Log files will be written to the target bucket under the identity of a member of the http://acs.amazonaws.com/groups/s3/LogDelivery group. These writes are subject to the usual access control restrictions. Therefore, logs will not be delivered unless the access control policy of the target bucket grants the log delivery group WRITE access. To ensure log files are delivered correctly, the log delivery group must also have READ_ACP permission on the target bucket. For more information about access control lists and groups, see Authentication and Access Control. For more information about correctly configuring your target bucket's access control policy, see the Setting Up Server Access Logging.

Log files created in the target bucket have an access control list entry that consists of a FULL_CONTROL grant to the bucket owner and grants to any users specified through the TargetGrants element.

The server access logging feature is designed for best effort. You can expect that most requests against a bucket that is properly configured for logging will result in a delivered log record, and that most log records will be delivered within a few hours of the time that they were recorded.

However, the server logging feature is offered on a best-effort basis. The completeness and timeliness of server logging is not guaranteed. The log record for a particular request might be delivered long after the request was actually processed, or it might not be delivered at all. The purpose of server logs is to give the bucket owner an idea of the nature of traffic against his or her bucket. It is not meant to be a complete accounting of all requests.

It follows from the best-effort nature of the server logging feature that the usage reports available at the AWS portal might include usage that does not correspond to any request in a delivered server log.