AWS awscloudtrail documentation change
Summary
Updated documentation to restructure filtering examples, add SES resource types, expand predefined log selector templates, and clarify advanced event selector fields for granular logging configuration
Security assessment
Added documentation for excluding AWS service events and filtering by userIdentity.arn/session credentials improves security monitoring capabilities. However, there's no evidence of addressing a specific vulnerability.
Diff
diff --git a/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.md b/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.md index e83ab93fd..46f28a7c4 100644 --- a//awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.md +++ b//awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.md @@ -50 +50 @@ The events that are logged by your trails are available in Amazon EventBridge. F - * [Log events by using advanced event selectors](./logging-data-events-with-cloudtrail.html#creating-data-event-selectors-advanced) + * [Log data events for trails by using advanced event selectors](./logging-data-events-with-cloudtrail.html#creating-data-event-selectors-advanced) @@ -70 +70 @@ The events that are logged by your trails are available in Amazon EventBridge. F - * [Filtering data events by eventName](./filtering-data-events.html#filtering-data-events-eventname) + * [AWS CLI examples for filtering data events](./filtering-data-events.html#filtering-data-events-examples) @@ -72 +72 @@ The events that are logged by your trails are available in Amazon EventBridge. F - * [Filtering data events by eventName using the AWS Management Console](./filtering-data-events.html#filtering-data-events-eventname-console) + * [Example 1: Filtering on the eventName field](./filtering-data-events.html#filtering-data-events-eventname) @@ -74,13 +74 @@ The events that are logged by your trails are available in Amazon EventBridge. F - * [Filtering data events by eventName using the AWS CLI](./filtering-data-events.html#filtering-data-events-eventname-cli) - - * [Filtering data events by resources.ARN](./filtering-data-events.html#filtering-data-events-resourcearn) - - * [Filtering data events by resources.ARN using the AWS Management Console](./filtering-data-events.html#filtering-data-events-resourcearn-console) - - * [Filtering data events by resources.ARN using the AWS CLI](./filtering-data-events.html#filtering-data-events-resourcearn-cli) - - * [Filtering data events by readOnly value](./filtering-data-events.html#filtering-data-events-readonly) - - * [Filtering data events by readOnly value using the AWS Management Console](./filtering-data-events.html#filtering-data-events-readonly-console) - - * [Filtering data events by readOnly value using the AWS CLI](./filtering-data-events.html#filtering-data-events-readonly-cli) + * [Example 2: Filtering on the resources.ARN and userIdentity.arn fields](./filtering-data-events.html#filtering-data-events-useridentityarn) @@ -215,0 +204,3 @@ Amazon SimpleDB | Amazon SimpleDB API activity on domains. | **SimpleDB domain** +Amazon Simple Email Service | Amazon Simple Email Service (Amazon SES) API activity on configuration sets. | **SES configuration set** | `AWS::SES::ConfigurationSet` +Amazon Simple Email Service | Amazon Simple Email Service (Amazon SES) API activity on email identities. | **SES identity** | `AWS::SES::EmailIdentity` +Amazon Simple Email Service | Amazon Simple Email Service (Amazon SES) API activity on templates. | **SES template** | `AWS::SES::Template` @@ -398 +389,13 @@ You can only enable data events on event data stores that contain CloudTrail eve - 7. Choose a log selector template. CloudTrail includes predefined templates that log all data events for the resource type. To build a custom log selector template, choose **Custom**. + 7. Choose a log selector template. You can choose a predefined template, or choose **Custom** to define your own event collection conditions. + +You can choose from the following predefined templates: + + * **Log all events** – Choose this template to log all events. + + * **Log only read events** – Choose this template to log only read events. Read-only events are events that do not change the state of a resource, such as `Get*` or `Describe*` events. + + * **Log only write events** – Choose this template to log only write events. Write events add, change, or delete resources, attributes, or artifacts, such as `Put*`, `Delete*`, or `Write*` events. + + * **Log only AWS Management Console events** – Choose this template to log only events originating from the AWS Management Console. + + * **Exclude AWS service initiated events** – Choose this template to exclude AWS service events, which have an `eventType` of `AwsServiceEvent`, and events initiated with AWS service-linked roles (SLRs). @@ -459 +462,13 @@ In the AWS Management Console, if your trail is using advanced event selectors, - 5. Choose a log selector template. CloudTrail includes predefined templates that log all data events for the resource type. To build a custom log selector template, choose **Custom**. + 5. Choose a log selector template. You can choose a predefined template, or choose **Custom** to define your own event collection conditions. + +You can choose from the following predefined templates: + + * **Log all events** – Choose this template to log all events. + + * **Log only read events** – Choose this template to log only read events. Read-only events are events that do not change the state of a resource, such as `Get*` or `Describe*` events. + + * **Log only write events** – Choose this template to log only write events. Write events add, change, or delete resources, attributes, or artifacts, such as `Put*`, `Delete*`, or `Write*` events. + + * **Log only AWS Management Console events** – Choose this template to log only events originating from the AWS Management Console. + + * **Exclude AWS service initiated events** – Choose this template to exclude AWS service events, which have an `eventType` of `AwsServiceEvent`, and events initiated with AWS service-linked roles (SLRs). @@ -484,0 +500,8 @@ Selectors don't support the use of wildcards like `*` . To match multiple values + * **`eventSource`** – The event source to include or exclude. This field can use any operator. + + * **eventType** – The event type to include or exclude. For example, you can set this field to **not equals** `AwsServiceEvent` to exclude [AWS service events](./non-api-aws-service-events.html). For a list of event types, see [eventType](./cloudtrail-event-reference-record-contents.html#ct-event-type) in [CloudTrail record contents for management, data, and network activity events](./cloudtrail-event-reference-record-contents.html). + + * **sessionCredentialFromConsole** – Include or exclude events originating from an AWS Management Console session. This field can be set to **equals** or **not equals** with a value of `true`. + + * **userIdentity.arn** – Include or exclude events for actions taken by specific IAM identities. For more information, see [CloudTrail userIdentity element](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-user-identity.html). + @@ -616 +639 @@ To log additional resource types, you'll need to use advanced event selectors. T - * You can use advanced event selectors to filter based on the value of the `eventName`, `resources.ARN`, and `readOnly` fields, giving you the ability to log only the data events of interest. For more information about configuring these fields, see [AdvancedFieldSelector](https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_AdvancedFieldSelector.html) in the _AWS CloudTrail API Reference_ and [Filtering data events by using advanced event selectors](./filtering-data-events.html) in this topic. + * You can use advanced event selectors to filter based on the value of the [supported advanced event selector fields](./filtering-data-events.html)supported advanced event selector fields, giving you the ability to log only the data events of interest. For more information about configuring these fields, see [AdvancedFieldSelector](https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_AdvancedFieldSelector.html) in the _AWS CloudTrail API Reference_ and [Filtering data events by using advanced event selectors](./filtering-data-events.html) in this guide. @@ -630 +653 @@ The command returns the event selectors for the trail. - * Log events by using advanced event selectors + * Log data events for trails by using advanced event selectors @@ -641 +664 @@ The command returns the event selectors for the trail. -#### Log events by using advanced event selectors +#### Log data events for trails by using advanced event selectors @@ -888,24 +911 @@ You can configure your event data stores to include data events using the AWS CL -You configure advanced event selectors to log data events on an event data store. - -The following advanced event selector fields are supported for logging data events on event data stores: - - * **`eventCategory`** – You must set `eventCategory` equal to `Data` to log data events. This is a required field. - - * **resources.type** – This field is used to select the resource type for which you want to log data events. The Data events table shows the possible values. This field can only use the `Equals` operator and is required. - - * **`eventName`** \- `eventName` can use any operator. You can use it to include or exclude any data event, such as `PutBucket` or `DeleteObject`. - - * **`eventSource`** – You can use it to include or exclude specific event sources. The `eventSource` is typically a short form of the service name without spaces plus `.amazonaws.com`. For example, you could set `eventSource` `Equals` to `ec2.amazonaws.com` to log only Amazon EC2 management events. - - * **`eventType`** – The [eventType](./cloudtrail-event-reference-record-contents.html#ct-event-type) to include or exclude. For example, you can set this field to `NotEquals` `AwsServiceEvent` to exclude [AWS service events](./non-api-aws-service-events.html). - - * **`readOnly`** \- `readOnly` can be set to `Equals` a value of `true` or `false`. When it is set to `false`, the event data store logs Write-only data events. Read-only data events are events that do not change the state of a resource, such as `Get*` or `Describe*` events. Write events add, change, or delete resources, attributes, or artifacts, such as `Put*`, `Delete*`, or `Write*` events. To log both **Read** and **Write** events, don't add a `readOnly` selector. - - * **`resources.ARN`** – You can use any operator with `resources.ARN`, but if you use `Equals` or `NotEquals`, the value must exactly match the ARN of a valid resource of the type you've specified in the template as the value of `resources.type`. - - * **`userIdentity.arn`** – Include or exclude events for actions taken by specific IAM identities. For more information, see [CloudTrail userIdentity element](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-user-identity.html). - - * **`sessionCredentialFromConsole`** – Include or exclude events originating from an AWS Management Console session. This field can be set to `Equals` or `NotEquals` with a value of `true`. - - - +You configure advanced event selectors to log data events on an event data store. For a list of supported fields, see [Filtering data events by using advanced event selectors](./filtering-data-events.html).