AWS aurora-dsql medium security documentation change

Service: aurora-dsql · 2025-05-28 · Security-related medium

File: aurora-dsql/latest/userguide/logging-using-cloudtrail.md

Summary

Removed preview notice, restructured logging documentation, added Backup and restore logs section with AWS Backup integration, added AWS KMS operation logging details, updated section titles

Security assessment

Added documentation about logging AWS KMS operations (GenerateDataKey, Decrypt) which are security-sensitive cryptographic operations. Monitoring KMS interactions helps track encryption key usage patterns, which is a security best practice. The change explicitly documents security-related event logging capabilities.

Diff

diff --git a/aurora-dsql/latest/userguide/logging-using-cloudtrail.md b/aurora-dsql/latest/userguide/logging-using-cloudtrail.md
index 45b817f05..b08e85495 100644
--- a//aurora-dsql/latest/userguide/logging-using-cloudtrail.md
+++ b//aurora-dsql/latest/userguide/logging-using-cloudtrail.md
@@ -7,2 +6,0 @@ Management eventsData events
-Amazon Aurora DSQL is provided as a Preview service. To learn more, see [Betas and Previews ](https://aws.amazon.com/service-terms/) in the AWS Service Terms. 
-
@@ -13 +11 @@ Amazon Aurora DSQL is integrated with [AWS CloudTrail](https://docs.aws.amazon.c
-CloudTrail captures all API calls for Aurora DSQL as events. Aurora DSQL records console activity, including SDK and CLI calls, to API operations as management events. It also captures authenticated connection attempts to clusters as data events.
+CloudTrail captures all API calls for Aurora DSQL as events. Aurora DSQL records console activity as management events. It also captures authenticated connection attempts to clusters as data events.
@@ -26,0 +25,2 @@ Amazon Aurora DSQL logs all Aurora DSQL control plane operations as management e
+**Control plane logs**
+
@@ -31,2 +30,0 @@ Amazon Aurora DSQL logs the following Aurora DSQL control plane operations to Cl
-  * [CreateMultiRegionClusters](https://docs.aws.amazon.com/aurora-dsql/latest/APIReference/API_CreateMultiRegionClusters.html)
-
@@ -35,2 +32,0 @@ Amazon Aurora DSQL logs the following Aurora DSQL control plane operations to Cl
-  * [DeleteMultiRegionClusters](https://docs.aws.amazon.com/aurora-dsql/latest/APIReference/API_DeleteMultiRegionClusters.html)
-
@@ -53,0 +50,34 @@ Amazon Aurora DSQL logs the following Aurora DSQL control plane operations to Cl
+**Backup and restore logs**
+
+Amazon Aurora DSQL logs the following Aurora DSQL backup and restore operations to CloudTrail as management events. 
+
+  * `StartBackupJob`
+
+  * `StopBackupJob`
+
+  * `GetBackupJob`
+
+  * `StartRestoreJob`
+
+  * `StopRestoreJob`
+
+  * `GetRestoreJob`
+
+
+
+
+For more on protecting your Aurora DSQL clusters using AWS Backup, see [Backup and restore for Amazon Aurora DSQL](./backup-aurora-dsql.html) .
+
+**AWS KMS** logs
+
+Amazon Aurora DSQL logs the following AWS KMS operations to CloudTrail as management events.
+
+  * `GenerateDataKey`
+
+  * `Decrypt`
+
+
+
+
+To learn more about how CloudTrail logs track requests that Aurora DSQL sends to AWS KMS on your behalf, see [Monitoring Aurora DSQL interaction with AWS KMS](./data-encryption.html#monitoring-dsql-kms-interaction).
+
@@ -93 +123 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please
-Logging with CloudTrail
+Monitoring with CloudWatch
@@ -95 +125 @@ Logging with CloudTrail
-Tagging resources
+Security