S3 access logs
When storing different objects in S3, especially those that are to be downloaded by various users and groups, you might want to know who is accessing the different files, when, and from what location.
Users can capture all the access logs and records of who is accessing various objects in a bucket via a simple setting in S3. You cannot store the logs in the same bucket as the items that you are tracking, so you need to either create an entirely new bucket expressly for the purpose of capturing the logs or designate a previously created bucket in your current account to hold the logs.
Logs are not pushed to that bucket in real time as items are accessed, as would be the case for logs on a web server. Amazon pushes the logs in batches in a best-effort approach.
If you don't want to set up an entirely different bucket to capture these logs, and if you have CloudTrail logs turned on for the account, then you can gather IAM user information on S3 API calls...