AWS awscloudtrail documentation change

Service: awscloudtrail · 2025-06-13 · Documentation medium

File: awscloudtrail/latest/userguide/filtering-data-events.md

Summary

Added example for filtering DeleteObject events in CloudTrail data events

Security assessment

Provides guidance on configuring security-relevant event filtering but does not address a specific vulnerability.

Diff

diff --git a/awscloudtrail/latest/userguide/filtering-data-events.md b/awscloudtrail/latest/userguide/filtering-data-events.md
index 4ee3c6831..3acbbc689 100644
--- a//awscloudtrail/latest/userguide/filtering-data-events.md
+++ b//awscloudtrail/latest/userguide/filtering-data-events.md
@@ -210,0 +211,2 @@ For information about how to log data events using the console, see [Logging dat
+  * Example 3: Filtering on the resources.type and eventName fields to exclude individual objects deleted by an Amazon S3 DeleteObjects event
+
@@ -268,0 +271,64 @@ The following example shows how to include all data events for all Amazon S3 obj
+### Example 3: Filtering on the `resources.type` and `eventName` fields to exclude individual objects deleted by an Amazon S3 DeleteObjects event
+
+The following example shows how to include all data events for all Amazon S3 objects in a specific general purpose Amazon S3 bucket but exclude the individual objects deleted by the `DeleteObject` operation. The value for S3 events for the `resources.type` field is `AWS::S3::Object`. The value for the event name is `DeleteObject`. 
+    
+    
+    aws cloudtrail put-event-selectors \
+    --trail-name trailName \
+    --advanced-event-selectors \
+    
+    {
+        "Name": "Exclude Events for DeleteObject operation",
+        "FieldSelectors": [
+          {
+            "Field": "eventCategory",
+            "Equals": [
+              "Data"
+            ]
+          },
+          {
+            "Field": "resources.type",
+            "Equals": [
+              "AWS::S3::Object"
+            ]
+          },
+          {
+            "Field": "eventName",
+            "NotEquals": [
+              "DeleteObject"
+            ]
+          }
+        ]
+      },
+      {
+        "Name": "Exclude DeleteObject Events for individual objects deleted by DeleteObjects Operation",
+        "FieldSelectors": [
+          {
+            "Field": "eventCategory",
+            "Equals": [
+              "Data"
+            ]
+          },
+          {
+            "Field": "resources.type",
+            "Equals": [
+              "AWS::S3::Object"
+            ]
+          },
+          {
+            "Field": "eventName",
+            "Equals": [
+              "DeleteObject"
+            ]
+          },
+          {
+            "Field": "eventType",
+            "NotEquals": [
+              "AwsServiceEvent"
+            ]
+          }
+        ]
+      }
+    ] (edited) 
+    
+