The various log operations I see in S3 logs:
REST.PUT.PART
REST.HEAD.OBJECT
REST.HEAD.BUCKET
WEBSITE.GET.OBJECT
REST.PUT.OBJECT
REST.GET.OBJECT
REST.POST.UPLOADS
REST.POST.UPLOAD
REST.GET.UPLOAD
REST.GET.BUCKET
REST.GET.UPLOADS
REST.GET.ACCELERATE
REST.DELETE.UPLOAD
REST.GET.VERSIONING
REST.GET.LOCATION
WEBSITE.OPTIONS.PREFLIGHT
WEBSITE.HEAD.OBJECT
REST.GET.BUCKETPOLICY
REST.GET.REQUEST_PAYMENT
REST.GET.WEBSITE
REST.GET.TAGGING
REST.GET.LOGGING_STATUS
REST.GET.NOTIFICATION
REST.GET.REPLICATION
REST.GET.LIFECYCLE
REST.GET.ACL
REST.GET.CORS
REST.COPY.OBJECT
REST.PUT.LOGGING_STATUS
REST.PUT.BUCKETPOLICY
REST.DELETE.OBJECT
REST.PUT.WEBSITE
Most of these are intuitive. However, I'm confused on what the following mean:
REST.PUT.PART
REST.PUT.OBJECT
WEBSITE.GET.OBJECT
REST.POST.UPLOADS
REST.POST.UPLOAD
REST.GET.UPLOAD
REST.GET.UPLOADS
REST.DELETE.UPLOAD
REST.GET.LOCATION
REST.GET.WEBSITE
REST.COPY.OBJECT
REST.PUT.WEBSITE
Does anyone know a place where this is documented or can explain to me the difference between these? One of the main questions I have is with multipart uploads and how they translate to logs.
Thanks!
These are all fairly straightforward if you compare them to the actions and subresources in the S3 REST API Reference.
REST.GET.WEBSITE
REST.PUT.WEBSITE
These are reading and writing the bucket's web site hosting configuration, probably from the console. The console does not have a magic connection to S3 -- everything it displays and all of its actions are done through API requests.
REST.PUT.PART
Upload one part of a multipart upload. Multipart is optional for objects >= 5 MiB and mandatory for objects > 5 GiB. (Technically, you can use the multipart API to upload an object smaller than 5 MiB, but you're required to upload the entire object as the first and only part, so this would usually be pretty pointless.) The console might use multipart uploads for larger files, since multipart allows parts to be uploaded in parallel, which usually provides a speed advantage.
REST.PUT.OBJECT
Upload an entire object in one request (non-multipart)
WEBSITE.GET.OBJECT
Download an object from the web site endpoint.
REST.POST.UPLOADS
Begin a multipart upload.
REST.POST.UPLOAD
This one is probably finishing a multipart upload, though it might be a browser-based form POST upload, but I suspect the former.
REST.GET.UPLOAD
Probably listing the parts of a multipart upload in progress.
REST.GET.UPLOADS
Probably fetching a list of any multipart uploads in progress.
REST.DELETE.UPLOAD
Probably aborting a multipart upload in progress and discarding the parts.
REST.GET.LOCATION
Read the bucket's location constraint (region). Probably from the console, though some libraries need to do this when they don't know the bucket's region.
REST.COPY.OBJECT
Copy an object or rename/move/modify -- objects are 100% immutable, so there is not actually a native rename or move operation in S3; it is always done by a copy followed by a delete. The copy operation transfers the data internally within S3 (not download/upload, even if you copy across buckets, and even across regions). Editing the metadata for an object is also not actually possible in S3 -- this, too, is done by making a copy of the object, with the same object key but new metadata... so this would be any and all of those events.