Select CloudTrail data events explicitly for resource-access investigations

Management-event coverage does not automatically include object reads or function invocations.

Source facts

CloudTrail data events describe supported resource-level operations such as S3 object access and Lambda invocation. Trails and event data stores do not log data events by default, and additional charges apply. Advanced event selectors can narrow the event types and resources recorded for a particular investigation or monitoring need.

Source: AWS Documentation.

Applicability

This applies to selecting CloudTrail data-event coverage for supported resources and operations.

DSE recommendation

DSE recommends identifying the exact question the audit record must answer before choosing selectors. Record which resource ARNs, read/write operations and exceptions are included. Estimate activity volume with the service owner and review current pricing before enabling broad collection. Keep the selection policy under change control so later reports can explain gaps. Assign retention, access and investigation ownership to the resulting data instead of enabling it without a plan for review. Make selector changes reviewable against a small table of required questions and representative API operations. Agree which excluded operations are intentional and who accepts that gap, then preserve the decision alongside the collection configuration for later incident interpretation.

Verification

Proposed verification: perform an approved disposable resource operation that should match the selector and one that should not. Inspect delivered events and confirm the actual resource and operation fields. Retain the selector configuration with the results and review collection volume before extending the scope.

Official reference

AWS Documentation. Reviewed October 20, 2026.