The time at which the request was received; these dates and times are in Coordinated Universal Time (UTC). The format, using strftime() terminology, is as follows: [%d/%B/%Y:%H:%M:%S %z]

Example entry

[06/Feb/2019:00:00:38 +0000]

The apparent IP address of the requester. Intermediate proxies and firewalls might obscure the actual IP address of the machine that's making the request.

Example entry

192.0.2.3

The canonical user ID of the requester, or a - for unauthenticated requests. If the requester was an IAM user, this field will return the requester's IAM user name along with the AWS account root user that the IAM user belongs to. This identifier is the same one used for access control purposes.

Example entry

79a59df900b949e55d96a1e698fbacedfd6e09d98eacf8f8d5218e7cd47ef2be

If the requester is using an assumed role, this field returns the assumed IAM role.

Example entry

arn:aws:sts::123456789012:assumed-role/roleName/test-role

A string generated by Amazon S3 to uniquely identify each request.

Example entry

3E57427F33A59F07

The operation listed here is declared as SOAP.operation, REST.HTTP_method.resource_type, WEBSITE.HTTP_method.resource_type, or BATCH.DELETE.OBJECT.

Example entry

REST.COPY.OBJECT_GET

The key (object name) of the object being copied, or - if the operation doesn't take a key parameter.

Example entry

/photos/2019/08/puppy.jpg

The Request-URI part of the HTTP request message.

Example entry

"GET /amzn-s3-demo-bucket1/photos/2019/08/puppy.jpg?x-foo=bar"

The numeric HTTP status code of the GET portion of the copy operation.

Example entry

200

The Amazon S3 Error responses of the GET portion of the copy operation, or - if no error occurred.

Example entry

NoSuchBucket

The number of response bytes sent, excluding the HTTP protocol overhead, or - if zero.

Example entry

2662992

The total size of the object in question.

Example entry

3462992

The number of milliseconds that the request was in flight from the server's perspective. This value is measured from the time that your request is received to the time that the last byte of the response is sent. Measurements made from the client's perspective might be longer because of network latency.

Example entry

70

The number of milliseconds that Amazon S3 spent processing your request. This value is measured from the time that the last byte of your request was received until the time that the first byte of the response was sent.

Example entry

10

The value of the HTTP Referer header, if present. HTTP user-agents (for example, browsers) typically set this header to the URL of the linking or embedding page when making a request.

Example entry

"http://www.example.com/webservices"

The value of the HTTP User-Agent header.

Example entry

"curl/7.15.1"

The version ID of the object being copied, or - if the x-amz-copy-source header didn't specify a versionId parameter as part of the copy source.

Example Entry

3HL4kqtJvjVBH40Nrjfkd

The x-amz-id-2 or Amazon S3 extended request ID.

Example entry

s9lzHYrFp76ZVxRcpX9+5cjAnEH2ROuNkd2BHfIa6UkFVdtjf5mKR3/eTPFvsiP/XV/VLi31234=

The signature version, SigV2 or SigV4, that was used to authenticate the request, or a - for unauthenticated requests.

Example entry

SigV4

The Secure Sockets Layer (SSL) cipher that was negotiated for an HTTPS request, or a - for HTTP.

Example entry

ECDHE-RSA-AES128-GCM-SHA256

The type of request authentication used: AuthHeader for authentication headers, QueryString for query strings (presigned URLs), or a - for unauthenticated requests.

Example entry

AuthHeader

The endpoint that was used to connect to Amazon S3.

Example entry

s3.us-west-2.amazonaws.com

Some earlier Regions support legacy endpoints. You might see these endpoints in your server access logs or AWS CloudTrail logs. For more information, see Legacy endpoints. For a complete list of Amazon S3 Regions and endpoints, see Amazon S3 endpoints and quotas in the Amazon Web Services General Reference.

The Transport Layer Security (TLS) version negotiated by the client. The value is one of following: TLSv1.1, TLSv1.2, TLSv1.3, or - if TLS wasn't used.

Example entry

TLSv1.2

The Amazon Resource Name (ARN) of the access point of the request. If the access point ARN is malformed or not used, the field will contain a -. For more information about access points, see Using access points. For more information about ARNs, see Amazon Resource Name (ARN) in the AWS Reference Guide.

Example entry

arn:aws:s3:us-east-1:123456789012:accesspoint/example-AP

A string that indicates whether the request required an access control list (ACL) for authorization. If the request required an ACL for authorization, the string is Yes. If no ACLs were required, the string is -. For more information about ACLs, see Access control list (ACL) overview. For more information about using the aclRequired field to disable ACLs, see Controlling ownership of objects and disabling ACLs for your bucket.

Example entry

Yes