# Logging with AWS CloudTrail for S3 Vectors
Amazon S3 Vectors is integrated with AWS CloudTrail, a service that provides a record of actions that are taken by a user, role, or an AWS service. CloudTrail captures all API calls for S3 Vectors as events. Using the information that's collected by CloudTrail, you can determine the request that was made to S3 Vectors, the IP address from which the request was made, when it was made, and additional details. When a supported event activity occurs in S3 Vectors, that activity is recorded in a CloudTrail event. You can use CloudTrail trail to log management events and data events for S3 Vectors.
To learn more about CloudTrail, see the [CloudTrail User Guide](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/).
## S3 Vectors information in CloudTrail
CloudTrail is enabled on your AWS account when you create the account. When activity occurs in S3 Vectors, that activity is recorded in a CloudTrail event along with other AWS service events in Event history. You can view, search, and download recent events in your AWS account. For more information, see [Viewing Events with CloudTrail Event History](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/view-cloudtrail-events.html).
For an ongoing record of events in your AWS account, including events for S3 Vectors, create a trail. A trail enables CloudTrail to deliver log files to an Amazon S3 bucket. By default, when you create a trail in the console, the trail applies to all AWS Regions. The trail logs events from all Regions in the AWS partition and delivers the log files to the Amazon S3 bucket that you specify. Additionally, you can configure other AWS services to further analyze and act upon the event data collected in CloudTrail logs. For more information, see [Overview for Creating a Trail](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-create-and-update-a-trail.html), [Configuring Amazon SNS Notifications for CloudTrail](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/getting-notifications-top-level.html), [Receiving CloudTrail Log Files from Multiple Regions](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/receive-cloudtrail-log-files-from-multiple-regions.html), and [Receiving CloudTrail Log Files from Multiple Accounts](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-receive-logs-from-multiple-accounts.html) in the *CloudTrail User Guide*.
All S3 Vectors API actions are logged by CloudTrail and are documented in the [Amazon S3 Vectors](https://docs.aws.amazon.com/AmazonS3/latest/API/API_Operations_Amazon_S3_Vectors.html) API Reference. For example, calls to the [CreateVectorBucket](https://docs.aws.amazon.com/AmazonS3/latest/API/API_S3VectorBuckets_CreateVectorBucket.html), [CreateIndex](https://docs.aws.amazon.com/AmazonS3/latest/API/API_S3VectorBuckets_CreateIndex.html), and [QueryVectors](https://docs.aws.amazon.com/AmazonS3/latest/API/API_S3VectorBuckets_QueryVectors.html) actions generate entries in the CloudTrail log files.
Every event or log entry contains information about who generated the request. The identity information helps you determine the following:
+ Whether the request was made with root or IAM user credentials.
+ Whether the request was made with temporary security credentials for a role or federated user.
+ Whether the request was made by another AWS service.
For more information, see the [CloudTrail userIdentity Element](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-user-identity.html) in the *CloudTrail User Guide*.
## CloudTrail management events for S3 Vectors
Management events provide information about management operations that are performed on resources in your AWS account. These are also known as control plane operations. By default, CloudTrail logs management events.
