本文為英文版的機器翻譯版本，如內容有任何歧義或不一致之處，概以英文版為準。

# Amazon S3 CloudTrail 事件
<a name="cloudtrail-logging-s3-info"></a>

**重要**  
Amazon S3 現在將伺服器端加密與 Amazon S3 受管金鑰 (SSE-S3) 套用為 Amazon S3 中每個儲存貯體的基本加密層級。從 2023 年 1 月 5 日起，所有上傳到 Amazon S3 的新物件都會自動加密，無需額外費用，也不會影響效能。S3 儲存貯體預設加密組態和新物件上傳的自動加密狀態可在 CloudTrail 日誌、S3 庫存、S3 Storage Lens、Amazon S3 主控台，以及 AWS CLI 和 AWS SDKs 中的其他 Amazon S3 API 回應標頭中使用。如需詳細資訊，請參閱[預設加密常見問答集](https://docs.aws.amazon.com/AmazonS3/latest/userguide/default-encryption-faq.html)。

本節提供 S3 記錄到 CloudTrail 的事件相關資訊。

## CloudTrail 中的 Amazon S3 資料事件
<a name="cloudtrail-data-events"></a>

[資料事件](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html#logging-data-events)提供在資源上或在資源中執行的資源操作的相關資訊 (例如，讀取或寫入 Amazon S3 物件)。這些也稱為資料平面操作。資料事件通常是大量資料的活動。根據預設，CloudTrail 不會記錄資料事件。CloudTrail **事件歷史記錄**不會記錄資料事件。

資料事件需支付額外的費用。如需 CloudTrail 定價的詳細資訊，請參閱 [AWS CloudTrail 定價](https://aws.amazon.com/cloudtrail/pricing/)。

您可以使用 CloudTrail 主控台 AWS CLI或 CloudTrail API 操作來記錄 Amazon S3 資源類型的資料事件。如需如何記錄資料事件的詳細資訊，請參閱《AWS CloudTrail 使用者指南》**中的[使用 AWS 管理主控台記錄資料事件](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html#logging-data-events-console)和[使用 AWS Command Line Interface記錄資料事件](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html#creating-data-event-selectors-with-the-AWS-CLI)。

下表列出您可以記錄其資料事件的 Amazon S3 資源類型。**資料事件類型 (主控台)** 資料行會顯示從 CloudTrail 主控台上的**資料事件類型**清單中選擇的值。**resources.type 值**欄會顯示值，您會在使用 AWS CLI 或 CloudTrail APIs 設定進階事件選取器時指定此`resources.type`值。**記錄到 CloudTrail 的資料 API** 資料行會針對資源類型顯示記錄到 CloudTrail 的 API 呼叫。




| 資料事件類型 (主控台) | resources.type 值 | 記錄到 CloudTrail 的資料 API | 
| --- | --- | --- | 
| S3 |  AWS::S3::Object  |  [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/zh_tw/AmazonS3/latest/userguide/cloudtrail-logging-s3-info.html)  | 
| S3 Express One Zone |  AWS::S3Express::Object  |  [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/zh_tw/AmazonS3/latest/userguide/cloudtrail-logging-s3-info.html)  | 
| S3 存取點 |  AWS::S3::Access Point  |  [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/zh_tw/AmazonS3/latest/userguide/cloudtrail-logging-s3-info.html)  | 
| S3 Object Lambda |  AWS::S3ObjectLambda::AccessPoint  |  [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/zh_tw/AmazonS3/latest/userguide/cloudtrail-logging-s3-info.html)  | 
| S3 Outposts |  AWS::S3Outposts::Object  |  [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/zh_tw/AmazonS3/latest/userguide/cloudtrail-logging-s3-info.html)  | 

您可以設定進階事件選取器來篩選 `eventName`、`readOnly` 和 `resources.ARN` 欄位，以僅記錄對您重要的事件。如需這些欄位的詳細資訊，請參閱AWS CloudTrail API 參考**中的[https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_AdvancedFieldSelector.html](https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_AdvancedFieldSelector.html)。

## CloudTrail 中的 Amazon S3 管理事件
<a name="cloudtrail-management-events"></a>

Amazon S3 會將所有控制平面操作記錄為管理事件。如需 S3 API 操作的詳細資訊，請參閱 [Amazon S3 API 參考](https://docs.aws.amazon.com/AmazonS3/latest/API/API_Operations.html)。

## CloudTrail 如何擷取對 Amazon S3 提出的請求
<a name="cloudtrail-logging-s3-requests"></a>

依預設，CloudTrail 會記錄過去 90 內發出的 S3 儲存貯體層級 API 呼叫，但不會記錄對物件提出的請求。儲存貯體層級呼叫包括 `CreateBucket`、`DeleteBucket`、`PutBucketLifecycle`、`PutBucketPolicy` 等事件。您可以在 CloudTrail 主控台上查看儲存貯體層級的事件。但是，您無法在那裡檢視資料事件 (Amazon S3 物件層級呼叫)，您必須在 CloudTrail 日誌中剖析或查詢這些事件。

