[Yandex Cloud documentation](../../../index.md) > [Yandex Object Storage](../../index.md) > [Step-by-step guides](../index.md) > Buckets > Enabling logging # Managing bucket logging To monitor [bucket](../../concepts/bucket.md) operations, enable [logging](../../concepts/server-logs.md). Detailed information about requests to the _source_ bucket will be saved in an [object](../../concepts/object.md) in the _target_ bucket. The source and target buckets must be different. Object Storage [does not guarantee](../../concepts/server-logs.md) complete and timely logging. By default, logging is disabled. After you enable it, Object Storage will log info about bucket operations once an hour. ## Enabling logging {#enable} To log bucket access: 1. Use an existing target bucket or create a new one. This bucket will store logs. {% cut "How to create a bucket" %} To create a [bucket](../../concepts/bucket.md), you need the _minimum_ `storage.editor` [role](../../security/index.md#storage-editor) for the [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder). {% list tabs group=instructions %} - Management console {#console} 1. In the [management console](https://console.yandex.cloud), select the folder where you want to create a bucket. 1. Navigate to **Object Storage**. 1. In the top panel, click **Create bucket**. 1. On the bucket creation page: 1. Enter a name for the bucket by following the [naming conventions](../../concepts/bucket.md#naming). By default, a bucket with a dot in the name is only available over HTTP. To provide HTTPS support for your bucket, [upload your own security certificate](../hosting/certificate.md) to Object Storage. 1. Add [labels](../../concepts/tags.md), if required: 1. Click **Add label**. 1. Add a label in `key: value` format. 1. Press **Enter**. 1. Limit the maximum bucket size, if required. If the value is `0`, the size is not limited. It is similar to the enabled **No limit** option. 1. Configure [public access](../../security/public-access.md) to read [objects](../../concepts/object.md) in the bucket, get a list of objects, and read bucket settings: * `With authorization`: Authorized Yandex Cloud users only. * `For all`: All users. {% note warning %} Public access is granted to an unlimited number of anonymous users. Use it only when other access grant mechanisms are not available. {% endnote %} 1. Select the default [storage class](../../concepts/storage-class.md): * `Standard` * `Cold` * `Ice` * `Intelligent` Cold classes are for long-term storage of objects you intend to use less frequently. The colder the storage, the cheaper it is to store data in, but the more expensive it is to read from and write to it. Intelligent-Tiering storage class automatically optimizes costs by moving objects between access levels based on how often they are accessed. 1. Enable encryption if you need to: in the **KMS Key** field, select an existing [symmetric key](../../../kms/concepts/key.md) or [create](../../../kms/operations/key.md#create) a new one. 1. Click **Create bucket** to complete the operation. - Yandex Cloud CLI {#cli} If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install). The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id ` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions. 1. See the description of the CLI command for creating a bucket: ```bash yc storage bucket create --help ``` 1. Create a bucket in the default folder: ```bash yc storage bucket create --name ``` Where `--name` is the name of the bucket. This is a required setting. For more information, see [Bucket naming rules](../../concepts/bucket.md#naming). By default, a bucket with a dot in the name is only available over HTTP. To provide HTTPS support for your bucket, [upload](../hosting/certificate.md) your own security certificate to Object Storage. Result: ```text name: example folder_id: b1gmit33ngp6******** anonymous_access_flags: read: false list: false default_storage_class: STANDARD versioning: VERSIONING_DISABLED max_size: "53687091200" acl: {} created_at: "2022-12-16T14:05:12.196007Z" ``` {% cut "Optional parameters" %} * `--default-storage-class`: [Storage class](../../concepts/storage-class.md). Valid values: * `standard`: Standard storage. It is installed by default. * `cold`: Cold storage. * `ice`: Ice storage. * `intelligent_tiering`: Intelligent storage Cold classes are for long-term storage of objects you intend to use less frequently. The colder the storage, the cheaper it is to store data in, but the more expensive it is to read from and write to it. Intelligent-Tiering storage class automatically optimizes costs by moving objects between access levels based on how often they are