AWS awscloudtrail medium security documentation change
Summary
Replaced region-specific SNS policy example with guidance to use CloudTrail service principal for cross-region support
Security assessment
Addresses potential security monitoring gaps by promoting use of service principal instead of manual account ID updates, preventing misconfigurations that could lead to missing security notifications. Directly improves security posture through better permission practices.
Diff
diff --git a/awscloudtrail/latest/userguide/cloudtrail-permissions-for-sns-notifications.md b/awscloudtrail/latest/userguide/cloudtrail-permissions-for-sns-notifications.md index 7eaf32096..bf3e2498c 100644 --- a/awscloudtrail/latest/userguide/cloudtrail-permissions-for-sns-notifications.md +++ b/awscloudtrail/latest/userguide/cloudtrail-permissions-for-sns-notifications.md @@ -221,29 +221 @@ When you create a new topic as part of creating or updating a trail, CloudTrail -If CloudTrail is not sending notifications for a Region, it's possible that your topic has an older policy that specifies CloudTrail account IDs for each Region. This policy gives CloudTrail permission to send notifications only for the Regions specified. - -The following topic policy allows CloudTrail to send notifications for the specified nine Regions only: - -###### Example topic policy with account IDs - - - { - "Version": "2012-10-17", - "Statement": [{ - "Sid": "AWSCloudTrailSNSPolicy20131101", - "Effect": "Allow", - "Principal": {"AWS": [ - "arn:aws:iam::903692715234:root", - "arn:aws:iam::035351147821:root", - "arn:aws:iam::859597730677:root", - "arn:aws:iam::814480443879:root", - "arn:aws:iam::216624486486:root", - "arn:aws:iam::086441151436:root", - "arn:aws:iam::388731089494:root", - "arn:aws:iam::284668455005:root", - "arn:aws:iam::113285607260:root" - ]}, - "Action": "SNS:Publish", - "Resource": "aws:arn:sns:us-east-1:123456789012:myTopic" - }] - } - -This policy uses a permission based on individual CloudTrail account IDs. To deliver logs for a new Region, you must manually update the policy to include the CloudTrail account ID for that Region. For example, because CloudTrail added support for the US East (Ohio) Region, you must update the policy to add the account ID ARN for that Region: `"arn:aws:iam::475085895292:root"`. +If CloudTrail is not sending notifications for a Region, it's possible that your topic has an older policy that specifies CloudTrail account IDs for each Region. This type of policy gives CloudTrail permission to send notifications only for the Regions specified. @@ -253 +225 @@ As a best practice, update the policy to use a permission with the CloudTrail se -This gives CloudTrail permission to send notifications for current and new Regions. The following is an updated version of the previous policy: +The following example policy gives CloudTrail permission to send notifications for current and new Regions: