用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-aws-foundations-4-8命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | cis-aws-foundations-4.8 |
| description | Ensure that object-level logging for write events is enabled for S3 buckets |
| category | cis-logging |
| version | 7.0.0 |
| author | cyberstrike-official |
| tags | ["cis","aws","logging","s3","object-level","cloudtrail","data-events","write"] |
| cis_id | 4.8 |
| cis_benchmark | CIS AWS Foundations Benchmark v7.0.0 |
| tech_stack | ["aws"] |
| cwe_ids | [] |
| chains_with | ["cis-aws-foundations-4.1","cis-aws-foundations-4.9"] |
| prerequisites | [] |
| severity_boost | {} |
S3 object-level API operations, such as GetObject, DeleteObject, and PutObject, are referred to as data events. By default, CloudTrail trails do not log data events, so it is recommended to enable object-level logging for S3 buckets.
Enabling object-level logging will help you meet data compliance requirements within your organization, perform comprehensive security analyses, monitor specific patterns of user behavior in your AWS account, or take immediate actions on any object-level API activity within your S3 buckets using Amazon CloudWatch Events.
Enabling logging for these object-level events may significantly increase the number of events logged and may incur additional costs.
https://console.aws.amazon.com/cloudtrail/.Trails, and then click the name of the trail that you want to examine.General details.Multi-region trail is set to Yes.Data events and confirm the configuration:advanced event selectors is being used, it should read:Data Events: S3
Log selector template
Log all events
basic event selectors is being used, it should read:Data events: S3
Bucket Name: All current and future S3 buckets
Write: Enabled
list-trails command to list all trails:aws cloudtrail list-trails
"TrailARN": "arn:aws:cloudtrail:<region>:<account#>:trail/<trail-name>",
"Name": "<trail-name>",
"HomeRegion": "<region>"
get-trail command to determine whether a trail is a multi-region trail:aws cloudtrail get-trail --name <trail-name> --region <region-name>
The command output should include: "IsMultiRegionTrail": true.
Run the get-event-selectors command, using the Name of the trail and the region returned in step 2, to determine if data event logging is configured:
aws cloudtrail get-event-selectors --region <home-region> --trail-name <trail-name> --query EventSelectors[*].DataResources[]
"Type": "AWS::S3::Object",
"Values": [
"arn:aws:s3"
If the get-event-selectors command returns an empty array, data events are not included in the trail's logging configuration; therefore, object-level API operations performed on S3 buckets within your AWS account are not being recorded.
Repeat steps 1-7 to verify that each trail has multi-region enabled and is configured to log data events. If a trail does not have multi-region enabled and data event logging configured, refer to the remediation steps.
At least one multi-region trail has S3 object-level write event logging enabled for all buckets.
https://console.aws.amazon.com/s3/.buckets, and then click the name of the S3 bucket you want to examine.Properties tab to see the bucket configuration in detail.AWS CloudTrail data events section, select the trail name for recording activity. You can choose an existing trail or create a new one by clicking the Configure in CloudTrail button or navigating to the CloudTrail console.Data Events check box.S3 from the Data event type drop-down.Log all events from the Log selector template drop-down.object-level data events logging for S3 buckets within your AWS account, run the put-event-selectors command using the name of the trail that you want to reconfigure as identifier:aws cloudtrail put-event-selectors --region <region-name> --trail-name <trail-name> --event-selectors '[{ "ReadWriteType": "WriteOnly", "IncludeManagementEvents":true, "DataResources": [{ "Type": "AWS::S3::Object", "Values": ["arn:aws:s3:::<s3-bucket-name>/"] }] }]'
object-level event trail configuration.["arn:aws:s3"] in the previous command.object-level logging of write events.--region command parameter, and perform the process for the other regions.By default, CloudTrail does not log object-level (data event) API operations for S3 buckets. Data event logging must be explicitly enabled per trail and bucket.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 8.5 Collect Detailed Audit Logs - Configure detailed audit logging for enterprise assets containing sensitive data. Include event source, date, username, timestamp, source addresses, destination addresses, and other useful elements that could assist in a forensic investigation. | x | x | |
| v7 | 6.3 Enable Detailed Logging - Enable system logging to include detailed information such as an event source, date, user, timestamp, source addresses, destination addresses, and other useful elements. | x | x |
Level 2 | Automated