accessed. * `--max-size`: Maximum bucket size, in bytes. The default value is `0` (unlimited). * Parameters for enabling [public access](../../security/public-access.md) to a bucket: * `--public-read`: Enables public read access to bucket objects. * `--public-list`: Enables public view access to the list of bucket objects. * `--public-config-read`: Enables public read access to bucket settings. By default, public access to the bucket is disabled. {% note warning %} Public access is granted to an unlimited number of anonymous users. Use it only when other access grant mechanisms are not available. {% endnote %} * Parameters to configure the bucket [ACL](../../concepts/acl.md): * `--acl`: Predefined ACL. For the list of possible values, see [Predefined ACLs](../../concepts/acl.md#predefined-acls). You cannot use this parameter together with `--grants`. * `--grants`: This parameter configures permissions for individual users, [service accounts](../../../iam/concepts/users/service-accounts.md), [user groups](../../../organization/concepts/groups.md), and [public groups](../../concepts/acl.md#public-groups) (a group of all internet users or a group of all authenticated Yandex Cloud users). You cannot use this parameter together with `--acl`. The parameter value is specified in the following format: `grant-type=,grantee-id=,permission=`, where: * `grant-type`: Permission grantee type. The possible values are: * `grant-type-account`: User, [service account](../../../iam/concepts/users/service-accounts.md), or [user group](../../../organization/concepts/groups.md). * `grant-type-all-authenticated-users`: [Public group](../../concepts/acl.md#public-groups) that includes all authenticated Yandex Cloud users. * `grant-type-all-users`: Public group that includes all internet users. * `grantee-id`: ID of the user, service account, or user group you need to grant a permission to. It is specified only if `grant-type=grant-type-account`. * `permission`: ACL permission type. The possible values are `permission-full-control`, `permission-write`, and `permission-read`. Learn more about permissions in [Permission types](../../concepts/acl.md#permissions-types). To configure multiple permissions, specify the `--grants` parameter multiple times. By default, an empty ACL is created for each new bucket. {% endcut %} Learn more about the `yc storage bucket create` command in the [YC CLI reference](../../../cli/cli-ref/storage/cli-ref/bucket/create.md). - AWS CLI {#aws-cli} If you do not have the AWS CLI yet, [install and configure it](../../tools/aws-cli.md). To create a bucket, [assign](../../../iam/operations/sa/assign-role-for-sa.md) the `storage.editor` [role](../../security/index.md#storage-editor) to the service account used by the AWS CLI. In the terminal, run this command: ```bash aws s3api create-bucket \ --endpoint-url=https://storage.yandexcloud.net \ --bucket ``` Where: * `--endpoint-url`: Object Storage endpoint. * `--bucket`: Bucket name. {% note info %} By default, a bucket with a dot in the name is only available over HTTP. To provide HTTPS support for your bucket, [upload](../hosting/certificate.md) your own security certificate to Object Storage. For more information, see [Bucket naming rules](../../concepts/bucket.md#naming). {% endnote %} Result: ```text { "Location": "/" } ``` The new bucket will have the following parameters: * Maximum size unlimited. * Limited [access](../../concepts/bucket.md#bucket-access) to read objects, get a list of objects, and read bucket setting. * [Storage class](../../concepts/storage-class.md): `Standard`. {% cut "Optional parameters" %} You can apply a [predefined ACL](../../concepts/acl.md#predefined-acls) to a bucket or configure permissions for individual users, [service accounts](../../../iam/concepts/users/service-accounts.md), [user groups](../../../organization/concepts/groups.md), and [public groups](../../concepts/acl.md#public-groups), such as a group of all internet users or a group of all authenticated Yandex Cloud users. You cannot use these settings together: a bucket can have either a predefined ACL or individual permissions. {% note info %} To manage bucket [ACL](../../concepts/acl.md) settings, [assign](../../../iam/operations/sa/assign-role-for-sa.md) the `storage.admin` [role](../../security/index.md#storage-admin) to the service account used by the AWS CLI. {% endnote %} **Predefined ACL** ```bash aws s3api create-bucket \ --endpoint-url=https://storage.yandexcloud.net \ --bucket \ --acl ``` Where `--acl` is a predefined ACL. For a list of values, see [Predefined ACLs](../../concepts/acl.md#predefined-acls). **Individual permissions** ```bash aws s3api create-bucket \ --endpoint-url=https://storage.yandexcloud.net \ --bucket \ ``` Where: * The possible types of ACL permissions are as follows: * `--grant-read`: Permission to access the list of objects in the bucket, read various bucket settings (lifecycle, CORS, and static hosting), and read all objects in the bucket. * `--grant-write`: Permission to write, overwrite, and delete objects in the bucket. It can only be used together with `--grant-read`. * `--grant-full-control`: Full access to the bucket and objects in it. You can specify multiple permissions in a single command. * The possible permission grantees are as follows: * `id=`: ID of the user, service account, or user group you need to grant a permission to. * `uri=http://acs.amazonaws.com/groups/global/AuthenticatedUsers`: [Public group](../../concepts/acl.md#public-groups) that includes all authenticated Yandex Cloud users. * `uri=http://acs.amazonaws.com/groups/global/AllUsers`: Public group that includes all internet users. By default, an empty ACL is created for each new bucket. {% endcut %} Learn more about the `aws s3api create-bucket` command in [this AWS guide](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3api/create-bucket.html). - Terraform {#tf} {% note info %} If you access Object Storage via Terraform under a [service account](../../../iam/concepts/users/service-accounts.md), [assign](../../../iam/operations/sa/assign-role-for-sa.md) to the service account the relevant [role](../../security/index.md#roles-list), e.g., `storage.admin`, for the folder you are going to create the resources in. {% endnote %} With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed. Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license. For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../../terraform/index.md). If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform). To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../../terraform/authentication.md) using the appropriate method. By default, Terraform uses an IAM token for authentication in Object Storage. In addition to an IAM token, you can use a service account and static access keys for authentication to Object Storage. For more information on Terraform authentication features in Object Storage, see [this provider guide](../../../terraform/resources/storage_bucket.md). **Creating a bucket using an IAM token** 1. [Get the authentication credentials](../../../tutorials/infrastructure-management/terraform-quickstart.md#get-credentials) and add them to environment variables. 1. In the configuration file, describe the resources you want to create: ```hcl # Creating a bucket using an IAM token resource "yandex_storage_bucket" "iam-bucket" { bucket = "" folder_id = "" } ``` Where: * `bucket`: Bucket name. This is a required setting. By default, a bucket with a dot in the name is only available over HTTP. To provide HTTPS support for your bucket, [upload your own security certificate](../hosting/certificate.md) to Object Storage. * `folder_id`: [Folder ID](../../../resource-manager/operations/folder/get-id.md). {% note info %} If using a user account IAM token, specify `folder_id` in the `yandex_storage_bucket` resource. If using an IAM token of a service account or static access keys, you do not have to specify `folder_id`. You will only need it to create a resource in a folder other than the service account folder. {% endnote %} For more information on the properties of the `yandex_storage_bucket` resource in Terraform, see [this provider guide](../../../terraform/resources/storage_bucket.md). 1. Create the resources: 1. In the terminal, navigate to the configuration file directory. 1. Make sure the configuration is correct using this command: ```bash terraform validate ``` If the configuration is valid, you will get this message: ```bash Success! The configuration is valid. ``` 1. Run this command: ```bash terraform plan ``` You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration. 1. Apply the configuration changes: ```bash terraform apply ``` 1. Type `yes` and press **Enter** to confirm the changes. Terraform will create all the required resources. You can check the new resources and their settings using the [management console](https://console.yandex.cloud). **Creating a bucket using a static key** 1. In the configuration file, describe the resources you want to create: {% cut "Creating a bucket using a static key" %} ```hcl terraform { required_providers { yandex = { source = "yandex-cloud/yandex" } } required_version = ">= 0.13" } # Configuring the provider provider "yandex" { zone = "ru-central1-a" } # Creating a service account resource "yandex_iam_service_account" "sa" { name = "" } # Assigning