AWS healthimaging documentation change
Summary
Added documentation about DICOMweb WADO-RS API actions being classified as CloudTrail data events requiring opt-in, and formatting changes for emphasis
Security assessment
The change clarifies that DICOMweb API actions require explicit CloudTrail data event logging configuration. While this relates to audit logging (a security control), there's no evidence of addressing a specific vulnerability. The update improves security documentation by informing users about required logging configuration.
Diff
diff --git a/healthimaging/latest/devguide/logging-using-cloudtrail.md b/healthimaging/latest/devguide/logging-using-cloudtrail.md index e6d3ef468..3d376efa0 100644 --- a//healthimaging/latest/devguide/logging-using-cloudtrail.md +++ b//healthimaging/latest/devguide/logging-using-cloudtrail.md @@ -36 +36 @@ For an ongoing record of events in your AWS account, including events for Health -AWS HealthImaging supports two types of CloudTrail events — management events and data events. _Management events_ are the general events that every AWS service generates, including HealthImaging. By default, logging is applied to management events for every HealthImaging API call that has it enabled. _Data events_ are billable and generally reserved for APIs that have high transactions per second (tps), so you can opt out of having CloudTrail logs for cost purposes. +AWS HealthImaging supports two types of CloudTrail events — **management events** and **data events**. Management events are the general events that every AWS service generates, including HealthImaging. By default, logging is applied to management events for every HealthImaging API call that has it enabled. Data events are billable and generally reserved for APIs that have high transactions per second (tps), so you can opt out of having CloudTrail logs for cost purposes. @@ -38 +38,3 @@ AWS HealthImaging supports two types of CloudTrail events — management events -With HealthImaging, all API actions listed in the [_AWS HealthImaging API Reference_](https://docs.aws.amazon.com/healthimaging/latest/APIReference/) are considered management events with the exception of [`GetImageFrame`](https://docs.aws.amazon.com/healthimaging/latest/APIReference/API_GetImageFrame.html). The `GetImageFrame` action is onboarded with CloudTrail as a data event and therefore must be enabled. For more information, see [Logging data events](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html) in the _AWS CloudTrail User Guide_. +With HealthImaging, all native API actions listed in the [_AWS HealthImaging API Reference_](https://docs.aws.amazon.com/healthimaging/latest/APIReference/) are classified as management events with the exception of [`GetImageFrame`](https://docs.aws.amazon.com/healthimaging/latest/APIReference/API_GetImageFrame.html). The `GetImageFrame` action is onboarded with CloudTrail as a data event and therefore must be enabled. For more information, see [Logging data events](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html) in the _AWS CloudTrail User Guide_. + +DICOMweb WADO-RS API actions are classified as data events in CloudTrail, therefore, you must opt-in to them. For more information, see [Retrieving DICOM data from HealthImaging](./dicomweb-retrieve.html) and [Logging data events](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html) in the _AWS CloudTrail User Guide_.