CloudTrail Data Event Enablement

By default, CloudTrail captures only management events — control-plane API calls such as CreateBucket or PutRolePolicy. Data events record resource-level operations: individual reads and writes on S3 objects, Lambda invocations, DynamoDB item operations, and others. They must be explicitly enabled per trail and are billed per 100,000 events delivered.

Overview

Service Events recorded Resource type selector

S3

GetObject, PutObject, DeleteObject, CopyObject (per object)

AWS::S3::Object

Lambda

Invoke (every function invocation)

AWS::Lambda::Function

DynamoDB

GetItem, PutItem, UpdateItem, DeleteItem, Query, Scan (per table)

AWS::DynamoDB::Table

S3 Access Points

Object operations via access points

AWS::S3::AccessPoint

S3 Object Lambda

Object reads through Object Lambda access points

AWS::S3ObjectLambda::AccessPoint

AppSync

GraphQL query, mutation, and subscription executions

AWS::AppSync::GraphQLApi

Cognito Identity Pools

GetCredentialsForIdentity, GetId, GetOpenIdToken

AWS::Cognito::IdentityPool

Bedrock

Model invocations and agent runs

AWS::Bedrock::AgentAlias, AWS::Bedrock::KnowledgeBase

SNS

Publish (message delivery to subscribers)

AWS::SNS::Topic
All data event types are charged at the same rate. Enable only the services you actively query in Kloudfuse to avoid unexpected CloudTrail costs.

S3 Object-Level Events

Enable data events for all S3 objects in your account:

aws cloudtrail put-event-selectors \
  --trail-name kloudfuse-trail \
  --event-selectors '[{
    "ReadWriteType": "All",
    "IncludeManagementEvents": true,
    "DataResources": [{
      "Type": "AWS::S3::Object",
      "Values": ["arn:aws:s3:::"]
    }]
  }]'
bash

To limit to specific buckets, replace "arn:aws:s3:::" with individual bucket ARNs:

aws cloudtrail put-event-selectors \
  --trail-name kloudfuse-trail \
  --event-selectors '[{
    "ReadWriteType": "All",
    "IncludeManagementEvents": true,
    "DataResources": [{
      "Type": "AWS::S3::Object",
      "Values": [
        "arn:aws:s3:::my-important-bucket/",
        "arn:aws:s3:::another-bucket/"
      ]
    }]
  }]'
bash
Use "ReadWriteType": "WriteOnly" to capture only mutating operations (PutObject, DeleteObject, CopyObject) and exclude high-volume read traffic (GetObject) to reduce cost.

Lambda Invocations

Enable data events for all Lambda functions:

aws cloudtrail put-event-selectors \
  --trail-name kloudfuse-trail \
  --event-selectors '[{
    "ReadWriteType": "All",
    "IncludeManagementEvents": true,
    "DataResources": [{
      "Type": "AWS::Lambda::Function",
      "Values": ["arn:aws:lambda"]
    }]
  }]'
bash

To limit to specific functions, provide individual ARNs:

aws cloudtrail put-event-selectors \
  --trail-name kloudfuse-trail \
  --event-selectors '[{
    "ReadWriteType": "All",
    "IncludeManagementEvents": true,
    "DataResources": [{
      "Type": "AWS::Lambda::Function",
      "Values": [
        "arn:aws:lambda:<region>:<account-id>:function:my-function"
      ]
    }]
  }]'
bash

DynamoDB Item-Level Events

Enable data events for all DynamoDB tables:

aws cloudtrail put-event-selectors \
  --trail-name kloudfuse-trail \
  --event-selectors '[{
    "ReadWriteType": "All",
    "IncludeManagementEvents": true,
    "DataResources": [{
      "Type": "AWS::DynamoDB::Table",
      "Values": ["arn:aws:dynamodb"]
    }]
  }]'
bash
DynamoDB item-level events can be very high volume for tables with frequent reads. Use "ReadWriteType": "WriteOnly" to capture only mutations (PutItem, UpdateItem, DeleteItem) for audit purposes.

S3 Access Points

Enable data events for object operations routed through S3 Access Points:

aws cloudtrail put-event-selectors \
  --trail-name kloudfuse-trail \
  --event-selectors '[{
    "ReadWriteType": "All",
    "IncludeManagementEvents": true,
    "DataResources": [{
      "Type": "AWS::S3::AccessPoint",
      "Values": ["arn:aws:s3"]
    }]
  }]'
bash

S3 Object Lambda Access Points

Enable data events for reads processed through S3 Object Lambda access points:

aws cloudtrail put-event-selectors \
  --trail-name kloudfuse-trail \
  --event-selectors '[{
    "ReadWriteType": "All",
    "IncludeManagementEvents": true,
    "DataResources": [{
      "Type": "AWS::S3ObjectLambda::AccessPoint",
      "Values": ["arn:aws:s3-object-lambda"]
    }]
  }]'
bash

AppSync GraphQL API

Enable data events for GraphQL executions. AppSync data events use advanced event selectors:

aws cloudtrail put-advanced-event-selectors \
  --trail-name kloudfuse-trail \
  --advanced-event-selectors '[{
    "Name": "AppSync data events",
    "FieldSelectors": [
      {"Field": "eventCategory", "Equals": ["Data"]},
      {"Field": "resources.type", "Equals": ["AWS::AppSync::GraphQLApi"]}
    ]
  }]'
bash

Cognito Identity Pools

Enable data events for credential vending operations:

aws cloudtrail put-advanced-event-selectors \
  --trail-name kloudfuse-trail \
  --advanced-event-selectors '[{
    "Name": "Cognito Identity Pool data events",
    "FieldSelectors": [
      {"Field": "eventCategory", "Equals": ["Data"]},
      {"Field": "resources.type", "Equals": ["AWS::Cognito::IdentityPool"]}
    ]
  }]'
bash

Bedrock Model and Agent Invocations

Enable data events for Bedrock model invocations and agent runs. Bedrock data events use advanced event selectors:

aws cloudtrail put-advanced-event-selectors \
  --trail-name kloudfuse-trail \
  --advanced-event-selectors '[
    {
      "Name": "Bedrock agent invocations",
      "FieldSelectors": [
        {"Field": "eventCategory", "Equals": ["Data"]},
        {"Field": "resources.type", "Equals": ["AWS::Bedrock::AgentAlias"]}
      ]
    },
    {
      "Name": "Bedrock knowledge base queries",
      "FieldSelectors": [
        {"Field": "eventCategory", "Equals": ["Data"]},
        {"Field": "resources.type", "Equals": ["AWS::Bedrock::KnowledgeBase"]}
      ]
    }
  ]'
bash

SNS Message Publish

Enable data events for SNS publish operations:

aws cloudtrail put-advanced-event-selectors \
  --trail-name kloudfuse-trail \
  --advanced-event-selectors '[{
    "Name": "SNS publish events",
    "FieldSelectors": [
      {"Field": "eventCategory", "Equals": ["Data"]},
      {"Field": "resources.type", "Equals": ["AWS::SNS::Topic"]}
    ]
  }]'
bash

Verify Data Events are Being Recorded

Confirm that data event selectors are applied to the trail:

aws cloudtrail get-event-selectors --trail-name kloudfuse-trail
bash

For trails using advanced event selectors:

aws cloudtrail get-advanced-event-selectors --trail-name kloudfuse-trail
bash

The response lists each configured selector. Once data events flow into the CloudWatch log group, they appear in Kloudfuse with the eventCategory field set to Data and the resources[0].type field identifying the service.

External References