AWS awscloudtrail documentation change
Summary
Clarified that attribute values in Insights event records contain only one value per attribute type
Security assessment
This is a documentation clarification about data formatting in logs. No security implications or security feature additions are present.
Diff
diff --git a/awscloudtrail/latest/userguide/cloudtrail-insights-fields-trails.md b/awscloudtrail/latest/userguide/cloudtrail-insights-fields-trails.md index bde6973f9..c3055f5f2 100644 --- a//awscloudtrail/latest/userguide/cloudtrail-insights-fields-trails.md +++ b//awscloudtrail/latest/userguide/cloudtrail-insights-fields-trails.md @@ -143 +143 @@ AWS CloudTrail Insights event records for trails include fields that are differe - * **`attribute`** – Contains the attribute type. Value can be `userIdentityArn`, `userAgent`, or `errorCode`. + * **`attribute`** – Contains the attribute type. Value can be `userIdentityArn`, `userAgent`, or `errorCode`. If present, these values will appear only once in an individual attribute. Different attribute values can have different `userIdentityArn`, `userAgent`, or `errorCode` values, but each attribute instance will contain only one value for `userIdentityArn`, `userAgent`, or `errorCode`.