AWS awscloudtrail documentation change
Summary
Added documentation for new 'put-event-configuration' and 'get-event-configuration' CLI commands to manage event size expansion, resource tag keys, and IAM global condition keys in CloudTrail events
Security assessment
The changes document new capabilities to include IAM global condition keys and resource tags in audit events, which improves security visibility but does not address a specific vulnerability. The note about requiring 'Large' event size for key inclusion is operational guidance rather than a security fix.
Diff
diff --git a/awscloudtrail/latest/userguide/lake-cli-manage-eds.md b/awscloudtrail/latest/userguide/lake-cli-manage-eds.md index bd58d8e23..b49500193 100644 --- a//awscloudtrail/latest/userguide/lake-cli-manage-eds.md +++ b//awscloudtrail/latest/userguide/lake-cli-manage-eds.md @@ -5 +5 @@ -Get an event data store with the AWS CLIList all event data stores in an account with the AWS CLIGet the resource-based policy for an event data store with the AWS CLIAttach a resource-based policy to an event data store with the AWS CLIDelete the resource-based policy attached to an event data store with the AWS CLIStop ingestion on an event data store with the AWS CLIStart ingestion on an event data store with the AWS CLIEnable federation on an event data storeDisable federation on an event data storeRestore an event data store with the AWS CLI +Get an event data store with the AWS CLIList all event data stores in an account with the AWS CLIAdd resource tag keys and IAM global conditions keys, and expand event sizeGet the event configuration for an event data storeGet the resource-based policy for an event data store with the AWS CLIAttach a resource-based policy to an event data store with the AWS CLIDelete the resource-based policy attached to an event data store with the AWS CLIStop ingestion on an event data store with the AWS CLIStart ingestion on an event data store with the AWS CLIEnable federation on an event data storeDisable federation on an event data storeRestore an event data store with the AWS CLI @@ -16,0 +17,4 @@ This section describes several other commands that you can run to get informatio + * Add resource tag keys and IAM global conditions keys, and expand event size + + * Get the event configuration for an event data store + @@ -123,0 +128,55 @@ The following is an example response. +## Add resource tag keys and IAM global conditions keys, and expand event size + +Run the AWS CLI `put-event-configuration` command to expand the maximum event size and add up to 50 resource tag keys and 50 IAM global condition keys to provide additional metadata about your events. + +The `put-event-configuration` command accepts the following arguments: + + * `--event-data-store` – Specify the ARN of the event data store or the ID suffix of the ARN. This parameter is required. + + * `--max-event-size` – Set to `Large` to set the maximum event size to 1 MB. By default, the value is `Standard`, which specifies a maximum event size of 256 KB. + +###### Note + +In order to add resource tag keys or IAM global conditions keys, you must set the event size to `Large` to ensure all of your added keys are included in the event. + + * `--context-key-selectors` – Specify the type of keys you want included in the events collected by your event data store. You can include resource tag keys and IAM global condition keys. Information about the added resource tags and IAM global condition keys is shown in the `eventContext` field in the event. For more information, see [Enrich CloudTrail events by adding resource tag keys and IAM global condition keys](./cloudtrail-context-events.html). + + * Set the `Type` to `TagContext` to pass in an array of up to 50 resource tag keys. If you add resource tags, CloudTrail events will include the selected tag keys associated with the resources that were involved in the API call. API events related to deleted resources will not have resource tags. + + * Set the `Type` to `RequestContext` to pass in an array of up to 50 IAM global condition keys. If you add IAM global condition keys, CloudTrail events will include information about the selected condition keys that were evaluated during the authorization process, including additional details about the principal, session, network, and the request itself. + + + + +The following example sets the maximum event size to `Large` and adds two resource tag keys `myTagKey1` and `myTagKey2`. + + + aws cloudtrail put-event-configuration \ + --event-data-store arn:aws:cloudtrail:us-east-1:123456789012:eventdatastore/EXAMPLE-f852-4e8f-8bd1-bcf6cEXAMPLE \ + --max-event-size Large \ + --context-key-selectors '[{"Type":"TagContext", "Equals":["myTagKey1","myTagKey2"]}]' + +The next example sets the maximum event size to `Large` and adds an IAM; global condition key (`aws:MultiFactorAuthAge`). + + + aws cloudtrail put-event-configuration \ + --event-data-store arn:aws:cloudtrail:us-east-1:123456789012:eventdatastore/EXAMPLE-f852-4e8f-8bd1-bcf6cEXAMPLE \ + --max-event-size Large \ + --context-key-selectors '[{"Type":"RequestContext", "Equals":["aws:MultiFactorAuthAge"]}]' + +The final example removes all resource tag keys and IAM global condition keys and sets the maximum event size to `Standard`. + + + aws cloudtrail put-event-configuration \ + --event-data-store arn:aws:cloudtrail:us-east-1:123456789012:eventdatastore/EXAMPLE-f852-4e8f-8bd1-bcf6cEXAMPLE \ + --max-event-size Standard \ + --context-key-selectors + +## Get the event configuration for an event data store + +Run the AWS CLI `get-event-configuration` command to return the event configuration for an event data store that collects CloudTrail events. This command returns the maximum event size and lists the resource tag keys and IAM global condition keys (if any) that are included in CloudTrail events. + + + aws cloudtrail get-event-configuration \ + --event-data-store arn:aws:cloudtrail:us-east-1:123456789012:eventdatastore/EXAMPLE-f852-4e8f-8bd1-bcf6cEXAMPLE +