Vendors / Amazon Web Services / Amazon S3 / S3 documented server access operations

Event type

S3 documented server access operations

Three documented S3 text scenarios: GET logging status, missing bucket policy, PUT object. Registry bucket/owner/client, UTC clock and fresh request identifiers.

PLAIN TEXT 27 fields Generator

s3 access

Preview Sample View Schema

CLI Install

meltr templates install aws

Overview

What this event covers

27-field published example profile; three complete scenario branches. Uses schema-standard registry fields plus generated vendor-specific IDs. Works with the default MELTr entity sample.yaml; example configuration: configs/aws/s3/server-access.yaml. Tested with MELTr rc3 commit 1e14e5defb66f6ac24decbe59c1c4f4e64877618. Entity fixtures must be selected per source; generic registry preview entities are not sufficient.

When generated

›Logging-status GET, missing-policy GET or successful object PUT.

Security relevance

Informational

Frequency notes

3600/hour test rate; equal synthetic branch selection is not measured traffic.

Resources

Docs and tools

S3 ordered fields and examples official

Generation

Configuration

Base frequency: 3600 events/hour
Business hours: 1.0x
Night hours: 1.0x
Weekend: 1.0x

Schema

Field definitions

Field reference for this event type — types, requirements, examples, and allowed values.

bucket_owner

String Required

Position 1 in the native text record. Registry service canonical_owner; 64 lowercase hex, stable synthetic account.

Source: Registry service canonical_owner; 64 lowercase hex, stable synthetic account.

Format unquoted token

Example e6433b73ea41ab1ccb8ebab49cc9392690bebe14b244719dac41d9ef96ce033d

bucket

String Required

Position 2 in the native text record. Registry service bucket_name; local safe example-* name (no dots or exotic characters).

Source: Registry service bucket_name; local safe example-* name (no dots or exotic characters).

Format unquoted token

Example example-lab-bucket

time

String Required

Position 3 in the native text record. One now() UTC clock, numeric strftime components and explicit English month table; seconds.

Source: One now() UTC clock, numeric strftime components and explicit English month table; seconds.

Format bracketed UTC

Example [01/Oct/2026:22:47:44 +0000]

remote_ip

String Required

Position 4 in the native text record. One registry.get_random_device() IP; validated IPv4.

Source: One registry.get_random_device() IP; validated IPv4.

Format unquoted token

Example 192.0.2.91

requester

String Required

Position 5 in the native text record. Reuse canonical_owner; owner account requester in this profile.

Source: Reuse canonical_owner; owner account requester in this profile.

Format unquoted token

Example e6433b73ea41ab1ccb8ebab49cc9392690bebe14b244719dac41d9ef96ce033d

request_id

String Required

Position 6 in the native text record. Faker bothify: 16 uppercase hexadecimal characters, fresh each event.

Source: Faker bothify: 16 uppercase hexadecimal characters, fresh each event.

Format unquoted token

Example CEF3751758C51565

operation

String Required

Position 7 in the native text record. Scenario-fixed: `REST.GET.BUCKETPOLICY`, `REST.GET.LOGGING_STATUS`, `REST.PUT.OBJECT`.

Source: Scenario-fixed: `REST.GET.BUCKETPOLICY`, `REST.GET.LOGGING_STATUS`, `REST.PUT.OBJECT`.

Format unquoted token

Example REST.GET.BUCKETPOLICY

key

String Required

Position 8 in the native text record. Scenario-fixed: `-`, `s3-dg.pdf`.

Source: Scenario-fixed: `-`, `s3-dg.pdf`.

Format unquoted token

Example -

request_uri

String Required

Position 9 in the native text record. Jinja derives bucket path; operation-specific method/query/key fixed.

Source: Jinja derives bucket path; operation-specific method/query/key fixed.

Format quoted string

Example "GET /example-lab-bucket?policy HTTP/1.1"

http_status

String Required

Position 10 in the native text record. Scenario-fixed: `200`, `404`.

Source: Scenario-fixed: `200`, `404`.

