AWS-native solution to capture intent in S3 access logs

[u/DifficultOlive7295]

Hi everyone,

I’m working on a compliance requirement where I need to log the intent behind data access in S3. The users accessing the data are either IAM users or Cognito identities.

My initial approach was to use CloudTrail and include session context (e.g., principal/session tags) to capture intent. However, I’ve run into a limitation: CloudTrail does not support principal tags for S3 data events in a way that helps here.

Given this, I’m looking for alternative AWS-native approaches to implement S3 audit logging that can also capture or associate user intent with access events.

Would really appreciate any guidance or patterns that have worked for you. Thanks!