AWS awscloudtrail documentation change
Summary
Updated documentation to add predefined log selector templates (read/write/console events), event enrichment with resource tags/IAM condition keys, and expanded event size details
Security assessment
The changes add documentation about security-relevant features like filtering event types (read/write/console), IAM condition key logging, and resource tag-based access control. However, there is no evidence of addressing a specific vulnerability. The additions improve security visibility but don't fix existing flaws.
Diff
diff --git a/awscloudtrail/latest/userguide/query-event-data-store-insights.md b/awscloudtrail/latest/userguide/query-event-data-store-insights.md index 43f7e5869..6f007ad40 100644 --- a//awscloudtrail/latest/userguide/query-event-data-store-insights.md +++ b//awscloudtrail/latest/userguide/query-event-data-store-insights.md @@ -110 +110 @@ For [organization event data stores](./cloudtrail-lake-organizations.html), Clou - 10. (Optional) In the **Tags** section, you can add up to 50 tag key pairs to help you identify, sort, and control access to your event data store. For more information about how to use IAM policies to authorize access to an event data store based on tags, see [Examples: Denying access to create or delete event data stores based on tags](./security_iam_id-based-policy-examples.html#security_iam_id-based-policy-examples-eds-tags). For more information about how you can use tags in AWS, see [Tagging your AWS resources](https://docs.aws.amazon.com/tag-editor/latest/userguide/tagging.html) in the _Tagging AWS Resources User Guide_. + 10. (Optional) In the **Tags** section, you can add up to 50 tag key pairs to help you identify, sort, and control access to your event data store. For more information about how to use IAM policies to authorize access to an event data store based on tags, see [Examples: Denying access to create or delete event data stores based on tags](./security_iam_id-based-policy-examples.html#security_iam_id-based-policy-examples-eds-tags). For more information about how you can use tags in AWS, see [Tagging AWS resources](https://docs.aws.amazon.com/tag-editor/latest/userguide/tagging.html) in the _Tagging AWS Resources User Guide_. @@ -221 +221 @@ For [organization event data stores](./cloudtrail-lake-organizations.html), Clou - 10. (Optional) In the **Tags** section, you can add up to 50 tag key pairs to help you identify, sort, and control access to your event data store. For more information about how to use IAM policies to authorize access to an event data store based on tags, see [Examples: Denying access to create or delete event data stores based on tags](./security_iam_id-based-policy-examples.html#security_iam_id-based-policy-examples-eds-tags). For more information about how you can use tags in AWS, see [Tagging your AWS resources](https://docs.aws.amazon.com/tag-editor/latest/userguide/tagging.html) in the _Tagging AWS Resources User Guide_. + 10. (Optional) In the **Tags** section, you can add up to 50 tag key pairs to help you identify, sort, and control access to your event data store. For more information about how to use IAM policies to authorize access to an event data store based on tags, see [Examples: Denying access to create or delete event data stores based on tags](./security_iam_id-based-policy-examples.html#security_iam_id-based-policy-examples-eds-tags). For more information about how you can use tags in AWS, see [Tagging AWS resources](https://docs.aws.amazon.com/tag-editor/latest/userguide/tagging.html) in the _Tagging AWS Resources User Guide_. @@ -247 +247,13 @@ For [organization event data stores](./cloudtrail-lake-organizations.html), Clou - 1. In **Log selector template** , choose a template, or **Custom** to build a custom configuration based on advanced event selector field values. + 1. In **Log selector template** , choose a predefined template, or choose **Custom** to write your own event collection conditions based on the values of advanced event selector fields. + +You can choose from the following predefined templates: + + * **Log all events** – Choose this template to log all events. + + * **Log only read events** – Choose this template to log only read events. Read-only events are events that do not change the state of a resource, such as `Get*` or `Describe*` events. + + * **Log only write events** – Choose this template to log only write events. Write events add, change, or delete resources, attributes, or artifacts, such as `Put*`, `Delete*`, or `Write*` events. + + * **Log only AWS Management Console events** – Choose this template to log only events originating from the AWS Management Console. + + * **Exclude AWS service initiated events** – Choose this template to exclude AWS service events, which have an `eventType` of `AwsServiceEvent`, and events initiated with AWS service-linked roles (SLRs). @@ -289 +301,39 @@ You can have a maximum of 500 values for all selectors on an event data store. T - 22. Choose **Next** to review your choices. + 22. Choose **Next** to enrich your events by adding resource tag keys and IAM global condition keys. + + 23. In **Enrich events** , add up to 50 resource tag keys and 50 IAM global condition keys to provide additional metadata about your events. This helps you categorize and group related events. + +If you add resource tag keys, CloudTrail will include the selected tag keys associated with the resources that were involved in the API call. API events related to deleted resources will not have resource tags. + +If you add IAM global condition keys, CloudTrail will include information about the selected condition keys that were evaluated during the authorization process, including additional details about the principal, session, network, and the request itself. + +Information about the resource tag keys and IAM global condition keys is shown in the `eventContext` field of the event. For more information, see [Enrich CloudTrail events by adding resource tag keys and IAM global condition keys](./cloudtrail-context-events.html). + +###### Note + +If an event contains a resource that doesn’t belong to the event Region, CloudTrail will not populate tags for this resource because tag retrieval is limited to the event Region. + + 24. Choose **Expand event size** to expand the event payload up to 1 MB from 256 KB. This option is automatically enabled when you add resource tag keys or IAM global condition keys to ensure all of your added keys are included in the event. + +Expanding the event size is helpful for analyzing and troubleshooting events because it allows you to see the full contents of the following fields as long as the event payload is less than 1 MB: + + * `annotation` + + * `requestID` + + * `additionalEventData` + + * `serviceEventDetails` + + * `userAgent` + + * `errorCode` + + * `responseElements` + + * `requestParameters` + + * `errorMessage` + +For more information about these fields, see [CloudTrail record contents](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-record-contents.html). + + 25. Choose **Next** to review your choices. @@ -291 +341 @@ You can have a maximum of 500 values for all selectors on an event data store. T - 23. On the **Review and create** page, review your choices. Choose **Edit** to make changes to a section. When you're ready to create the event data store, choose **Create event data store**. + 26. On the **Review and create** page, review your choices. Choose **Edit** to make changes to a section. When you're ready to create the event data store, choose **Create event data store**. @@ -293 +343 @@ You can have a maximum of 500 values for all selectors on an event data store. T - 24. The new event data store is visible in the **Event data stores** table on the **Event data stores** page. + 27. The new event data store is visible in the **Event data stores** table on the **Event data stores** page.