How to Configure Spaces Access Logs

Spaces buckets automatically generate detailed logs of reads, writes, and deletions of objects in your buckets, as well as origin endpoints in the Amazon S3 Server Access Log format. You can configure this feature using the S3 API or Terraform. Using the PutBucketLogging S3 API requires an access key with “Full Access” permissions on all buckets.

Spaces access logs are designed to be delivered within an hour but may take as long as two hours or more.

Configure Access Logs

To configure access logs, use the following API call, replacing REGION with your bucket’s region and MY_SOURCE_BUCKET with your source bucket’s name (the origin of the logs):

aws --endpoint-url https://REGION.digitaloceanspaces.com \
        s3api put-bucket-logging \
        --bucket MY_SOURCE_BUCKET \
        --bucket-logging-status file://logging_config.json

The file logging_config.json allows you to set your target bucket name (where the logs are output) and target directory prefix, for example:

{
  "LoggingEnabled": {
    "TargetBucket": "my-destination-bucket",
    "TargetPrefix": "Logs/"
  }
}

If you have enabled the Spaces CDN on your buckets, configuring access logs also logs accesses to your buckets’ CDN endpoints in the Amazon CloudFront access logs format.

For a list of feature limits, see Access Key Limits.