AWS awscloudtrail documentation change
Summary
Restructured documentation to remove region-specific availability list and add detailed VPC endpoint policy configuration examples. Added sections for creating VPC endpoints/policies and multiple policy examples demonstrating access control.
Security assessment
Changes focus on documenting security controls (VPC endpoint policies) but do not indicate remediation of a specific vulnerability. The added policy examples demonstrate security best practices for access management.
Diff
diff --git a/awscloudtrail/latest/userguide/cloudtrail-and-interface-VPC.md b/awscloudtrail/latest/userguide/cloudtrail-and-interface-VPC.md index aad774539..159ab3223 100644 --- a//awscloudtrail/latest/userguide/cloudtrail-and-interface-VPC.md +++ b//awscloudtrail/latest/userguide/cloudtrail-and-interface-VPC.md @@ -5 +5 @@ -AvailabilityCreate a VPC endpoint for CloudTrailShared subnets +RegionsCreate a VPC endpoint for CloudTrailCreate a VPC endpoint policy for CloudTrailShared subnets @@ -17 +17 @@ Interface VPC endpoints are powered by AWS PrivateLink, an AWS technology that e -The following steps are for users of Amazon VPC. For more information, see [Get started with Amazon VPC](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-getting-started.html) in the _Amazon VPC User Guide_. +The following sections are for users of Amazon VPC. For more information, see [Get started with Amazon VPC](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-getting-started.html) in the _Amazon VPC User Guide_. @@ -19 +19 @@ The following steps are for users of Amazon VPC. For more information, see [Get -## Availability +###### Topics @@ -21 +21 @@ The following steps are for users of Amazon VPC. For more information, see [Get -CloudTrail currently supports VPC endpoints in the following AWS Regions: + * Regions @@ -23 +23 @@ CloudTrail currently supports VPC endpoints in the following AWS Regions: - * US East (Ohio) + * Create a VPC endpoint for CloudTrail @@ -25 +25 @@ CloudTrail currently supports VPC endpoints in the following AWS Regions: - * US East (N. Virginia) + * Create a VPC endpoint policy for CloudTrail @@ -27 +27 @@ CloudTrail currently supports VPC endpoints in the following AWS Regions: - * US West (N. California) + * Shared subnets @@ -29 +28,0 @@ CloudTrail currently supports VPC endpoints in the following AWS Regions: - * US West (Oregon) @@ -31 +29,0 @@ CloudTrail currently supports VPC endpoints in the following AWS Regions: - * Africa (Cape Town) @@ -33 +30,0 @@ CloudTrail currently supports VPC endpoints in the following AWS Regions: - * Asia Pacific (Hong Kong) @@ -35 +32 @@ CloudTrail currently supports VPC endpoints in the following AWS Regions: - * Asia Pacific (Hyderabad) +## Regions @@ -37 +34 @@ CloudTrail currently supports VPC endpoints in the following AWS Regions: - * Asia Pacific (Jakarta) +AWS CloudTrail supports VPC endpoints and VPC endpoint policies in all AWS Regions in which CloudTrail is supported. @@ -39 +36 @@ CloudTrail currently supports VPC endpoints in the following AWS Regions: - * Asia Pacific (Malaysia) +## Create a VPC endpoint for CloudTrail @@ -41 +38 @@ CloudTrail currently supports VPC endpoints in the following AWS Regions: - * Asia Pacific (Melbourne) +To start using CloudTrail with your VPC, create an interface VPC endpoint for CloudTrail. For more information, see [Access an AWS service using an interface VPC endpoint](https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html#create-interface-endpoint.html) in the _Amazon VPC User Guide_. @@ -43 +40 @@ CloudTrail currently supports VPC endpoints in the following AWS Regions: - * Asia Pacific (Mumbai) +You don't need to change the settings for CloudTrail. CloudTrail calls other AWS services using either public endpoints or private interface VPC endpoints, whichever are in use. @@ -45 +42 @@ CloudTrail currently supports VPC endpoints in the following AWS Regions: - * Asia Pacific (Osaka) +## Create a VPC endpoint policy for CloudTrail @@ -47 +44 @@ CloudTrail currently supports VPC endpoints in the following AWS Regions: - * Asia Pacific (Seoul) +A VPC endpoint policy is an IAM resource that you can attach to an interface VPC endpoint. The default endpoint policy gives you full access to CloudTrail APIs through the interface VPC endpoint. To control the access granted to CloudTrail from your VPC, attach a custom endpoint policy to the interface VPC endpoint. @@ -49 +46 @@ CloudTrail currently supports VPC endpoints in the following AWS Regions: - * Asia Pacific (Singapore) +An endpoint policy specifies the following information: @@ -51 +48 @@ CloudTrail currently supports VPC endpoints in the following AWS Regions: - * Asia Pacific (Sydney) + * The principals that can perform actions (AWS accounts, IAM users, and IAM roles). @@ -53 +50 @@ CloudTrail currently supports VPC endpoints in the following AWS Regions: - * Asia Pacific (Thailand) + * The actions that can be performed. @@ -55 +52 @@ CloudTrail currently supports VPC endpoints in the following AWS Regions: - * Asia Pacific (Tokyo) + * The resources on which actions can be performed. @@ -57 +53,0 @@ CloudTrail currently supports VPC endpoints in the following AWS Regions: - * Canada (Central) @@ -59 +54,0 @@ CloudTrail currently supports VPC endpoints in the following AWS Regions: - * Canada West (Calgary) @@ -61 +55,0 @@ CloudTrail currently supports VPC