When an AWS S3 bucket is accessed, every request leaves a trail. That trail lives in audit logs. Done right, those logs don’t just answer who touched your data, they reveal what they did, when they did it, and how. The wrong setup means shadows, blind spots, and fear.