roles to a service account resource "yandex_resourcemanager_folder_iam_member" "sa-admin" { folder_id = "" role = "storage.admin" member = "serviceAccount:${yandex_iam_service_account.sa.id}" } # Creating a static access key resource "yandex_iam_service_account_static_access_key" "sa-static-key" { service_account_id = yandex_iam_service_account.sa.id description = "static access key for object storage" } # Creating a bucket using a static key resource "yandex_storage_bucket" "test" { access_key = yandex_iam_service_account_static_access_key.sa-static-key.access_key secret_key = yandex_iam_service_account_static_access_key.sa-static-key.secret_key bucket = "" max_size = default_storage_class = "" anonymous_access_flags { read = list = config_read = } tags = { = "" = "" ... = "" } } ``` Where: * `yandex_iam_service_account`: Description of the [service account](../../../iam/concepts/users/service-accounts.md) to create and use the [bucket](../../concepts/bucket.md): * `name`: Service account name. This is a required setting. * `bucket`: Bucket name. By default, a bucket with a dot in the name is only available over HTTP. To provide HTTPS support for your bucket, [upload your own security certificate](../hosting/certificate.md) to Object Storage. * `max_size`: Maximum bucket size, in bytes. The default value is `0`, unlimited. * `default_storage_class`: [Storage class](../../concepts/storage-class.md). Valid values: * `standard`: Standard storage. This is a default value. * `cold`: Cold storage. * `ice`: Ice storage. * `intelligent_tiering`: Intelligent storage Cold classes are for long-term storage of objects you intend to use less frequently. The colder the storage, the cheaper it is to store data in, but the more expensive it is to read from and write to it. Intelligent-Tiering storage class automatically optimizes costs by moving objects between access levels based on how often they are accessed. * `anonymous_access_flags`: [Access](../../concepts/bucket.md#bucket-access) settings: * `read`: Public read access to bucket objects. * `list`: Public view access to the list of bucket objects. * `config_read`: Public read access to bucket settings. Disabled by default. * `tags`: Bucket [labels](../../concepts/tags.md) in `key = "value"` format. For more information on the properties of the `yandex_storage_bucket` resource in Terraform, see [this provider guide](../../../terraform/resources/storage_bucket.md). {% endcut %} 1. Create the resources: 1. In the terminal, navigate to the configuration file directory. 1. Make sure the configuration is correct using this command: ```bash terraform validate ``` If the configuration is valid, you will get this message: ```bash Success! The configuration is valid. ``` 1. Run this command: ```bash terraform plan ``` You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration. 1. Apply the configuration changes: ```bash terraform apply ``` 1. Type `yes` and press **Enter** to confirm the changes. Terraform will create all the required resources. You can check the new resources and their settings using the [management console](https://console.yandex.cloud). - API {#api} To create a bucket, use the [create](../../api-ref/Bucket/create.md) REST API method for the [Bucket](../../api-ref/Bucket/index.md) resource, the [BucketService/Create](../../api-ref/grpc/Bucket/create.md) gRPC API call, or the [create](../../s3/api-ref/bucket/create.md) S3 API method. {% endlist %} {% endcut %} {% note info %} To write logs to the target bucket with an [access policy](../../concepts/policy.md) configured, [add](policy.md#apply-policy) a rule to this policy to allow any account to perform the `PutObject` action, and specify the name of the bucket with a [key prefix](../../concepts/server-logs.md#key-prefix) for log objects, e.g., `/logs/*`, as a resource. {% endnote %} 1. Enable logging for the source bucket you want to monitor. {% list tabs group=instructions %} - Management console {#console} 1. In the [management console](https://console.yandex.cloud), select a folder. 1. Navigate to **Object Storage**. 1. Select the bucket you want to configure logging for. 1. In the left-hand panel, select ![image](../../../_assets/console-icons/wrench.svg) **Settings**. 1. Select the **Logging** tab. 1. Enable **Write logs**. 1. Select **Bucket for log storage**. 1. In the **Prefix** field, specify the prefix for log storage. 1. Click **Save**. - AWS CLI {#cli} To enable logging via the [AWS CLI](../../tools/aws-cli.md): 1. Create a file with logging settings in JSON format. Here is an example: ```json { "LoggingEnabled": { "TargetBucket": "", "TargetPrefix": "" } } ``` Where: * `TargetBucket`: Name of the target bucket for the logs. * `TargetPrefix`: [Prefix of the key](../../concepts/server-logs.md#key-prefix) used for objects with logs, e.g., `logs/`. 