AWS eventbridge documentation change

Service: eventbridge · 2025-06-07 · Documentation low

File: eventbridge/latest/ref/events-ref-emr-serverless.md

Summary

Added CloudTrail integration documentation and API call monitoring examples

Security assessment

Documents how to monitor EMR Serverless API activity through CloudTrail, which is a security best practice for auditing and detecting unauthorized changes. However, this is a documentation improvement rather than addressing a specific vulnerability.

Diff

diff --git a/eventbridge/latest/ref/events-ref-emr-serverless.md b/eventbridge/latest/ref/events-ref-emr-serverless.md
index 4c66b8b65..5fc7c61b9 100644
--- a//eventbridge/latest/ref/events-ref-emr-serverless.md
+++ b//eventbridge/latest/ref/events-ref-emr-serverless.md
@@ -5 +5 @@
-Service events
+Service eventsEvents via CloudTrail
@@ -9 +9 @@ Service events
-EMR Serverless sends service events directly to EventBridge.
+EMR Serverless sends service events directly to EventBridge, as well as via AWS CloudTrail.
@@ -49,0 +50,34 @@ For more information, see [Creating event patterns](https://docs.aws.amazon.com/
+## EMR Serverless events delivered via AWS CloudTrail
+
+AWS CloudTrail sends events originating from EMR Serverless to EventBridge. AWS services deliver events to CloudTrail on a [best effort](./event-delivery-level.html) basis. For more information, see [AWS service events delivered via AWS CloudTrail](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-service-event-cloudtrail.html) in the _Amazon EventBridge User Guide_.
+
+To match events from this service delivered by AWS CloudTrail, create an event pattern that matches against the following event attributes:
+
+  * `source`: aws.emr-serverless
+
+  * `eventSource`: emr-serverless.amazonaws.com
+
+
+
+    
+    
+    {
+      "source": ["aws.emr-serverless"],
+      "detail-type": ["AWS API Call via CloudTrail"],
+      "detail": {
+        "eventSource": ["emr-serverless.amazonaws.com"]
+      }
+    }
+
+To match against a specific API calls from this service, include an `eventName` attribute specifying an array of API calls to match:
+    
+    
+    {
+      "source": ["aws.emr-serverless"],
+      "detail-type": ["AWS API Call via CloudTrail"],
+      "detail": {
+        "eventSource": ["emr-serverless.amazonaws.com"],
+        "eventName": ["api-action-name"]
+      }
+    }
+