---
title: "S3 Event Record Format"
slug: "s3-event-record-format"
tags: ["Event-Broker", "5.4"]
updated: 2026-10-28T01:53:34Z
published: 2026-10-28T01:53:34Z
canonical: "docs.vastdata.com/s3-event-record-format"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vastdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# S3 Event Record Format

VAST Cluster generates S3 event records in the following format:

```plaintext

   "Records":[  
      {  
         "awsRegion"="<region>",  
         "eventName":"<event type>",  
         "eventSource":"vast:s3",   
         "eventTime":"<timestamp>"  
         "eventVersion":"2.2",
         "requestParameters":{  
            "sourceIPAddress":"<source IP>"
         },
         "responseElements":{  
            "x-amz-request-id":"<request ID>",
            "x-amz-id-2":"<request ID>"
         },
         "s3":{  
            "bucket":{  
               "arn":"arn:vast:s3:::<bucket name>"
               "name":"<bucket name>",
               "ownerIdentity":{  
                  "principalId":"<principal ID>"
               },
            },
            "configurationId":"<config ID>",
            "object":{  
               "eTag":"<eTag>",               
               "key":"<key>",
               "versionId":"<version>",
               "sequencer": "<sequencer>"
               "size":"<size>",
            }
            "s3SchemaVersion":"1.0",
         },
         "userIdentity":{  
            "principalId":"<principal's email>"
         },
      }
   ]
```

Where:

- `&lt;timestamp&gt;` contains the time when VAST Cluster finished processing of the request. The time is in ISO-8601 format, for example, 1970-01-01T00:00:00.00000Z.
- `&lt;event type&gt;` identifies the [S3 event type](/docs-5-4/docs/event-publishing) (including the prepending 's3:').
- `&lt;principal ID&gt;` identifies the principal (for example, the username for local users, or username@domainname for users retrieved from authentication providers).
- `&lt;source IP&gt;` is the client IP address from which the S3 request originated.
- `&lt;request ID&gt;` is the VAST-internal identifier for the request.
- `&lt;config ID&gt;` is the ID of the event notification definition record created on the VAST cluster.
- `&lt;bucket name&gt;` is the name of the bucket included in the S3 request.
- `&lt;key&gt;` is the key of the object specified in the S3 request.
- `&lt;size&gt;` indicates the object size in bytes.
- `eTag` is the object's entity tag (eTag).
- `&lt;version&gt;` indicates the object version if S3 Object Versioning is enabled for the bucket. If versioning is not enabled, this entry is not included.
- `&lt;sequencer&gt;` is a string representation of a hexadecimal value used to determine the event's sequence number. It is only used with PUT and DELETE requests,

For example:

```plaintext

Records=[Bunch(
    awsRegion='region',
    eventName='s3:ObjectCreated:Put',
    eventSource='vast:s3',
    eventTime='2024-10-01T10:51:35.859365Z',
    eventVersion='2.2',
    requestParameters=Bunch(sourceIPAddress='198.51.100.2'),
    responseElements=Bunch(x-amz-id-2='0x80010000000c', x-amz-request-id='0x80010000000c'),
    s3=Bunch(
         bucket=Bunch(
              arn='vast:s3:::design-enter-above',
              name='design-enter-above',
              ownerIdentity=Bunch(principalId='user@example.comlab')
              ),
         configurationId='participant-full',
         object=Bunch(
              eTag='5defbfc99890b0538929cca518a1fe7f',
              key='drive-blue-capital',
              sequencer='000300000000000f4241',
              size=1048576
              ),
         s3SchemaVersion='1.0'
         ),
    userIdentity=Bunch(principalId='user@example.com')
)]
```