For S3 Vectors, CloudTrail logs the following management events:
+ [CreateVectorBucket](https://docs.aws.amazon.com/AmazonS3/latest/API/API_S3VectorBuckets_CreateVectorBucket.html)
+ [DeleteVectorBucket](https://docs.aws.amazon.com/AmazonS3/latest/API/API_S3VectorBuckets_DeleteVectorBucket.html)
+ [GetVectorBucket](https://docs.aws.amazon.com/AmazonS3/latest/API/API_S3VectorBuckets_GetVectorBucket.html)
+ [ListVectorBuckets](https://docs.aws.amazon.com/AmazonS3/latest/API/API_S3VectorBuckets_ListVectorBuckets.html)
+ [PutVectorBucketPolicy](https://docs.aws.amazon.com/AmazonS3/latest/API/API_S3VectorBuckets_PutVectorBucketPolicy.html)
+ [GetVectorBucketPolicy](https://docs.aws.amazon.com/AmazonS3/latest/API/API_S3VectorBuckets_GetVectorBucketPolicy.html)
+ [DeleteVectorBucketPolicy](https://docs.aws.amazon.com/AmazonS3/latest/API/API_S3VectorBuckets_DeleteVectorBucketPolicy.html)
+ [CreateIndex](https://docs.aws.amazon.com/AmazonS3/latest/API/API_S3VectorBuckets_CreateIndex.html)
+ [DeleteIndex](https://docs.aws.amazon.com/AmazonS3/latest/API/API_S3VectorBuckets_DeleteIndex.html)
+ [GetIndex](https://docs.aws.amazon.com/AmazonS3/latest/API/API_S3VectorBuckets_GetIndex.html)
+ [ListIndexes](https://docs.aws.amazon.com/AmazonS3/latest/API/API_S3VectorBuckets_ListIndexes.html)
The `eventSource` for S3 Vectors management events and data events is `s3vectors.amazonaws.com`.
For more information about management events, see [Logging management events](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-management-events-with-cloudtrail.html) in the *CloudTrail User Guide*.
## CloudTrail data events for S3 Vectors
Data events provide information about the resource operations performed on or in a resource. These are also known as data plane operations. By default, CloudTrail doesn't log data events. However, you can configure trails to log data events for S3 Vectors resources.
When you configure your trail to log data events, you can specify the S3 Vectors resource type. S3 Vectors supports the following resource types for data events:
+ `AWS::S3Vectors::VectorBucket` - Logs data events for all vector indexes in the specified vector buckets
+ `AWS::S3Vectors::Index` - Logs data events for specific vector indexes
For S3 Vectors, CloudTrail logs the following data events:
Vector data operations:
+ [PutVectors](https://docs.aws.amazon.com/AmazonS3/latest/API/API_S3VectorBuckets_PutVectors.html) - Logs when vectors are added to a vector index
+ [GetVectors](https://docs.aws.amazon.com/AmazonS3/latest/API/API_S3VectorBuckets_GetVectors.html) - Logs when vectors are retrieved from a vector index
+ [DeleteVectors](https://docs.aws.amazon.com/AmazonS3/latest/API/API_S3VectorBuckets_DeleteVectors.html) - Logs when vectors are deleted from a vector index
+ [ListVectors](https://docs.aws.amazon.com/AmazonS3/latest/API/API_S3VectorBuckets_ListVectors.html) - Logs when vectors in a vector index are listed
+ [QueryVectors](https://docs.aws.amazon.com/AmazonS3/latest/API/API_S3VectorBuckets_QueryVectors.html) - Logs when similarity queries are performed on a vector index
The `eventSource` for S3 Vectors data events is `s3vectors.amazonaws.com`.
## Enabling data event logging for S3 Vectors
You can enable data event logging for S3 Vectors resources when you create or update a CloudTrail trail. You can specify logging for all vector buckets and vector indexes in your account, or you can specify individual vector buckets or vector indexes. For detailed steps about creating a trail, see [Creating a trail](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-create-a-trail-using-the-console-first-time.html) in the *CloudTrail User Guide*.
To enable data event logging for all S3 Vectors resources:
+ When creating or updating a trail, choose **Data events**.
+ For **Resource type**, choose `AWS::S3Vectors::VectorBucket`.
+ For **Resource ARN**, enter `arn:aws:s3vectors:_:_:bucket/*` to log events for all vector buckets, or specify individual vector bucket ARNs (for example, `arn:aws:s3vectors:us-east-1:123456789012:bucket/amzn-s3-demo-vector-bucket`).
To enable data event logging for specific vector indexes:
+ When creating or updating a trail, choose **Data events**.
+ For **Resource type**, choose `AWS::S3Vectors::Index`.
+ For **Resource ARN**, enter the ARN of the specific vector index, such as: `arn:aws:s3vectors:us-east-1:123456789012:bucket/amzn-s3-demo-vector-bucket/index/my-index`.
For more information about data events, see [Logging data events](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html) in the *CloudTrail User Guide*.
