AWS IAM documentation change
Summary
Updated documentation about AWS STS CloudTrail logging to reflect current implementation status of endpointType and awsServingRegion fields instead of future plans
Security assessment
Adds documentation about enhanced CloudTrail logging capabilities that improve visibility into STS endpoint usage. While not addressing a specific vulnerability, improved logging supports security monitoring and incident response.
Diff
diff --git a/IAM/latest/UserGuide/cloudtrail-integration.md b/IAM/latest/UserGuide/cloudtrail-integration.md index 4ed37ccf2..fc05e18ff 100644 --- a//IAM/latest/UserGuide/cloudtrail-integration.md +++ b//IAM/latest/UserGuide/cloudtrail-integration.md @@ -560 +560 @@ The CloudTrail log entry also contains an `additionalEventData` field with an `i -Starting in early 2025, AWS is making changes to the AWS Security Token Service (AWS STS) global endpoint (`https://sts.amazonaws.com`) to enhance its resiliency and performance. As part of these changes, AWS STS will start including additional AWS CloudTrail log fields `endpointType` and `awsServingRegion` under the `RequestDetails` element to log the serving AWS Region and endpoint type being called under the `addtionalEventData` element. The `endpointType` field can have a value of `global` or `regional` to indicate the type of global endpoint that served the request. For more information about the AWS STS global endpoint changes, see [AWS STS Regions and endpoints](./id_credentials_temp_region-endpoints.html). +For requests to the AWS Security Token Service (AWS STS) global endpoint (`https://sts.amazonaws.com`), AWS STS includes additional AWS CloudTrail log fields: `endpointType` and `awsServingRegion`. These fields appear under the `addtionalEventData` `RequestDetails` element to log the serving AWS Region and endpoint type being called. The `endpointType` field can have a value of `global` or `regional` to indicate the type of global endpoint that served the request. For more information about the AWS STS global endpoint changes, see [AWS STS Regions and endpoints](./id_credentials_temp_region-endpoints.html).