S3 Event Notifications Now Include System Tags

System-generated tags are now part of S3 event notifications. It's not a feature, it's a fix.

What changed

• S3 event notifications now include system-generated tags for all destinations (EventBridge, SQS, SNS, Lambda).
• These tags are metadata labels applied by AWS services to buckets.
• The feature is available at no additional cost in all AWS Regions.

Why it matters

This change directly addresses a significant operational burden for environments managing numerous S3 buckets. Previously, filtering S3 events based on bucket characteristics often required complex, brittle configurations, potentially involving individual bucket listings or separate Lambda functions to inspect events. The honest version: This enables a single EventBridge rule to filter events from thousands of buckets based on their system-assigned tags, rather than needing to enumerate each bucket ARN. This should simplify workflows for data lakes, compliance monitoring, and cross-account access logging.

The catch

Watch out: While the announcement states system-generated tags are included, it does not specify which AWS services' system-generated tags are supported or how frequently they are refreshed within S3 event notifications. The honest version: You gain EventBridge filtering efficiency, but lose granular control over which system tags are available and their real-time accuracy in the event payload. This pairs with S3 Object Lambda for more advanced event manipulation, but doesn't inherently solve the problem of tag staleness.

Ship it

If you are currently using EventBridge to filter S3 events and manage more than a dozen buckets, investigate enabling this feature. Ensure your buckets have relevant system-generated tags applied by services like CloudFormation or AWS Config. Update your EventBridge rules to leverage tag-based filtering instead of explicit bucket ARNs where applicable.

Bottom line: S3 event notifications now include system tags, simplifying EventBridge filtering for large numbers of buckets.

— Filed to /aws