AWS › AWS CloudTrail & Auditing
What is the difference between CloudTrail management events and data events, and when should data events be enabled?
AdvancedAnswer
Management events capture control plane operations, such as creating or deleting resources, and are captured by default, while data events capture more granular, high volume actions like individual S3 object level reads and writes or Lambda function invocations, which are not enabled by default due to their potentially large volume and additional cost, and should be enabled specifically when you need detailed visibility into data access patterns, such as detecting unauthorized reads of sensitive objects in a specific S3 bucket.
aws cloudtrail put-event-selectors --trail-name my-trail --event-selectors '[{"ReadWriteType":"All","DataResources":[{"Type":"AWS::S3::Object","Values":["arn:aws:s3:::sensitive-bucket/"]}]}]'Real-world example A company handling sensitive customer documents enables S3 data events specifically for the bucket storing those documents, allowing them to track every individual file access, while leaving data events disabled for less sensitive, high traffic buckets to control cost.