AWS IAM documentation change
Summary
Updated references to specify OIDC/SAML federated principals and session principals in CloudTrail logging context
Security assessment
Enhances documentation about security auditing capabilities for different federation types, improving clarity without addressing specific vulnerabilities
Diff
diff --git a/IAM/latest/UserGuide/cloudtrail-integration.md b/IAM/latest/UserGuide/cloudtrail-integration.md index 4c1eac107..235c5d2cc 100644 --- a//IAM/latest/UserGuide/cloudtrail-integration.md +++ b//IAM/latest/UserGuide/cloudtrail-integration.md @@ -59 +59 @@ CloudTrail logs all authenticated API requests to IAM and AWS STS API operations -You can use the logged information to map calls made by a federated user with an assumed role back to the originating external federated caller. In the case of `AssumeRole`, you can map calls back to the originating AWS service or to the account of the originating user. The `userIdentity` section of the JSON data in the CloudTrail log entry contains the information that you need to map the AssumeRole* request with a specific federated user. For more information, see [CloudTrail userIdentity Element](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-user-identity.html) in the _AWS CloudTrail User Guide_. +You can use the logged information to map calls made by an OIDC or SAML federated principal with an assumed role back to the originating external federated caller. In the case of `AssumeRole`, you can map calls back to the originating AWS service or to the account of the originating user. The `userIdentity` section of the JSON data in the CloudTrail log entry contains the information that you need to map the AssumeRole* request with a specific session principal. For more information, see [CloudTrail userIdentity Element](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-user-identity.html) in the _AWS CloudTrail User Guide_. @@ -77 +77 @@ For more details about the user identity information in CloudTrail log entries, -CloudTrail logs sign-in events to the AWS Management Console, the AWS discussion forums, and AWS Marketplace. CloudTrail logs successful and failed sign-in attempts for IAM users and federated users. +CloudTrail logs sign-in events to the AWS Management Console, the AWS discussion forums, and AWS Marketplace. CloudTrail logs successful and failed sign-in attempts for IAM users, SAML and OIDC federated principals, and AWS STS federated user principals.