Table Of Contents


User Guide

First time using the AWS CLI? See the User Guide for help getting started.

[ aws . s3api ]



Set the logging parameters for a bucket and to specify permissions for who can view and modify the logging parameters. All logs are saved to buckets in the same AWS Region as the source bucket. To set the logging status of a bucket, you must be the bucket owner.

The bucket owner is automatically granted FULL_CONTROL to all logs. You use the Grantee request element to grant access to other people. The Permissions request element specifies the kind of access the grantee has to the logs.

Grantee Values

You can specify the person (grantee) to whom you're assigning access rights (using request elements) in the following ways:

  • By the person's ID: Grantee xmlns:xsi="" xsi:type="CanonicalUser"IDID/IDDisplayNameGranteesEmail/DisplayName /Grantee DisplayName is optional and ignored in the request.
  • By Email address: `` Grantee xmlns:xsi="" xsi:type="AmazonCustomerByEmail"`` The grantee is resolved to the CanonicalUser and, in a response to a GET Object acl request, appears as the CanonicalUser.
  • By URI: Grantee xmlns:xsi="" xsi:type="Group"URI

To enable logging, you use LoggingEnabled and its children request elements. To disable logging, you use an empty BucketLoggingStatus request element:

BucketLoggingStatus xmlns="" /

For more information about server access logging, see Server Access Logging .

For more information about creating a bucket, see CreateBucket . For more information about returning the logging status of a bucket, see GetBucketLogging .

The following operations are related to PutBucketLogging :

  • PutObject
  • DeleteBucket
  • CreateBucket
  • GetBucketLogging

See also: AWS API Documentation

See 'aws help' for descriptions of global parameters.


--bucket <value>
--bucket-logging-status <value>
[--content-md5 <value>]
[--cli-input-json <value>]
[--generate-cli-skeleton <value>]


--bucket (string)

The name of the bucket for which to set the logging parameters.

--bucket-logging-status (structure)

Container for logging status information.

JSON Syntax:

  "LoggingEnabled": {
    "TargetBucket": "string",
    "TargetGrants": [
        "Grantee": {
          "DisplayName": "string",
          "EmailAddress": "string",
          "ID": "string",
          "Type": "CanonicalUser"|"AmazonCustomerByEmail"|"Group",
          "URI": "string"
        "Permission": "FULL_CONTROL"|"READ"|"WRITE"
    "TargetPrefix": "string"

--content-md5 (string)

The MD5 hash of the PutBucketLogging request body.

--cli-input-json (string) Performs service operation based on the JSON string provided. The JSON string follows the format provided by --generate-cli-skeleton. If other arguments are provided on the command line, the CLI values will override the JSON-provided values. It is not possible to pass arbitrary binary values using a JSON-provided value as the string will be taken literally.

--generate-cli-skeleton (string) Prints a JSON skeleton to standard output without sending an API request. If provided with no value or the value input, prints a sample input JSON that can be used as an argument for --cli-input-json. If provided with the value output, it validates the command inputs and returns a sample output JSON for that command.

See 'aws help' for descriptions of global parameters.


The example below sets the logging policy for MyBucket. The AWS user will have full control over the log files, and no one else has any access. First, grant S3 permission with put-bucket-acl:

aws s3api put-bucket-acl --bucket MyBucket --grant-write URI= --grant-read-acp URI=

Then apply the logging policy:

aws s3api put-bucket-logging --bucket MyBucket --bucket-logging-status file://logging.json

logging.json is a JSON document in the current folder that contains the logging policy:

  "LoggingEnabled": {
    "TargetBucket": "MyBucket",
    "TargetPrefix": "MyBucketLogs/",
    "TargetGrants": [
        "Grantee": {
          "Type": "AmazonCustomerByEmail",
          "EmailAddress": ""
        "Permission": "FULL_CONTROL"


the put-bucket-acl command is required to grant S3's log delivery system the necessary permissions (write and read-acp permissions).

For more information, see Amazon S3 Server Access Logging in the Amazon S3 Developer Guide.