endpoints in the following AWS Regions: - * China (Beijing) @@ -63 +57 @@ CloudTrail currently supports VPC endpoints in the following AWS Regions: - * China (Ningxia) +For more information about VPC endpoint policies, including how to update a policy, see [Controlling access to services with VPC endpoints](https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-access.html) in the _Amazon VPC User Guide_. @@ -65 +59 @@ CloudTrail currently supports VPC endpoints in the following AWS Regions: - * Europe (Frankfurt) +Following are examples of custom VPC endpoint policies for CloudTrail. @@ -67 +61 @@ CloudTrail currently supports VPC endpoints in the following AWS Regions: - * Europe (Ireland) +###### Example policies: @@ -69 +63 @@ CloudTrail currently supports VPC endpoints in the following AWS Regions: - * Europe (London) + * Example: Allow all CloudTrail actions @@ -71 +65 @@ CloudTrail currently supports VPC endpoints in the following AWS Regions: - * Europe (Milan) + * Example: Allow specific CloudTrail actions @@ -73 +67 @@ CloudTrail currently supports VPC endpoints in the following AWS Regions: - * Europe (Paris) + * Example: Deny all CloudTrail actions @@ -75 +69 @@ CloudTrail currently supports VPC endpoints in the following AWS Regions: - * Europe (Spain) + * Example: Deny specific CloudTrail actions @@ -77 +71 @@ CloudTrail currently supports VPC endpoints in the following AWS Regions: - * Europe (Stockholm) + * Example: Allow all CloudTrail actions from a specific VPC @@ -79 +73 @@ CloudTrail currently supports VPC endpoints in the following AWS Regions: - * Europe (Zurich) + * Example: Allow all CloudTrail actions from a specific VPC endpoint @@ -81 +74,0 @@ CloudTrail currently supports VPC endpoints in the following AWS Regions: - * Israel (Tel Aviv) @@ -83 +75,0 @@ CloudTrail currently supports VPC endpoints in the following AWS Regions: - * Mexico (Central) @@ -85 +76,0 @@ CloudTrail currently supports VPC endpoints in the following AWS Regions: - * Middle East (Bahrain) @@ -87 +78 @@ CloudTrail currently supports VPC endpoints in the following AWS Regions: - * Middle East (UAE) +### Example: Allow all CloudTrail actions @@ -89 +80 @@ CloudTrail currently supports VPC endpoints in the following AWS Regions: - * South America (São Paulo) +The following example VPC endpoint policy grants access to all CloudTrail actions for all principals on all resources. @@ -91 +81,0 @@ CloudTrail currently supports VPC endpoints in the following AWS Regions: - * AWS GovCloud (US-East) @@ -93 +83,11 @@ CloudTrail currently supports VPC endpoints in the following AWS Regions: - * AWS GovCloud (US-West) + { + "Version": "2012-10-17", + "Statement": [ + { + "Action": "cloudtrail:*", + "Effect": "Allow", + "Resource": "*", + "Principal": "*" + } + ] + } @@ -94,0 +95 @@ CloudTrail currently supports VPC endpoints in the following AWS Regions: +### Example: Allow specific CloudTrail actions @@ -95,0 +97 @@ CloudTrail currently supports VPC endpoints in the following AWS Regions: +The following example VPC endpoint policy grants access to perform the `cloudtrail:ListTrails` and `cloudtrail:ListEventDataStores` actions for all principals on all resources. @@ -98 +100,11 @@ CloudTrail currently supports VPC endpoints in the following AWS Regions: -## Create a VPC endpoint for CloudTrail + { + "Version": "2012-10-17", + "Statement": [ + { + "Action": ["cloudtrail:ListTrails", "cloudtrail:ListEventDataStores"], + "Effect": "Allow", + "Principal": "*", + "Resource": "*" + } + ] + } @@ -100 +112 @@ CloudTrail currently supports VPC endpoints in the following AWS Regions: -To start using CloudTrail with your VPC, create an interface VPC endpoint for CloudTrail. For more information, see [Access an AWS service using an interface VPC endpoint](https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html#create-interface-endpoint.html) in the _Amazon VPC User Guide_. +### Example: Deny all CloudTrail actions @@ -102 +114,74 @@ To start using CloudTrail with your VPC, create an interface VPC endpoint for Cl -You don't need to change the settings for CloudTrail. CloudTrail calls other AWS services using either public endpoints or private interface VPC endpoints, whichever are in use. +The following example VPC endpoint policy denies access to all CloudTrail actions for all principals on all resources. + + + { + "Version": "2012-10-17", + "Statement": [ + { + "Action": "cloudtrail:*", + "Effect": "Deny", + "Principal": "*", + "Resource": "*" + } + ] + } + +### Example: Deny specific CloudTrail actions + +The following example VPC endpoint policy denies the `cloudtrail:CreateTrail` and `cloudtrail:CreateEventDataStore` actions for all principals on all resources. + + + { + "Version": "2012-10-17", + "Statement": [ + { + "Action": ["cloudtrail:CreateTrail", "cloudtrail:CreateEventDataStore"], + "Effect": "Deny", + "Principal": "*", + "Resource": "*" + } + ] + } + +### Example: Allow all CloudTrail actions from a specific VPC + +The following example VPC endpoint policy grants access to perform all CloudTrail actions for all principals on all resources but only if the requester uses the specified VPC to make the request. Replace `vpc-id` with your VPC ID. + + + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": "cloudtrail:*", + "Resource": "*", + "Principal": "*", + "Condition": { + "StringEquals": { + "aws:SourceVpc": "vpc-id" + } + } + } + ] + } +