AWS awscloudtrail documentation change
Summary
Enhanced documentation for CloudTrail event data store configuration by adding predefined log selector templates, event enrichment options with resource tags/IAM condition keys, and expanded event size capabilities
Security assessment
The changes add documentation about granular logging controls (like excluding AWS service events) and event enrichment with security-relevant metadata (IAM condition keys/resource tags). While these improve audit capabilities and contextual analysis for security teams, there is no evidence of addressing a specific vulnerability or security incident.
Diff
diff --git a/awscloudtrail/latest/userguide/query-event-data-store-cloudtrail.md b/awscloudtrail/latest/userguide/query-event-data-store-cloudtrail.md index 84762f3b4..79878e0d5 100644 --- a//awscloudtrail/latest/userguide/query-event-data-store-cloudtrail.md +++ b//awscloudtrail/latest/userguide/query-event-data-store-cloudtrail.md @@ -185 +185,13 @@ If you choose to enable Insights, do the following. - 2. In **Log selector template** , choose a template. You can choose to log all data events, `readOnly` events, `writeOnly` events, or **Custom** to build a custom log selector. + 2. In **Log selector template** , choose a predefined template, or choose **Custom** to define your own event collection conditions based on the values of advanced event selector fields. + +You can choose from the following predefined templates: + + * **Log all events** – Choose this template to log all events. + + * **Log only read events** – Choose this template to log only read events. Read-only events are events that do not change the state of a resource, such as `Get*` or `Describe*` events. + + * **Log only write events** – Choose this template to log only write events. Write events add, change, or delete resources, attributes, or artifacts, such as `Put*`, `Delete*`, or `Write*` events. + + * **Log only AWS Management Console events** – Choose this template to log only events originating from the AWS Management Console. + + * **Exclude AWS service initiated events** – Choose this template to exclude AWS service events, which have an `eventType` of `AwsServiceEvent`, and events initiated with AWS service-linked roles (SLRs). @@ -281 +293,39 @@ CloudTrail only copies trail events that have an `eventTime` within the event da - 21. Choose **Next** to review your choices. + 21. Choose **Next** to enrich your events by adding resource tag keys and IAM global condition keys. + + 22. In **Enrich events** , add up to 50 resource tag keys and 50 IAM global condition keys to provide additional metadata about your events. This helps you categorize and group related events. + +If you add resource tag keys, CloudTrail will include the selected tag keys associated with the resources that were involved in the API call. API events related to deleted resources will not have resource tags. + +If you add IAM global condition keys, CloudTrail will include information about the selected condition keys that were evaluated during the authorization process, including additional details about the principal, session, network, and the request itself. + +Information about the resource tag keys and IAM global condition keys is shown in the `eventContext` field of the event. For more information, see [Enrich CloudTrail events by adding resource tag keys and IAM global condition keys](./cloudtrail-context-events.html). + +###### Note + +If an event contains a resource that doesn’t belong to the event Region, CloudTrail will not populate tags for this resource because tag retrieval is limited to the event Region. + + 23. Choose **Expand event size** to expand the event payload up to 1 MB from 256 KB. This option is automatically enabled when you add resource tag keys or IAM global condition keys to ensure all of your added keys are included in the event. + +Expanding the event size is helpful for analyzing and troubleshooting events because it allows you to see the full contents of the following fields as long as the event payload is less than 1 MB: + + * `annotation` + + * `requestID` + + * `additionalEventData` + + * `serviceEventDetails` + + * `userAgent` + + * `errorCode` + + * `responseElements` + + * `requestParameters` + + * `errorMessage` + +For more information about these fields, see [CloudTrail record contents](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-record-contents.html). + + 24. Choose **Next** to review your choices. @@ -283 +333 @@ CloudTrail only copies trail events that have an `eventTime` within the event da - 22. On the **Review and create** page, review your choices. Choose **Edit** to make changes to a section. When you're ready to create the event data store, choose **Create event data store**. + 25. On the **Review and create** page, review your choices. Choose **Edit** to make changes to a section. When you're ready to create the event data store, choose **Create event data store**. @@ -285 +335 @@ CloudTrail only copies trail events that have an `eventTime` within the event da - 23. The new event data store is visible in the **Event data stores** table on the **Event data stores** page. + 26. The new event data store is visible in the **Event data stores** table on the **Event data stores** page.