1. Enable logging in the bucket: ```bash aws s3api put-bucket-logging \ --bucket \ --endpoint-url https://storage.yandexcloud.net \ --bucket-logging-status file:// ``` Where: * `--bucket`: Name of the source bucket to enable action logging for. * `--bucket-logging-status`: Path to the logging settings file. - Terraform {#tf} {% note info %} If you access Object Storage via Terraform under a [service account](../../../iam/concepts/users/service-accounts.md), [assign](../../../iam/operations/sa/assign-role-for-sa.md) to the service account the relevant [role](../../security/index.md#roles-list), e.g., `storage.admin`, for the folder you are going to create the resources in. {% endnote %} With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed. Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license. For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../../terraform/index.md). If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform). To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../../terraform/authentication.md) using the appropriate method. To enable logging for a bucket you want to track: 1. Open the Terraform configuration file and add the `logging` section to the bucket description. ```hcl resource "yandex_storage_bucket" "log_bucket" { access_key = "" secret_key = "" bucket = "" } resource "yandex_storage_bucket" "bucket" { access_key = "" secret_key = "" bucket = "" acl = "private" logging { target_bucket = yandex_storage_bucket.log_bucket.id target_prefix = "log/" } } ``` Where: * `access_key`: Static access key ID. {% note info %} In addition to static access keys, you can use an IAM token for authentication in Object Storage. For more details, see [Creating a bucket](create.md) and the [relevant provider documentation](../../../terraform/resources/storage_object.md). {% endnote %} * `secret_key`: Secret access key value. * `target_bucket`: Bucket for storing logs. * `target_prefix`: [Prefix of the key](../../concepts/server-logs.md#key-prefix) used for objects with logs, e.g., `logs/`. For more information on the properties of the `yandex_storage_bucket` resource in Terraform, see [this provider guide](../../../terraform/resources/storage_bucket.md#enable-logging). 1. Apply the changes: 1. In the terminal, navigate to the configuration file directory. 1. Make sure the configuration is correct using this command: ```bash terraform validate ``` If the configuration is valid, you will get this message: ```bash Success! The configuration is valid. ``` 1. Run this command: ```bash terraform plan ``` You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration. 1. Apply the configuration changes: ```bash terraform apply ``` 1. Type `yes` and press **Enter** to confirm the changes. This will create all the resources you need in the specified folder. You can check the new resources and their settings using the [management console](https://console.yandex.cloud). - API {#api} To enable logging for a bucket, use the [putBucketLogging](../../s3/api-ref/bucket/putBucketLogging.md) S3 API method. Here is an example of an HTTP request body: ```xml target_bucket_name key_prefix ``` Where: * `TargetBucket`: Target bucket name. * `TargetPrefix`: [Prefix of the key](../../concepts/server-logs.md#key-prefix) used for objects with logs, e.g., `logs/`. {% endlist %} If you want to delete the target bucket, first [disable logging](#stop-logging) or select another target bucket for storing logs. You can only [delete](delete.md) an empty bucket. ## Getting logging settings {#get-settings} To get the target bucket name and the log object key prefix, follow these steps: {% list tabs group=instructions %} - Management console {#console} 1. In the [management console](https://console.yandex.cloud), select a folder. 1. Navigate to **Object Storage**. 1. Select the original bucket. 1. In the left-hand panel, select ![image](../../../_assets/console-icons/wrench.svg) **Settings**. 1. Select the **Logging** tab. 1. The **Bucket for log storage** list contains the name of the target bucket. 