AWS iot-mi documentation change
Summary
Updated CloudTrail logging documentation with specific API operations, added detailed event examples for CreateCloudConnector and ListDiscoveredDevices operations, and removed preview notice
Security assessment
The change adds explicit documentation of 20+ API operations being logged (including security-sensitive operations like CreateAccountAssociation and DeregisterAccountAssociation), which improves audit capability transparency. However, there is no evidence of addressing a specific vulnerability or security incident.
Diff
diff --git a/iot-mi/latest/devguide/logging-using-cloudtrail.md b/iot-mi/latest/devguide/logging-using-cloudtrail.md index 3728131f3..f6cf808ea 100644 --- a//iot-mi/latest/devguide/logging-using-cloudtrail.md +++ b//iot-mi/latest/devguide/logging-using-cloudtrail.md @@ -7,2 +6,0 @@ Management events in CloudTrailEvent examples -Managed integrations for AWS IoT Device Management is in preview release and is subject to change. For access, contact us from the [managed integrations console](https://console.aws.amazon.com/iot/home#/managed-integrations/intro). - @@ -48 +46,48 @@ CloudTrail Lake event data stores and queries incur costs. When you create an ev -Managed integrations logs all managed integrations control plane operations as management events. For a list of the Managed integrations control plane operations that managed integrations logs to CloudTrail, see the [Managed integrations API Reference](https://docs.aws.amazon.com/iot-mi/latest/APIReference/). +Managed integrations logs the following managed integrations control plane operations to CloudTrail as _management events_. + + * `CreateCloudConnector` + + * `UpdateCloudConnector` + + * `GetCloudConnector` + + * `DeleteCloudConnector` + + * `ListCloudConnectors` + + * `CreateConnectorDestination` + + * `UpdateConnectorDestination` + + * `GetConnectorDestination` + + * `DeleteConnectorDestination` + + * `ListConnectorDestinations` + + * `CreateAccountAssociation` + + * `UpdateAccountAssociation` + + * `GetAccountAssociation` + + * `DeleteAccountAssociation` + + * `ListAccountAssociations` + + * `StartAccountAssociationRefresh` + + * `ListManagedThingAccountAssociations` + + * `RegisterAccountAssociation` + + * `DeregisterAccountAssociation` + + * `SendConnectorEvent` + + * `ListDeviceDiscoveries` + + * `ListDiscoveredDevices` + + + @@ -54 +99 @@ An event represents a single request from any source and includes information ab -The following example shows a CloudTrail event that demonstrates the `StartDeviceDiscovery` API operation. +The following example shows a CloudTrail event that demonstrates a successful `CreateCloudConnector` API operation. @@ -56 +101 @@ The following example shows a CloudTrail event that demonstrates the `StartDevic -**Successful CloudTrail event with the`StartDeviceDiscovery` API operation.** +**Successful CloudTrail event with the`CreateCloudConnector` API operation.** @@ -63,4 +108,4 @@ The following example shows a CloudTrail event that demonstrates the `StartDevic - "principalId": "AROA47CRX4JX4AEXAMPLE", - "arn": "arn:aws:sts::123456789012:assumed-role/Admin/EXAMPLE", - "accountId": "222222222222", - "accessKeyId": "access-key-id", + "principalId": "EXAMPLE", + "arn": "arn:aws:sts::111122223333:assumed-role/Admin/EXAMPLE", + "accountId": "111122223333", + "accessKeyId": "EXAMPLEKYSBQSCGRIC", @@ -70,3 +115,3 @@ The following example shows a CloudTrail event that demonstrates the `StartDevic - "principalId": "AROA47CRX4JXUNEXAMPLE", - "arn": "arn:aws:iam::123456789012:role/Admin", - "accountId": "222222222222", + "principalId": "AROAZOZQFKYSFZVB2J2GN", + "arn": "arn:aws:iam::111122223333:role/Admin", + "accountId": "111122223333", @@ -76 +121 @@ The following example shows a CloudTrail event that demonstrates the `StartDevic - "creationDate": "2025-02-26T20:04:25Z", + "creationDate": "2025-06-05T18:26:16Z", @@ -81,3 +126,3 @@ The following example shows a CloudTrail event that demonstrates the `StartDevic - "eventTime": "2025-02-26T20:11:33Z", - "eventSource": "gamma-iotmanagedintegrations.amazonaws.com", - "eventName": "StartDeviceDiscovery", + "eventTime": "2025-06-05T18:30:40Z", + "eventSource": "iotmanagedintegrations.amazonaws.com", + "eventName": "CreateCloudConnector", @@ -85,2 +130,2 @@ The following example shows a CloudTrail event that demonstrates the `StartDevic - "sourceIPAddress": "15.248.7.123", - "userAgent": "aws-sdk-java/2.30.21 md/io#sync md/http#Apache ua/2.1 os/Mac_OS_X#15.3.1 lang/java#17.0.13 md/OpenJDK_64-Bit_Server_VM#17.0.13+11-LTS md/vendor#Amazon.com_Inc. md/en_US cfg/auth-source#stat m/D,N", + "sourceIPAddress": "192.0.2.0", + "userAgent": "PostmanRuntime/7.44.0", @@ -88,2 +133,9 @@ The following example shows a CloudTrail