如果您使用 記錄資料活動 AWS CloudTrail，Amazon S3 `DeleteObjects`資料事件的事件記錄會同時包含`DeleteObjects`事件和在該操作中刪除的每個物件`DeleteObject`的事件。您可以從事件記錄中排除已刪除物件的其他可見性。如需詳細資訊，請參閱《AWS CloudTrail 使用者指南》**中的[篩選資料事件的AWS CLI 範例](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/filtering-data-events.html#filtering-data-events-deleteobjects)。

## CloudTrail 日誌記錄所追蹤的 Amazon S3 帳戶層級動作
<a name="cloudtrail-account-level-tracking"></a>

CloudTrail 會記錄帳戶層級的動作。Amazon S3 記錄會與其他 AWS 服務 記錄一起寫入日誌檔中。CloudTrail 會根據期間與檔案大小，決定何時建立與寫入新檔案。

本節中的各表格會列出支援 CloudTrail 記錄的 Amazon S3 帳戶層級動作。

Amazon S3 透過 CloudTrail 記錄追蹤的帳戶層級 API 動作會顯示為下列事件名稱。CloudTrail 事件名稱與 API 動作名稱不同。例如，DeletePublicAccessBlock 是 DeleteAccountPublicAccessBlock。
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_DeletePublicAccessBlock.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_DeletePublicAccessBlock.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetPublicAccessBlock.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetPublicAccessBlock.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_PutPublicAccessBlock.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_PutPublicAccessBlock.html)

## CloudTrail 日誌記錄所追蹤的 Amazon S3 儲存貯體層級動作
<a name="cloudtrail-bucket-level-tracking"></a>

CloudTrail 預設會記錄一般用途儲存貯體的儲存貯體層級動作。Amazon S3 記錄會與其他 AWS 服務記錄一起寫入日誌檔案中。CloudTrail 會根據期間與檔案大小，決定何時建立與寫入新檔案。

此區段列出支援 CloudTrail 記錄的 Amazon S3 儲存貯體層級動作。

Amazon S3 透過 CloudTrail 記錄追蹤的儲存貯體層級 API 動作會顯示為下列事件名稱。有些情況下，CloudTrail 事件名稱會與 API 動作名稱不同。例如，`PutBucketLifecycleConfiguration` 為 `PutBucketLifecycle`。
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_CreateBucket.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_CreateBucket.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_CreateBucketMetadataConfiguration.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_CreateBucketMetadataConfiguration.html) (V2 API 操作)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_CreateBucketMetadataTableConfiguration.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_CreateBucketMetadataTableConfiguration.html) (V1 API 操作)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucket.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucket.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketAnalyticsConfiguration.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketAnalyticsConfiguration.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketCors.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketCors.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketEncryption.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketEncryption.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketIntelligentTieringConfiguration.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketIntelligentTieringConfiguration.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketInventoryConfiguration.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketInventoryConfiguration.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketLifecycle.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketLifecycle.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketMetadataConfiguration.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketMetadataConfiguration.html) (V2 API 操作)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketMetadataTableConfiguration.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketMetadataTableConfiguration.html) (V1 API 操作)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketMetricsConfiguration.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketMetricsConfiguration.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketOwnershipControls.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketOwnershipControls.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketPolicy.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketPolicy.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeletePublicAccessBlock.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeletePublicAccessBlock.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketReplication.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketReplication.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketTagging.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketTagging.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketAccelerateConfiguration.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketAccelerateConfiguration.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketAcl.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketAcl.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketAnalyticsConfiguration.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketAnalyticsConfiguration.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketCors.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketCors.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketEncryption.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketEncryption.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketIntelligentTieringConfiguration.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketIntelligentTieringConfiguration.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketInventoryConfiguration.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketInventoryConfiguration.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketLifecycle.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketLifecycle.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketLocation.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketLocation.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketLogging.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketLogging.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketMetadataConfiguration.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketMetadataConfiguration.html) (V2 API 操作)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketMetadataTableConfiguration.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketMetadataTableConfiguration.html) (V1 API 操作)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketMetricsConfiguration.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketMetricsConfiguration.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketNotification.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketNotification.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObjectLockConfiguration.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObjectLockConfiguration.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketOwnershipControls.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketOwnershipControls.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketPolicy.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketPolicy.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketPolicyStatus.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketPolicyStatus.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetPublicAccessBlock.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetPublicAccessBlock.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketReplication.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketReplication.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketRequestPayment.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketRequestPayment.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketTagging.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketTagging.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketVersioning.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketVersioning.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketWebsite.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketWebsite.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_HeadBucket.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_HeadBucket.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListBuckets.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListBuckets.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketAccelerateConfiguration.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketAccelerateConfiguration.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketAcl.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketAcl.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketAnalyticsConfiguration.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketAnalyticsConfiguration.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketCors.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketCors.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketEncryption.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketEncryption.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketIntelligentTieringConfiguration.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketIntelligentTieringConfiguration.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketInventoryConfiguration.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketInventoryConfiguration.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketLifecycle.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketLifecycle.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketLogging.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketLogging.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketMetricsConfiguration.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketMetricsConfiguration.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketNotification.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketNotification.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObjectLockConfiguration.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObjectLockConfiguration.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketOwnershipControls.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketOwnershipControls.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketPolicy.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketPolicy.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutPublicAccessBlock.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutPublicAccessBlock.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketReplication.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketReplication.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketRequestPayment.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketRequestPayment.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketTagging.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketTagging.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketVersioning.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketVersioning.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketWebsite.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketWebsite.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_UpdateBucketMetadataJournalTableConfiguratione.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_UpdateBucketMetadataJournalTableConfiguratione.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_UpdateBucketMetadataInventoryTableConfiguration.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_UpdateBucketMetadataInventoryTableConfiguration.html)