**Topics**
+ [S3 Vectors information in CloudTrail](#s3-vectors-logging-information)
+ [CloudTrail management events for S3 Vectors](#s3-vectors-logging-management-events)
+ [CloudTrail data events for S3 Vectors](#s3-vectors-logging-data-events)
+ [Enabling data event logging for S3 Vectors](#s3-vectors-logging-enabling-data-events)
+ [CloudTrail log file example for S3 Vectors](s3-vectors-cloudtrail-log-example.md)
# CloudTrail log file example for S3 Vectors
The following examples show CloudTrail log entries for S3 Vectors data events. Data events are logged when you perform operations on vector data within your vector indexes.
## Example: CloudTrail log file for `GetVectors` data event
```
{
"eventVersion": "1.11",
"userIdentity": {
"type": "IAMUser",
"principalId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/myUserName",
"accountId": "123456789012",
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"userName": "myUserName"
},
"eventTime": "2024-11-22T17:12:25Z",
"eventSource": "s3vectors.amazonaws.com",
"eventName": "GetVectors",
"awsRegion": "us-east-1",
"sourceIPAddress": "192.0.2.0",
"userAgent": "[aws-cli/2.18.5]",
"requestParameters": {
"vectorBucketName": "amzn-s3-demo-vector-bucket",
"returnMetadata": "false",
"indexName": "111aa1111-22bb-33cc-44dd-5555eee66ffff",
"returnData": "false"
},
"responseElements": null,
"additionalEventData": {
"SignatureVersion": "SigV4",
"cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256"
},
"requestID": "07D681123BD12AED",
"eventID": "f2b287f3-0df1-1234-a2f4-c4bdfed47657",
"readOnly": true,
"resources": [{
"accountId": "123456789012",
"type": "AWS::S3Vectors::VectorBucket",
"ARN": "arn:aws:s3vectors:us-east-1:123456789012:bucket/amzn-s3-demo-vector-bucket"
}, {
"accountId": "123456789012",
"type": "AWS::S3Vectors::Index",
"ARN": "arn:aws:s3vectors:us-east-1:123456789012:bucket/amzn-s3-demo-vector-bucket/index/111aa1111-22bb-33cc-44dd-5555eee66ffff"
}],
"eventType": "AwsApiCall",
"managementEvent": false,
"recipientAccountId": "444455556666",
"eventCategory": "Data",
"tlsDetails": {
"tlsVersion": "TLSv1.2",
"cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256",
"clientProvidedHostHeader": "client-host"
}
}
```
## Understanding S3 Vectors log file entries
CloudTrail log files contain one or more log entries. An event represents a single request from any source and includes information about the requested action, the date and time of the action, request parameters, and so on. CloudTrail log files aren't an ordered stack trace of the public API calls, so they don't appear in any specific order.
S3 Vectors CloudTrail log entries contain the following key elements:
+ **eventSource** - Always `s3vectors.amazonaws.com` for S3 Vectors events.
+ **eventName** - The S3 Vectors API operation that was performed.
+ **eventCategory** - Either `Management` for control plane operations or `Data` for data plane operations.
+ **readOnly**: `true` for read operations (for examples, [GetVectors](https://docs.aws.amazon.com/AmazonS3/latest/API/API_S3VectorBuckets_GetVectors.html), [QueryVectors](https://docs.aws.amazon.com/AmazonS3/latest/API/API_S3VectorBuckets_QueryVectors.html), [ListVectors](https://docs.aws.amazon.com/AmazonS3/latest/API/API_S3VectorBuckets_ListVectors.html)) and `false` for write operations ([PutVectors](https://docs.aws.amazon.com/AmazonS3/latest/API/API_S3VectorBuckets_PutVectors.html), [DeleteVectors](https://docs.aws.amazon.com/AmazonS3/latest/API/API_S3VectorBuckets_DeleteVectors.html)).
+ **resources** - The S3 Vectors resources involved in the operation, including vector buckets and vector indexes.
+ **requestParameters** - The parameters that were sent with the request.
+ **responseElements** - The response elements returned by the S3 Vectors service.