1. The **Prefix** field contains the prefix used for log storage. - AWS CLI {#cli} To get the logging settings via the [AWS CLI](../../tools/aws-cli.md): Run this command: ```bash aws s3api get-bucket-logging \ --bucket \ --output json \ --endpoint-url https://storage.yandexcloud.net ``` Result: ```json { "LoggingEnabled": { "TargetBucket": "", "TargetPrefix": "" } } ``` - Terraform {#tf} To get the logging settings for the bucket you want to monitor: 1. Open the Terraform configuration file and find the `logging` section in the bucket description. ```hcl resource "yandex_storage_bucket" "log_bucket" { access_key = "" secret_key = "" bucket = "" } resource "yandex_storage_bucket" "bucket" { access_key = "" secret_key = "" bucket = "" acl = "private" logging { target_bucket = yandex_storage_bucket.log_bucket.id target_prefix = "log/" } } ``` Where: * `access_key`: Static access key ID. * `secret_key`: Secret access key value. * `target_bucket`: Bucket for storing logs. * `target_prefix`: [Prefix of the key](../../concepts/server-logs.md#key-prefix) used for objects with logs, e.g., `logs/`. For more information on the properties of the `yandex_storage_bucket` resource in Terraform, see [this provider guide](../../../terraform/resources/storage_bucket.md#enable-logging). 1. Apply the changes: 1. In the terminal, navigate to the configuration file directory. 1. Make sure the configuration is correct using this command: ```bash terraform validate ``` If the configuration is valid, you will get this message: ```bash Success! The configuration is valid. ``` 1. Run this command: ```bash terraform plan ``` You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration. 1. Apply the configuration changes: ```bash terraform apply ``` 1. Type `yes` and press **Enter** to confirm the changes. You can check the update using the [management console](https://console.yandex.cloud). - API {#api} Use the [getBucketLogging](../../s3/api-ref/bucket/getBucketLogging.md) S3 API method. Here is an example of an HTTP response body: ```xml HTTP/1.1 200 target_bucket_name logs/ ``` {% endlist %} ## Getting logs {#get-logs} To get logs, download the object prefixed with `logs/` from the target bucket: {% list tabs group=instructions %} - Management console {#console} 1. In the [management console](https://console.yandex.cloud), select a folder. 1. Navigate to **Object Storage**. 1. Select the target bucket with logs. 1. Go to the `logs/` folder. 1. Next to the log object you want to download, click ![image](../../../_assets/console-icons/ellipsis.svg) and select **Download**. {% note info %} You can also use [CyberDuck](../../tools/cyberduck.md) or [WinSCP](../../tools/winscp.md) to download objects using the GUI. {% endnote %} - AWS CLI {#cli} To get logs using the [AWS CLI](../../tools/aws-cli.md), download the objects prefixed with `logs/` by following [this guide](../objects/download.md#cli). - API {#api} Use the Object [get](../../s3/api-ref/object/get.md) S3 API method. {% endlist %} ## Disabling logging {#stop-logging} To disable logging, follow these steps: {% list tabs group=instructions %} - Management console {#console} 1. In the [management console](https://console.yandex.cloud), select a folder. 1. Navigate to **Object Storage**. 1. Select the bucket you want to disable logging for. 1. In the left-hand panel, select ![image](../../../_assets/console-icons/wrench.svg) **Settings**. 1. Select the **Logging** tab. 1. Disable **Write logs**. 1. Click **Save**. - AWS CLI {#cli} To disable logging using the [AWS CLI](../../tools/aws-cli.md), use this command: ```bash aws s3api put-bucket-logging \ --bucket \ --endpoint-url https://storage.yandexcloud.net \ --bucket-logging-status {} ``` Where `--bucket` is the name of the source bucket to disable logging for. - Terraform {#tf} To disable logging: 1. In the Terraform configuration file, delete the `logging` section from the bucket description. {% cut "Example of a bucket description in Terraform configuration" %} ```hcl ... resource "yandex_storage_bucket" "log_bucket" { access_key = "" secret_key = "" bucket = "" } resource "yandex_storage_bucket" "bucket" { access_key = "" secret_key = "" bucket = "" acl = "private" logging { target_bucket = yandex_storage_bucket.log_bucket.id target_prefix = "log/" } } ... ``` {% endcut %} 1. Apply the configuration changes: 1. In the terminal, navigate to the configuration file directory. 1. Make sure the configuration is correct using this command: ```bash terraform validate ``` If the configuration is valid, you will get this message: ```bash Success! The configuration is valid. ``` 1. Run this command: ```bash terraform plan ``` You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration. 1. Apply the configuration changes: ```bash terraform apply ``` 1. Type `yes` and press **Enter** to confirm the changes. You can check the update using the [management console](https://console.yandex.cloud). - API {#api} Use the [putBucketLogging](../../s3/api-ref/bucket/putBucketLogging.md) S3 API method. In the request body, provide the `` parameter with an empty value. Here is an example of an HTTP request body: ```xml ``` {% endlist %}