Configure the aws_cloudtrail event_selector block with appropriate settings.

The event_selector block should contain:

• A data_resource block with type set to AWS::S3::Object and values set to either the ARN for the aws_s3_bucket, or arn:aws:s3::: to apply to all buckets
• read_write_type set to All or WriteOnly

Example configuration

resource "aws_s3_bucket" "bucket1" {
  # other required fields here
}

resource "aws_s3_bucket" "logged_bucket1" {
  # other required fields here
}

resource "aws_cloudtrail" "read_write_type_all" {
  name = "read_write_type_all"
  s3_bucket_name = "${aws_s3_bucket.ct_bucket1.id}"

  event_selector {
    read_write_type = "All"

    data_resource {
      type = "AWS::S3::Object"
      values = ["${aws_s3_bucket.ct_bucket1.arn}/", "${aws_s3_bucket.logged_bucket1.arn}/"]
    }
  }
}