How to identify who created ONTAP S3 Bucket
Applies to
- ONTAP S3
- ONTAP CLI
- ONTAP System Manager
- Third-party S3 clients (AWS CLI, S3 Browser, custom scripts)
Description
ONTAP S3 buckets can be created using multiple interfaces and tools, including ONTAP CLI, ONTAP System Manager, and S3-compatible clients such as AWS CLI or third-party applications. However, ONTAP does not store a direct “bucket creator” attribute in the bucket metadata.
To identify who created an ONTAP S3 bucket, user must rely on audit trails. There are two primary sources of audit information:
Cluster Management Audit Logs – These capture administrative actions performed through ONTAP CLI or System Manager.
S3 Protocol Audit Logs – These record API-driven operations, such as bucket creation via AWS CLI, S3 Browser, or Boto3 (Python), AWS SDK for Java.
The identification process depends on which audit logs are enabled and the method used to create the bucket. This article explains the available approaches to determine the origin of an ONTAP S3 bucket creation event.