event that demonstrates the `StartDevic - "DiscoveryType": "ZIGBEE", - "ControllerIdentifier": "554a1e3f7c884e67a21e0cabac3a48e3" + "EndpointType": "LAMBDA", + "Description": "Manual testing for C2C CT Validation", + "ClientToken": "abc7460", + "EndpointConfig": { + "lambda": { + "arn": "arn:aws:lambda:us-east-1:111122223333:function:LightweightMockConnector7460" + } + }, + "Name": "EdenManualTestCloudConnector" @@ -99,3 +151,2 @@ The following example shows a CloudTrail event that demonstrates the `StartDevic - "Id": "717023e159264ec5ba97293e4d884d3a", - "StartedAt": 1740600693.789, - "Arn": "arn:aws:iotmanagedintegrations::123456789012:device-discovery/717023e159264ec5ba97293e4d884d3a" + "Id": "f7e633e719404c4a933596b4d0cc276e", + "Arn": "arn:aws:iotmanagedintegrations:us-east-1:111122223333:cloud-connector/EXAMPLE404c4a933596b4d0cc276e" @@ -103,2 +154,2 @@ The following example shows a CloudTrail event that demonstrates the `StartDevic - "requestID": "29aa09b9-ad0e-42dc-8b7f-565a1a56c020", - "eventID": "d8d0a6ab-b729-4aa5-8af0-9f605ee90d0f", + "requestID": "c0071fd1-b8e0-400a-bcc0-EXAMPLE9e4", + "eventID": "95b318ea-2f63-4183-9c22-EXAMPLE3e", @@ -108 +159 @@ The following example shows a CloudTrail event that demonstrates the `StartDevic - "recipientAccountId": "123456789012", + "recipientAccountId": "111122223333", @@ -111,0 +163 @@ The following example shows a CloudTrail event that demonstrates the `StartDevic +The following example shows a CloudTrail event that demonstrates a successful `ListDiscoveredDevices` API operation. @@ -113 +165 @@ The following example shows a CloudTrail event that demonstrates the `StartDevic -**Access denied CloudTrail event with the`StartDeviceDiscovery` API operation.** +**Successful CloudTrail event with the`ListDiscoveredDevices` API operation.** @@ -120,4 +172,4 @@ The following example shows a CloudTrail event that demonstrates the `StartDevic - "principalId": "AROA47CRX4JX4AEXAMPLE", - "arn": "arn:aws:sts::123456789012:assumaDMINed-role/EXAMPLEExplicitDenyRole/EXAMPLE", - "accountId": "222222222222", - "accessKeyId": "access-key-id", + "principalId": "EZAMPLE", + "arn": "arn:aws:sts::444455556666:assumed-role/Admin/EXAMPLE", + "accountId": "444455556666", + "accessKeyId": "EXAMPLERJ26PYMH", @@ -127,4 +179,4 @@ The following example shows a CloudTrail event that demonstrates the `StartDevic - "principalId": "AROA47CRX4JXUNEXAMPLE", - "arn": "arn:aws:iam::123456789012:role/EXAMPLEExplicitDenyRole", - "accountId": "222222222222", - "userName": "EXAMPLEExplicitDenyRole" + "principalId": "EXAMPLE", + "arn": "arn:aws:iam::444455556666:role/Admin", + "accountId": "444455556666", + "userName": "Admin" @@ -133 +185 @@ The following example shows a CloudTrail event that demonstrates the `StartDevic - "creationDate": "2025-02-27T21:36:55Z", + "creationDate": "2025-06-10T23:37:31Z", @@ -135,0 +188 @@ The following example shows a CloudTrail event that demonstrates the `StartDevic + } @@ -137,5 +190,3 @@ The following example shows a CloudTrail event that demonstrates the `StartDevic - "invokedBy": "AWS Internal" - }, - "eventTime": "2025-02-27T21:37:01Z", - "eventSource": "gamma-iotmanagedintegrations.amazonaws.com", - "eventName": "StartDeviceDiscovery", + "eventTime": "2025-06-10T23:38:07Z", + "eventSource": "iotmanagedintegrations.amazonaws.com", + "eventName": "ListDiscoveredDevices", @@ -143,3 +194,2 @@ The following example shows a CloudTrail event that demonstrates the `StartDevic - "sourceIPAddress": "AWS Internal", - "userAgent": "AWS Internal", - "errorCode": "AccessDenied", + "sourceIPAddress": "192.0.2.0", + "userAgent": "EXAMPLE-runtime/2.4.0", @@ -147,3 +197 @@ The following example shows a CloudTrail event that demonstrates the `StartDevic - "DiscoveryType": "CLOUD", - "ClientToken": "ClientToken", - "ConnectorAssociationIdentifier": "ConnectorAssociation" + "Identifier": "EXAMPLE4f268483a17d8060f014" @@ -151,6 +199,4 @@ The following example shows a CloudTrail event that demonstrates the `StartDevic - "responseElements": { - "message": "User: arn:aws:sts::123456789012:assumed-role/EXAMPLEExplicitDenyRole/EXAMPLE is not authorized to perform: iotmanagedintegrations:StartDeviceDiscovery on resource: arn:aws:iotmanagedintegrations:us-east-1:123456789012:/device-discoveries with an explicit deny" - }, - "requestID": "5eabd798-d79c-4d76-a5dd-115be230d77a", - "eventID": "cc75660c-f628-462a-9e6e-83dab40c5246", - "readOnly": false, + "responseElements": null, + "requestID": "27ae1f61-e2e6-43e4-bf17-EXAMPLEa568", + "eventID": "34734e81-76a8-49a4-9641-EXAMPLE28ed", + "readOnly": true, @@ -159 +205 @@ The following example shows a CloudTrail event that demonstrates the `StartDevic - "recipientAccountId": "123456789012", + "recipientAccountId": "444455556666",