AWS iot-mi documentation change
Summary
Removed section about CloudTrail data events for SNS resources and added detailed CloudTrail event examples for StartDeviceDiscovery API including security headers and access denied scenario
Security assessment
Added examples demonstrate security headers (Content-Security-Policy, X-Content-Type-Options) and show access control enforcement through AccessDenied events, but there's no evidence this addresses a specific vulnerability
Diff
diff --git a/iot-mi/latest/devguide/logging-using-cloudtrail.md b/iot-mi/latest/devguide/logging-using-cloudtrail.md index f1832a670..72fa97784 100644 --- a//iot-mi/latest/devguide/logging-using-cloudtrail.md +++ b//iot-mi/latest/devguide/logging-using-cloudtrail.md @@ -5 +5 @@ -Data events in CloudTrailManagement events in CloudTrailEvent examples +Management events in CloudTrailEvent examples @@ -44,26 +43,0 @@ CloudTrail Lake event data stores and queries incur costs. When you create an ev -## Data events in CloudTrail - -[Data events](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html#logging-data-events) provide information about the resource operations performed on or in a resource (for example, reading or writing to an Amazon S3 object). These are also known as data plane operations. Data events are often high-volume activities. By default, CloudTrail doesn’t log data events. The CloudTrail **Event history** doesn't record data events. - -Additional charges apply for data events. For more information about CloudTrail pricing, see [AWS CloudTrail Pricing](https://aws.amazon.com/cloudtrail/pricing/). - -You can log data events for the managed integrations resource types by using the CloudTrail console, AWS CLI, or CloudTrail API operations. For more information about how to log data events, see [Logging data events with the AWS Management Console](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html#logging-data-events-console) and [Logging data events with the AWS Command Line Interface](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html#creating-data-event-selectors-with-the-AWS-CLI) in the _AWS CloudTrail User Guide_. - -The following table lists the managed integrations resource types for which you can log data events. The **Resource type (console)** column shows the value to choose from the **Resource type** list on the CloudTrail console. The **resources.type value** column shows the `resources.type` value, which you would specify when configuring advanced event selectors using the AWS CLI or CloudTrail APIs. The **Data APIs logged to CloudTrail** column shows the API calls logged to CloudTrail for the resource type. - -Resource type (console) | resources.type value | Data APIs logged to CloudTrail ----|---|--- -**SNS topic** | `AWS::SNS::Topic` | - - * [Publish](https://docs.aws.amazon.com/sns/latest/api/API_Publish.html) - * [PublishBatch](https://docs.aws.amazon.com/sns/latest/api/API_PublishBatch.html) - - -**SNS platform endpoint** | `AWS::SNS::PlatformEndpoint` | - - * [Publish](https://docs.aws.amazon.com/sns/latest/api/API_Publish.html) - - - -You can configure advanced event selectors to filter on the `eventName`, `readOnly`, and `resources.ARN` fields to log only those events that are important to you. For more information about these fields, see [AdvancedFieldSelector](https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_AdvancedFieldSelector.html) in the _AWS CloudTrail API Reference_. - @@ -80,4 +54,108 @@ An event represents a single request from any source and includes information ab -The following example shows a CloudTrail event that demonstrates the operation. - - - +The following example shows a CloudTrail event that demonstrates the `StartDeviceDiscovery` API operation. + +**Successful CloudTrail event with the`StartDeviceDiscovery` API operation.