AWS AmazonCloudWatch documentation change

Service: AmazonCloudWatch · 2025-07-04 · Documentation low

File: AmazonCloudWatch/latest/monitoring/logging_cw_api_calls.md

Summary

Expanded list of CloudWatch metric APIs logged by CloudTrail to include PutMetricData, GetMetricStatistics, and ListMetrics. Added example CloudTrail event for PutMetricData operation.

Security assessment

The change enhances documentation about CloudTrail's monitoring capabilities for additional CloudWatch APIs. While audit logging is a security-related feature, there is no evidence this change addresses a specific vulnerability or security incident - it simply expands documentation coverage of existing security logging capabilities.

Diff

diff --git a/AmazonCloudWatch/latest/monitoring/logging_cw_api_calls.md b/AmazonCloudWatch/latest/monitoring/logging_cw_api_calls.md
index f436f3442..25d6b59aa 100644
--- a//AmazonCloudWatch/latest/monitoring/logging_cw_api_calls.md
+++ b//AmazonCloudWatch/latest/monitoring/logging_cw_api_calls.md
@@ -230 +230 @@ The following log file entry shows that a user called the CloudWatch Logs `Creat
-CloudTrail can capture API activities related to the CloudWatch data plane operations [ GetMetricData](https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_GetMetricData.html) and [ GetMetricWidgetImage](https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_GetMetricWidgetImage.html). 
+CloudTrail can capture API activities related to the CloudWatch data plane operations on metrics [ GetMetricData](https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_GetMetricData.html), [ GetMetricWidgetImage](https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_GetMetricWidgetImage.html), [ PutMetricData](https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_PutMetricData.html), [ GetMetricStatistics](https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_GetMetricStatistics.html), and [ ListMetrics](https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_ListMetrics.html) APIs.
@@ -242 +242 @@ Data plane events can be filtered by resource type. Because there are additional
-Using the information that CloudTrail collects, you can identify a specific request to the CloudWatch GetMetricData or GetMetricWidgetImage APIs, the IP address of the requester, the requester's identity, and the date and time of the request. Logging the **GetMetricData** and **GetMetricWidgetImage** APIs using CloudTrail helps you enable operational and risk auditing, governance, and compliance of your AWS account.
+Using the information that CloudTrail collects, you can identify any of the metric APIs, the IP address of the requester, the requester's identity, and the date and time of the request. Logging the **GetMetricData** , **GetMetricWidgetImage** , **PutMetricData** , **GetMetricStatistics** , and **ListMetrics** APIs using CloudTrail helps you enable operational and risk auditing, governance, and compliance of your AWS account.
@@ -327,0 +328,65 @@ The following is an example of a CloudTrail event for a **GetMetricData** operat
+The following is an example of a CloudTrail event for a **PutMetricData** operation.
+    
+    
+    {
+          "eventVersion": "1.11",
+          "userIdentity": {
+            "type": "AssumedRole",
+            "principalId": "111122223333:example.amazon.com",
+            "arn": "arn:aws:sts::111122223333:assumed-role/cloudwatch.full.access/example.amazon.com",
+            "accountId": "111122223333",
+            "accessKeyId": "EXAMPLE1234567890",
+            "sessionContext": {
+              "sessionIssuer": {
+                "type": "Role",
+                "principalId": "AROA3FLD4LJVPWYJ6BCNM",
+                "arn": "arn:aws:iam::111122223333:role/cloudwatch.full.access",
+                "accountId": "111122223333",
+                "userName": "cloudwatch.full.access"
+              },
+              "attributes": {
+                "creationDate": "2025-06-19T23:19:50Z",
+                "mfaAuthenticated": "false"
+              }
+            }
+          },
+          "eventTime": "2025-06-19T23:51:04Z",
+          "eventSource": "monitoring.amazonaws.com",
+          "eventName": "PutMetricData",
+          "awsRegion": "us-east-1",
+          "sourceIPAddress": "AWS Internal",
+          "userAgent": "AWS Internal",
+          "requestParameters": {
+            "namespace": "CloudTrailTests",
+            "metricData": [
+              {
+                "metricName": "CloudTrailPutMetricDataTest",
+                "dimensions": [
+                  {
+                    "name": "TestDimName",
+                    "value": "TestDimValue"
+                  }
+                ]
+              }
+            ]
+          },
+          "responseElements": null,
+          "requestID": "877db913-2620-4929-97f3-f3c93c6f689b",
+          "eventID": "0c0c4516-75f4-4b27-8a83-213821a96a2b",
+          "readOnly": false,
+          "resources": [
+            {
+              "type": "AWS::CloudWatch::Metric"
+            }
+          ],
+          "eventType": "AwsApiCall",
+          "managementEvent": false,
+          "recipientAccountId": "111122223333",
+          "eventCategory": "Data",
+          "tlsDetails": {
+            "tlsVersion": "TLSv1.3",
+            "cipherSuite": "TLS_AES_128_GCM_SHA256",
+            "clientProvidedHostHeader": "monitoring.us-east-1.amazonaws.com"
+          }
+        }
+