AWS awscloudtrail documentation change
Summary
Reorganized content structure and expanded documentation for CloudTrail Lake integrations with external event sources
Security assessment
Added documentation about logging external user activity via integrations enhances security visibility capabilities, but does not address a specific security vulnerability
Diff
diff --git a/awscloudtrail/latest/userguide/cloudtrail-lake.md index 518718878..9c3635441 100644 --- a/awscloudtrail/latest/userguide/cloudtrail-lake.md +++ b/awscloudtrail/latest/userguide/cloudtrail-lake.md @@ -5 +5 @@ -CloudTrail Lake event data storesCloudTrail Lake queriesCloudTrail Lake dashboardsAdditional resourcesCloudTrail Lake integrations +CloudTrail Lake event data storesCloudTrail Lake queriesCloudTrail Lake dashboardsCloudTrail Lake integrationsAdditional resources @@ -61,0 +62,8 @@ For more information, see [CloudTrail Lake dashboards](./lake-dashboard.html). +## CloudTrail Lake integrations + +You can use CloudTrail Lake _integrations_ to log and store user activity data from outside of AWS; from any source in your hybrid environments, such as in-house or SaaS applications hosted on-premises or in the cloud, virtual machines, or containers. After you create event data stores in CloudTrail Lake and create a channel to log activity events, you call the `PutAuditEvents` API to ingest your application activity into CloudTrail. You can then use CloudTrail Lake to search, query, and analyze the data that is logged from your applications. + +Integrations can also log events to your event data stores from over a dozen CloudTrail partners. In a partner integration, you create destination event data stores, a channel, and a resource policy. After you create the integration, you provide the channel ARN to the partner. There are two types of integrations: direct and solution. With direct integrations, the partner calls the `PutAuditEvents` API to deliver events to the event data store for your AWS account. With solution integrations, the application runs in your AWS account and the application calls the `PutAuditEvents` API to deliver events to the event data store for your AWS account. + +For more information about integrations, see [Create an integration with an event source outside of AWS](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/query-event-data-store-integration.html). + @@ -89,8 +96,0 @@ The following resources can help you get a better understanding of what CloudTra -## CloudTrail Lake integrations - -You can use CloudTrail Lake _integrations_ to log and store user activity data from outside of AWS; from any source in your hybrid environments, such as in-house or SaaS applications hosted on-premises or in the cloud, virtual machines, or containers. After you create event data stores in CloudTrail Lake and create a channel to log activity events, you call the `PutAuditEvents` API to ingest your application activity into CloudTrail. You can then use CloudTrail Lake to search, query, and analyze the data that is logged from your applications. - -Integrations can also log events to your event data stores from over a dozen CloudTrail partners. In a partner integration, you create destination event data stores, a channel, and a resource policy. After you create the integration, you provide the channel ARN to the partner. There are two types of integrations: direct and solution. With direct integrations, the partner calls the `PutAuditEvents` API to deliver events to the event data store for your AWS account. With solution integrations, the application runs in your AWS account and the application calls the `PutAuditEvents` API to deliver events to the event data store for your AWS account. - -For more information about integrations, see [Create an integration with an event source outside of AWS](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/query-event-data-store-integration.html). -