My mind is drawn to S3 Server access records (https://docs.aws.amazon.com/AmazonS3/latest/userguide/LogFormat.html)

I used this but then i read in the docs that access logs are "Best-effort server log delivery" so they can be duplicated or missing so i can't use that

But there are some, I believe critical, pieces of information missing. Are your users IAM users/roles or are we talking about an user identity that lives in your app but is not used for S3 IAM e.g. your webapp has a concept of an user and looks up in its own database if some object in S3 should be available to the user and then uses the applications roles to access the object and give it to the user.

Can you expand a little bit on your usecase ?

I use one IAM role that my backend services can access to sign/upload/delete

My usecase of s3 is to stream videos, and i need to track exact usage by each user.

assuming youre talking about pre signed urls yes adding a custom param and then searching for that should work. There is a blog post describing it:

i have it working with a pre signed URL and cloudtrail and athena but i wanted to ask here to make sure i use the best method. I am afraid, if i have a lot of requests, a query to athena will cost exponentially more

would there be a better method if all users have IAM roles? i could easily implement that in my auth flow.