除了這些 API 操作之外，您也可以使用 [OPTIONS 物件](https://docs.aws.amazon.com/AmazonS3/latest/API/RESTOPTIONSobject.html)的物件層級動作。此動作視為 CloudTrail 日誌記錄中的儲存貯體層操作，因為此動作會檢查儲存貯體的 CORSA 組態。

**注意**  
支援 HeadBucket API 做為 CloudTrail 中的 Amazon S3 資料事件。

## CloudTrail 記錄所追蹤的 Amazon S3 Express One Zone 儲存貯體層級 (地區 API 端點) 動作
<a name="cloudtrail-bucket-level-tracking-s3express"></a>

CloudTrail 預設會將目錄儲存貯體的儲存貯體層級動作記錄為管理事件。S3 Express One Zone 的 CloudTrail 管理事件 `eventsource` 為 `s3express.amazonaws.com`。

下列這些地區端點 API 操作會記錄到 CloudTrail。
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_CreateBucket.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_CreateBucket.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucket.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucket.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketPolicy.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketPolicy.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketPolicy.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketPolicy.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketPolicy.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketPolicy.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListDirectoryBuckets.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListDirectoryBuckets.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketEncryption.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketEncryption.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketEncryption.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketEncryption.html)
+ [https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketEncryption.html](https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketEncryption.html)

如需詳細資訊，請參閱[使用適用於 S3 Express One Zone 的 AWS CloudTrail 記錄](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-express-one-zone-logging.html)

## 跨帳戶案例中的 Amazon S3 物件層級動作
<a name="cloudtrail-object-level-crossaccount"></a>

下列特殊使用案例包含跨帳戶案例中的物件層級 API 呼叫與 CloudTrail 日誌回報方式。CloudTrail 會將日誌傳送給請求者 (進行 API 呼叫的帳戶)，但日誌項目遭到修訂或省略而導致存取遭拒的某些情況則除外。設定跨帳戶存取時，請考慮本節中的範例。

**注意**  
這些範例假設已適當地設定 CloudTrail 日誌。

### 範例 1：CloudTrail 將日誌交付給儲存貯體擁有者
<a name="cloudtrail-crossaccount-example1"></a>

即使在儲存貯體擁有者沒有相同物件 API 操作的許可時，CloudTrail 也會將日誌交付給儲存貯體擁有者。請考慮下列跨帳戶案例：
+ 帳戶 A 擁有儲存貯體。
+ 帳戶 B (申請者) 嘗試存取該儲存貯體中的物件。
+ 帳戶 C 擁有物件。帳戶 C 可能與 A 帳戶相同，也可能不相同。

**注意**  
CloudTrail 一律會將物件層級 API 日誌交付給申請者 (帳戶 B)。此外，即使在儲存貯體擁有者未擁有物件 (帳戶 C)，或對該物件上相同的 API 動作沒有許可時，CloudTrail 也會將相同的日誌交付給儲存貯體擁有者 (帳戶 A)。

### 範例 2：CloudTrail 不會大量增加用於設定物件 ACL 的電子郵件地址
<a name="cloudtrail-crossaccount-example2"></a>

請考慮下列跨帳戶案例：
+ 帳戶 A 擁有儲存貯體。
+  帳戶 B (申請者) 會傳送要求以使用電子郵件地址設定物件 ACL 授予。如需 ACL 的詳細資訊，請參閱「[存取控制清單 (ACL) 概觀](acl-overview.md)」。

請求者會取得日誌與電子郵件資訊。不過，儲存貯體擁有者 (如果他們像範例 1 一樣有資格接收日誌) 會取得回報事件的 CloudTrail 日誌。不過，儲存貯體擁有者不會取得 ACL 組態資訊，特別是被授與者電子郵件地址與授予。日誌告訴儲存貯體擁有者的唯一資訊是帳戶 B 已提出 ACL API 呼叫。