AWS AWSCloudFormation documentation change
Summary
Updated documentation for CloudTrail advanced field selectors to expand supported fields for trails and clarify usage of eventSource, eventType, sessionCredentialFromConsole, and userIdentity.arn across both trails and event data stores
Security assessment
The changes enhance documentation about filtering capabilities for security-relevant fields like console session origins (sessionCredentialFromConsole) and IAM identity tracking (userIdentity.arn), but there's no evidence of addressing a specific vulnerability or incident
Diff
diff --git a/AWSCloudFormation/latest/UserGuide/aws-properties-cloudtrail-trail-advancedfieldselector.md b/AWSCloudFormation/latest/UserGuide/aws-properties-cloudtrail-trail-advancedfieldselector.md index 8ba1b32b8..78ea96d1d 100644 --- a//AWSCloudFormation/latest/UserGuide/aws-properties-cloudtrail-trail-advancedfieldselector.md +++ b//AWSCloudFormation/latest/UserGuide/aws-properties-cloudtrail-trail-advancedfieldselector.md @@ -84 +84 @@ For CloudTrail management events, supported fields include `eventCategory` (requ -For CloudTrail data events, supported fields include `eventCategory` (required), `resources.type` (required), `eventName`, `readOnly`, and `resources.ARN`. The following additional fields are available for event data stores: `eventSource`, `eventType`, `sessionCredentialFromConsole`, and `userIdentity.arn`. +For CloudTrail data events, supported fields include `eventCategory` (required), `eventName`, `eventSource`, `eventType`, `resources.type` (required), `readOnly`, `resources.ARN`, `sessionCredentialFromConsole`, and `userIdentity.arn`. @@ -96 +96 @@ Selectors don't support the use of wildcards like `*` . To match multiple values - * **`eventSource` ** \- This field is only used for management events, data events (for event data stores only), and network activity events. + * **`eventSource` ** \- This field is only used for management events, data events, and network activity events. @@ -100 +100,3 @@ For management events for trails, this is an optional field that can be set to ` -For management and data events for event data stores, you can use it to include or exclude any event source and can use any operator. +For data events for trails, this is an optional field that you can use to include or exclude any event source and can use any operator. + +For management and data events for event data stores, this is an optional field that you can use to include or exclude any event source and can use any operator. @@ -124 +126 @@ The following are used only for event data stores: - * **`eventType` ** \- This is an optional field available only for event data stores, which is used to filter management and data events on the event type. For information about available event types, see [CloudTrail record contents](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-record-contents.html#ct-event-type) in the _AWS CloudTrail user guide_. + * **`eventType` ** \- For event data stores, this is an optional field available for event data stores to filter management and data events on the event type. For trails, this is an optional field to filter data events on the event type. For information about available event types, see [CloudTrail record contents](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-record-contents.html#ct-event-type) in the _AWS CloudTrail user guide_. @@ -128 +130 @@ The following are used only for event data stores: - * **`sessionCredentialFromConsole` ** \- This is an optional field available only for event data stores, which is used to filter management and data events based on whether the events originated from an AWS Management Console session. `sessionCredentialFromConsole` can only use the `Equals` and `NotEquals` operators. + * **`sessionCredentialFromConsole` ** \- For event data stores, this is an optional field used to filter management and data events based on whether the events originated from an AWS Management Console session. For trails, this is an optional field used to filter data events. `sessionCredentialFromConsole` can only use the `Equals` and `NotEquals` operators. @@ -144 +146 @@ You can't use the `resources.ARN` field to filter resource types that do not hav - * **`userIdentity.arn` ** \- This is an optional field available only for event data stores, which is used to filter management and data events on the userIdentity ARN. You can use any operator with `userIdentity.arn`. For more information on the userIdentity element, see [CloudTrail userIdentity element](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-user-identity.html) in the _AWS CloudTrail User Guide_. + * **`userIdentity.arn` ** \- For event data stores, this is an optional field used to filter management and data events for actions taken by specific IAM identities. For trails, this is an optional field used to filter data events. You can use any operator with `userIdentity.arn`. For more information on the userIdentity element, see [CloudTrail userIdentity element](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-user-identity.html) in the _AWS CloudTrail User Guide_.