AWS managedservices documentation change

Service: managedservices · 2025-05-25 · Documentation low

File: managedservices/latest/accelerate-guide/acc-log-mgmt.md

Summary

Expanded list of log files collected by CloudWatch Agent including security-related logs (audit.log, auth.log, secure) and Windows event logs

Security assessment

While the change adds documentation about security-relevant logs (authentication, audit, Windows security events), this appears to be routine documentation of monitoring capabilities rather than addressing a specific security issue. The inclusion of security logs helps with auditing but doesn't indicate a security fix.

Diff

diff --git a/managedservices/latest/accelerate-guide/acc-log-mgmt.md b/managedservices/latest/accelerate-guide/acc-log-mgmt.md
index b66f34655..35d459c37 100644
--- a//managedservices/latest/accelerate-guide/acc-log-mgmt.md
+++ b//managedservices/latest/accelerate-guide/acc-log-mgmt.md
@@ -78,0 +79,31 @@ The following log files are sent to CloudWatch Logs, into a log group of the sam
+  * /var/log/amazon/ssm/amazon-ssm-agent.log
+
+  * /var/log/amazon/ssm/errors.log
+
+  * /var/log/audit/audit.log
+
+  * /var/log/auth.log
+
+  * /var/log/cloud-init-output.log
+
+  * /var/log/cron
+
+  * /var/log/dnf.log
+
+  * /var/log/dpkg.log
+
+  * /var/log/maillog
+
+  * /var/log/messages
+
+  * /var/log/secure
+
+  * /var/log/spooler
+
+  * /var/log/syslog
+
+  * /var/log/yum.log
+
+  * /var/log/zypper.log
+
+
@@ -80,15 +110,0 @@ The following log files are sent to CloudWatch Logs, into a log group of the sam
-    /var/log/amazon/ssm/amazon-ssm-agent.log
-    /var/log/amazon/ssm/errors.log
-    /var/log/audit/audit.log
-    /var/log/auth.log
-    /var/log/cloud-init-output.log
-    /var/log/cron
-    /var/log/dnf.log
-    /var/log/dpkg.log
-    /var/log/maillog
-    /var/log/messages
-    /var/log/secure
-    /var/log/spooler
-    /var/log/syslog
-    /var/log/yum.log
-    /var/log/zypper.log
@@ -99,0 +116,23 @@ For more information, see [Manually Create or Edit the CloudWatch Agent Configur
+  * AmazonSSMAgentLog
+
+  * AmazonCloudWatchAgentLog
+
+  * AmazonSSMErrorLog
+
+  * AmazonCloudFormationLog
+
+  * ApplicationEventLog
+
+  * EC2ConfigServiceEventLog
+
+  * MicrosoftWindowsAppLockerEXEAndDLLEventLog
+
+  * MicrosoftWindowsAppLockerMSIAndScriptEventLog
+
+  * MicrosoftWindowsGroupPolicyOperationalEventLog
+
+  * SecurityEventLog
+
+  * SystemEventLog
+
+
@@ -101,4 +139,0 @@ For more information, see [Manually Create or Edit the CloudWatch Agent Configur
-    C:\\ProgramData\\Amazon\\SSM\\Logs\\amazon-ssm-agent.log
-    C:\\ProgramData\\Amazon\\SSM\\Logs\\amazon-cloudwatch-agent.log
-    C:\\ProgramData\\Amazon\\SSM\\Logs\\errors.log
-    C:\\cfn\\log\\cfn-init.log