Format unquoted token

Example 404

error_code

String Required

Position 11 in the native text record. Scenario-fixed: `-`, `NoSuchBucketPolicy`.

Source: Scenario-fixed: `-`, `NoSuchBucketPolicy`.

Format unquoted token

Example NoSuchBucketPolicy

bytes_sent

String Required

Position 12 in the native text record. Scenario-fixed: `-`, `242`, `297`.

Source: Scenario-fixed: `-`, `242`, `297`.

Format unquoted token

Example 297

object_size

String Required

Position 13 in the native text record. Scenario-fixed: `-`, `4406583`.

Source: Scenario-fixed: `-`, `4406583`.

Format unquoted token

Example -

total_time

String Required

Position 14 in the native text record. Scenario-fixed: `11`, `38`, `41754`.

Source: Scenario-fixed: `11`, `38`, `41754`.

Format unquoted token

Example 38

turnaround_time

String Required

Position 15 in the native text record. Scenario-fixed: `-`, `28`.

Source: Scenario-fixed: `-`, `28`.

Format unquoted token

Example -

referrer

String Required

Position 16 in the native text record. Scenario-fixed: `-`.

Source: Scenario-fixed: `-`.

Format quoted string

Example "-"

user_agent

String Required

Position 17 in the native text record. Scenario-fixed: `S3Console/0.4`.

Source: Scenario-fixed: `S3Console/0.4`.

Format quoted string

Example "S3Console/0.4"

version_id

String Required

Position 18 in the native text record. Scenario-fixed: `-`.

Source: Scenario-fixed: `-`.

Format unquoted token

Example -

host_id

String Required

Position 19 in the native text record. MELTr random_string(85, base64 alphabet), Faker selects final A/Q/g/w, then ==; synthetic 64-byte base64 token.

Source: MELTr random_string(85, base64 alphabet), Faker selects final A/Q/g/w, then ==; synthetic 64-byte base64 token.

Format unquoted token

Example w79NfUHfUjwWHVaXbWemcO/WhzZelXlrVA/8/A9u9fl8f6bXlwJmdKVfzzApvMDVC4wgigG6q3eTmf8yW3UFvQ==

signature_version

String Required

Position 20 in the native text record. Scenario-fixed: `SigV4`.

Source: Scenario-fixed: `SigV4`.

Format unquoted token

Example SigV4

cipher_suite

String Required

Position 21 in the native text record. Scenario-fixed: `ECDHE-RSA-AES128-GCM-SHA256`, `ECDHE-RSA-AES128-SHA`.

Source: Scenario-fixed: `ECDHE-RSA-AES128-GCM-SHA256`, `ECDHE-RSA-AES128-SHA`.

Format unquoted token

Example ECDHE-RSA-AES128-GCM-SHA256

authentication_type

String Required

Position 22 in the native text record. Scenario-fixed: `AuthHeader`.

Source: Scenario-fixed: `AuthHeader`.

Format unquoted token

Example AuthHeader

host_header

String Required

Position 23 in the native text record. Same bucket + .s3.us-west-1.amazonaws.com.

Source: Same bucket + .s3.us-west-1.amazonaws.com.

Format unquoted token

Example example-lab-bucket.s3.us-west-1.amazonaws.com

tls_version

String Required

Position 24 in the native text record. Scenario-fixed: `TLSV1.2`.

Source: Scenario-fixed: `TLSV1.2`.

Format unquoted token

Example TLSV1.2

access_point_arn

String Required

Position 25 in the native text record. Scenario-fixed: `-`.

Source: Scenario-fixed: `-`.

Format unquoted token

Example -

acl_required

String Required

Position 26 in the native text record. Scenario-fixed: `-`, `Yes`.

Source: Scenario-fixed: `-`, `Yes`.

Format unquoted token

Example Yes

source_region

String Required

Position 27 in the native text record. Scenario-fixed: `us-east-1`.

Source: Scenario-fixed: `us-east-1`.

Format unquoted token

Example us-east-1