AWS AWSCloudFormation documentation change
Summary
Expanded field support for CloudTrail data events, updated documentation for eventSource, eventType, sessionCredentialFromConsole, and userIdentity.arn fields to clarify usage across trails and event data stores
Security assessment
Enhanced documentation of security-related logging features (user identity tracking, session credentials) but no evidence of addressing a specific vulnerability. Adds clarification about security monitoring capabilities.
Diff
diff --git a/AWSCloudFormation/latest/UserGuide/aws-properties-cloudtrail-eventdatastore-advancedfieldselector.md b/AWSCloudFormation/latest/UserGuide/aws-properties-cloudtrail-eventdatastore-advancedfieldselector.md index a56c4db8d..857dacb2a 100644 --- a//AWSCloudFormation/latest/UserGuide/aws-properties-cloudtrail-eventdatastore-advancedfieldselector.md +++ b//AWSCloudFormation/latest/UserGuide/aws-properties-cloudtrail-eventdatastore-advancedfieldselector.md @@ -84 +84 @@ For CloudTrail management events, supported fields include `eventCategory` (requ -For CloudTrail data events, supported fields include `eventCategory` (required), `resources.type` (required), `eventName`, `readOnly`, and `resources.ARN`. The following additional fields are available for event data stores: `eventSource`, `eventType`, `sessionCredentialFromConsole`, and `userIdentity.arn`. +For CloudTrail data events, supported fields include `eventCategory` (required), `eventName`, `eventSource`, `eventType`, `resources.type` (required), `readOnly`, `resources.ARN`, `sessionCredentialFromConsole`, and `userIdentity.arn`. @@ -96 +96 @@ Selectors don't support the use of wildcards like `*` . To match multiple values - * **`eventSource` ** \- This field is only used for management events, data events (for event data stores only), and network activity events. + * **`eventSource` ** \- This field is only used for management events, data events, and network activity events. @@ -100 +100,3 @@ For management events for trails, this is an optional field that can be set to ` -For management and data events for event data stores, you can use it to include or exclude any event source and can use any operator. +For data events for trails, this is an optional field that you can use to include or exclude any event source and can use any operator. + +For management and data events for event data stores, this is an optional field that you can use to include or exclude any event source and can use any operator. @@ -124 +126 @@ The following are used only for event data stores: - * **`eventType` ** \- This is an optional field available only for event data stores, which is used to filter management and data events on the event type. For information about available event types, see [CloudTrail record contents](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-record-contents.html#ct-event-type) in the _AWS CloudTrail user guide_. + * **`eventType` ** \- For event data stores, this is an optional field available for event data stores to filter management and data events on the event type. For trails, this is an optional field to filter data events on the event type. For information about available event types, see [CloudTrail record contents](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-record-contents.html#ct-event-type) in the _AWS CloudTrail user guide_. @@ -128 +130 @@ The following are used only for event data stores: - * **`sessionCredentialFromConsole` ** \- This is an optional field available only for event data stores, which is used to filter management and data events based on whether the events originated from an AWS Management Console session. `sessionCredentialFromConsole` can only use the `Equals` and `NotEquals` operators. + * **`sessionCredentialFromConsole` ** \- For event data stores, this is an optional field used to filter management and data events based on whether the events originated from an AWS Management Console session. For trails, this is an optional field used to filter data events. `sessionCredentialFromConsole` can only use the `Equals` and `NotEquals` operators. @@ -144 +146 @@ You can't use the `resources.ARN` field to filter resource types that do not hav - * **`userIdentity.arn` ** \- This is an optional field available only for event data stores, which is used to filter management and data events on the userIdentity ARN. You can use any operator with `userIdentity.arn`. For more information on the userIdentity element, see [CloudTrail userIdentity element](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-user-identity.html) in the _AWS CloudTrail User Guide_. + * **`userIdentity.arn` ** \- For event data stores, this is an optional field used to filter management and data events for actions taken by specific IAM identities. For trails, this is an optional field used to filter data events. You can use any operator with `userIdentity.arn`. For more information on the userIdentity element, see [CloudTrail userIdentity element](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-user-identity.html) in the _AWS CloudTrail User Guide_.