** + + + { + "eventVersion": "1.09", + "userIdentity": { + "type": "AssumedRole", + "principalId": "AROA47CRX4JX4AEXAMPLE", + "arn": "arn:aws:sts::123456789012:assumed-role/Admin/EXAMPLE", + "accountId": "222222222222", + "accessKeyId": "access-key-id", + "sessionContext": { + "sessionIssuer": { + "type": "Role", + "principalId": "AROA47CRX4JXUNEXAMPLE", + "arn": "arn:aws:iam::123456789012:role/Admin", + "accountId": "222222222222", + "userName": "Admin" + }, + "attributes": { + "creationDate": "2025-02-26T20:04:25Z", + "mfaAuthenticated": "false" + } + } + }, + "eventTime": "2025-02-26T20:11:33Z", + "eventSource": "gamma-iotmanagedintegrations.amazonaws.com", + "eventName": "StartDeviceDiscovery", + "awsRegion": "us-east-1", + "sourceIPAddress": "15.248.7.123", + "userAgent": "aws-sdk-java/2.30.21 md/io#sync md/http#Apache ua/2.1 os/Mac_OS_X#15.3.1 lang/java#17.0.13 md/OpenJDK_64-Bit_Server_VM#17.0.13+11-LTS md/vendor#Amazon.com_Inc. md/en_US cfg/auth-source#stat m/D,N", + "requestParameters": { + "DiscoveryType": "ZIGBEE", + "ControllerIdentifier": "554a1e3f7c884e67a21e0cabac3a48e3" + }, + "responseElements": { + "X-Frame-Options": "DENY", + "Access-Control-Expose-Headers": "Content-Length,Content-Type,X-Amzn-Errortype,X-Amzn-Requestid", + "Strict-Transport-Security": "max-age:47304000; includeSubDomains", + "Cache-Control": "no-store, no-cache", + "X-Content-Type-Options": "nosniff", + "Content-Security-Policy": "upgrade-insecure-requests; default-src 'none'; object-src 'none'; frame-ancestors 'none'; base-uri 'none'", + "Pragma": "no-cache", + "Id": "717023e159264ec5ba97293e4d884d3a", + "StartedAt": 1740600693.789, + "Arn": "arn:aws:iotmanagedintegrations::123456789012:device-discovery/717023e159264ec5ba97293e4d884d3a" + }, + "requestID": "29aa09b9-ad0e-42dc-8b7f-565a1a56c020", + "eventID": "d8d0a6ab-b729-4aa5-8af0-9f605ee90d0f", + "readOnly": false, + "eventType": "AwsApiCall", + "managementEvent": true, + "recipientAccountId": "123456789012", + "eventCategory": "Management" + } + + +**Access denied CloudTrail event with the`StartDeviceDiscovery` API operation.** + + + { + "eventVersion": "1.09", + "userIdentity": { + "type": "AssumedRole", + "principalId": "AROA47CRX4JX4AEXAMPLE", + "arn": "arn:aws:sts::123456789012:assumaDMINed-role/EXAMPLEExplicitDenyRole/EXAMPLE", + "accountId": "222222222222", + "accessKeyId": "access-key-id", + "sessionContext": { + "sessionIssuer": { + "type": "Role", + "principalId": "AROA47CRX4JXUNEXAMPLE", + "arn": "arn:aws:iam::123456789012:role/EXAMPLEExplicitDenyRole", + "accountId": "222222222222", + "userName": "EXAMPLEExplicitDenyRole" + }, + "attributes": { + "creationDate": "2025-02-27T21:36:55Z", + "mfaAuthenticated": "false" + } + }, + "invokedBy": "AWS Internal" + }, + "eventTime": "2025-02-27T21:37:01Z", + "eventSource": "gamma-iotmanagedintegrations.amazonaws.com", + "eventName": "StartDeviceDiscovery", + "awsRegion": "us-east-1", + "sourceIPAddress": "AWS Internal", + "userAgent": "AWS Internal", + "errorCode": "AccessDenied", + "requestParameters": { + "DiscoveryType": "CLOUD", + "ClientToken": "ClientToken", + "ConnectorAssociationIdentifier": "ConnectorAssociation" + }, + "responseElements": { + "message": "User: arn:aws:sts::123456789012:assumed-role/EXAMPLEExplicitDenyRole/EXAMPLE is not authorized to perform: iotmanagedintegrations:StartDeviceDiscovery on resource: arn:aws:iotmanagedintegrations:us-east-1:123456789012:/device-discoveries with an explicit deny" + }, + "requestID": "5eabd798-d79c-4d76-a5dd-115be230d77a", + "eventID": "cc75660c-f628-462a-9e6e-83dab40c5246", + "readOnly": false, + "eventType": "AwsApiCall", + "managementEvent": true, + "recipientAccountId": "123456789012", + "eventCategory": "Management" + }