Audit logging for AI Object Storage

• Security and compliance teams: trace data access and administrative actions.
• Platform and storage admins: understand access patterns and debug incidents.
• Application engineers: correlate storage audit logs with application logs to investigate behavior during incidents.

​

Log types

​

Control plane logs

• Key creation
• Key revocation
• Audit logging enabled for a bucket or for the organization
• Audit logging disabled

​

Data plane logs

• Object operations such as puts, gets, and deletes
• Bucket operations such as bucket creation and listings

​

Log format and delivery

• The order of events inside a bundle doesn’t necessarily match the order in which CoreWeave generated them.
• The order of bundles written to the audit logging bucket doesn’t reflect the precise generation order.
• A single request (for example, a multi-object delete) can generate multiple log entries.

​

Audit logging bucket

​

Configuration

​

Enable audit logging

​

Prerequisites

• To set the bucket access policy: An AI Object Storage Access Key and an organization access policy that allows s3:PutBucketPolicy on the cw-[ORG-ID]-audit-logs bucket (or s3:* on all buckets).
• To call the Object Storage API: The Object Storage Admin IAM role and a CoreWeave API access token.

​

Steps

1. Contact CoreWeave support to request enablement, and include your organization name and Org ID. Your Org ID is a short hexadecimal string (for example, ab1cd2). Find it on the Settings page of your Cloud Console account. CoreWeave creates your cw-[ORG-ID]-audit-logs destination bucket as part of the enablement process.
2. After CoreWeave creates the destination bucket, apply a bucket access policy granting the CoreWeave audit logging service account permission to write logs. The policy must grant at minimum s3:ListBucket and s3:PutObject. Replace [ORG-ID] with your organization ID.
   audit-logging-bucket-access-policy.json

   {
     "Statement": [
       {
         "Sid": "AllowAuditLoggingServiceAccount",
         "Action": [
           "s3:ListBucket",
           "s3:PutObject"
         ],
         "Effect": "Allow",
         "Principal": {
           "CW": [
             "arn:aws:iam::coreweave:static/audit-logs"
           ]
         },
         "Resource": [
           "arn:aws:s3:::cw-[ORG-ID]-audit-logs",
           "arn:aws:s3:::cw-[ORG-ID]-audit-logs/*"
         ]
       }
     ],
     "Version": "2012-10-17"
   }
   
   For instructions on applying this policy using S3 clients or Terraform, see Manage bucket access policies.
3. Notify CoreWeave that you’ve applied the bucket access policy, either by replying to your CoreWeave support ticket or by notifying CoreWeave through your support Slack channel. The CoreWeave admin then finishes enabling audit logging for your organization. After CoreWeave confirms that audit logging is enabled for your organization, you can choose which event types to capture.
4. Call the Object Storage API to enable the types of logs you want:
   • Use organization-level settings to enable control plane logging, data plane logging for all buckets created after the setting is enabled, or both.
   • Use bucket-level settings to enable data plane logging for a specific bucket only.
   • Organization-level
   • Bucket-level

   Organization-level settings let you enable control plane logging, data plane logging for all buckets created after the setting is enabled, or both.Set the flags to true or false based on which event types you want to log:

   • controlPlaneAuditLoggingEnabled: Control plane logging
   • bucketAuditLoggingEnabled: Data plane logging for buckets created after the setting is enabled

   Save the following as organization-settings.json:

   organization-settings.json

   {
     "settings": {
       "controlPlaneAuditLoggingEnabled": true,
       "bucketAuditLoggingEnabled": true
     }
   }
   

   Submit the request:

   Example request

   curl -X PUT https://api.coreweave.com/v1/cwobject/organization/settings \
     -H "Content-Type: application/json" \
     -H "Authorization: Bearer [API-ACCESS-TOKEN]" \
     -d @organization-settings.json
   

   A successful response returns the updated organization settings:

   Response status code 200

   {
     "settings": {
       "controlPlaneAuditLoggingEnabled": true,
       "bucketAuditLoggingEnabled": true
     }
   }
   

   Bucket-level settings enable data plane logging for a specific bucket. Control plane logging is not available at the bucket level.Save the following as bucket-settings.json, replacing [BUCKET-NAME] with the name of the bucket to monitor. Set the auditLoggingEnabled flag to true to enable data plane logging for the bucket.

   bucket-settings.json

   {
     "bucketName": "[BUCKET-NAME]",
     "settings": {
       "auditLoggingEnabled": true
     }
   }
   

   Submit the request:

   Example request

   curl -X PUT https://api.coreweave.com/v1/cwobject/bucket/settings \
     -H "Content-Type: application/json" \
     -H "Authorization: Bearer [API-ACCESS-TOKEN]" \
     -d @bucket-settings.json
   

   A successful response returns the updated bucket settings:

   Response status code 200

   {
     "settings": {
       "auditLoggingEnabled": true
     }
   }
   

   You can also modify bucket settings in Terraform using the coreweave_object_storage_bucket_settings resource.