AWS awscloudtrail documentation change
Summary
Updated list of data events supported by AWS CloudTrail, adding multiple new AWS service integrations and reorganizing existing entries. Added documentation for services including AWS IoT certificate/thing operations, AWS Private CA connectors, S3 access points/Express/Object Lambda, and others.
Security assessment
The changes primarily expand the list of services whose API activities are logged by CloudTrail. While increased logging capabilities can improve security monitoring, there is no direct evidence this addresses a specific security vulnerability. The note about DynamoDB streams clarifies logging behavior but doesn't indicate a security fix.
Diff
diff --git a/awscloudtrail/latest/userguide/cloudtrail-concepts.md b/awscloudtrail/latest/userguide/cloudtrail-concepts.md index d8b0044a7..517c617b6 100644 --- a//awscloudtrail/latest/userguide/cloudtrail-concepts.md +++ b//awscloudtrail/latest/userguide/cloudtrail-concepts.md @@ -102,0 +103,2 @@ For event data stores, you can use only advanced event selectors to include data +#### Data events supported by AWS CloudTrail + @@ -105,6 +107,7 @@ AWS service | Description | Resource type (console) | resources.type value -Amazon DynamoDB | [Amazon DynamoDB item-level API activity](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/logging-using-cloudtrail.html#ddb-data-plane-events-in-cloudtrail) on tables (for example, `PutItem`, `DeleteItem`, and `UpdateItem` API operations). - -###### Note - -For tables with streams enabled, the `resources` field in the data event contains both `AWS::DynamoDB::Stream` and `AWS::DynamoDB::Table`. If you specify `AWS::DynamoDB::Table` for the `resources.type`, it will log both DynamoDB table and DynamoDB streams events by default. To exclude [streams events](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/logging-using-cloudtrail.html#ddb-data-plane-events-in-cloudtrail), add a filter on the `eventName` field. | **DynamoDB** | `AWS::DynamoDB::Table` -AWS Lambda | AWS Lambda function execution activity (the `Invoke` API). | **Lambda** | `AWS::Lambda::Function` +AWS Backup | AWS Backup Search Data API activity on search jobs. | **AWS Backup Search Data APIs** | `AWS::Backup::SearchJob` +AWS IoT | [AWS IoT API activity](https://docs.aws.amazon.com/greengrass/v2/developerguide/logging-using-cloudtrail.html#greengrass-data-events-cloudtrail) on [certificates](https://docs.aws.amazon.com/iot/latest/developerguide/x509-client-certs.html). | **IoT certificate** | `AWS::IoT::Certificate` +AWS IoT | [AWS IoT API activity](https://docs.aws.amazon.com/greengrass/v2/developerguide/logging-using-cloudtrail.html#greengrass-data-events-cloudtrail) on [things](https://docs.aws.amazon.com/iot/latest/developerguide/thing-registry.html). | **IoT thing** | `AWS::IoT::Thing` +AWS Private CA | AWS Private CA Connector for Active Directory API activity. | **AWS Private CA Connector for Active Directory** | `AWS::PCAConnectorAD::Connector` +AWS Private CA | AWS Private CA Connector for SCEP API activity. | **AWS Private CA Connector for SCEP** | `AWS::PCAConnectorSCEP::Connector` +Amazon RDS | [Amazon RDS API activity](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/logging-using-cloudtrail-data-api.html#logging-using-cloudtrail-data-api.including-excluding-cloudtrail-events) on a DB Cluster. | **RDS Data API - DB Cluster** | `AWS::RDS::DBCluster` +Amazon RDS | Amazon RDS API activity on a DB Instance. | **RDS Data API - DB Instance** | `AWS::RDS::DBInstance` @@ -111,0 +115,12 @@ Amazon S3 | [Amazon S3 object-level API activity](https://docs.aws.amazon.com/Am +Amazon S3 | [Amazon S3 API activity](https://docs.aws.amazon.com/AmazonS3/latest/userguide/cloudtrail-logging-s3-info.html#cloudtrail-data-events) on access points. | **S3 Access Point** | `AWS::S3::AccessPoint` +Amazon S3 | [Amazon S3 object-level API activity](https://docs.aws.amazon.com/AmazonS3/latest/userguide/cloudtrail-logging-s3-info.html#cloudtrail-data-events) (for example, `GetObject`, `DeleteObject`, and `PutObject` API operations) on objects in directory buckets. | **S3 Express** | `AWS::S3Express::Object` +Amazon S3 | [Amazon S3 Object Lambda access points API activity](https://docs.aws.amazon.com/AmazonS3/latest/userguide/cloudtrail-logging-s3-info.html#cloudtrail-data-events), such as calls to `CompleteMultipartUpload` and `GetObject`. | **S3 Object Lambda** | `AWS::S3ObjectLambda::AccessPoint` +Amazon S3 | Amazon FSx API activity on volumes. | **FSx Volume** | `AWS::FSx::Volume` +Amazon S3 Tables | Amazon S3 API activity on [tables](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-tables-create.html). | **S3 table** | `AWS::S3Tables::Table` +Amazon S3 Tables | Amazon S3 API activity on [table buckets](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-tables-buckets.html). | **S3 table bucket** | `AWS::S3Tables::TableBucket` +Amazon S3 on Outposts | [Amazon S3 on Outposts object-level API activity](https://docs.aws.amazon.com/AmazonS3/latest/userguide/cloudtrail-logging-s3-info.html#cloudtrail-data-events). | **S3 Outposts** | `AWS::S3Outposts::Object` +Amazon SNS | Amazon SNS [`Publish`](https://docs.aws.amazon.com/sns/latest/api/API_Publish.html) API operations on platform endpoints. | **SNS platform endpoint** | `AWS::SNS::PlatformEndpoint` +Amazon SNS | Amazon SNS [`Publish`](https://docs.aws.amazon.com/sns/latest/api/API_Publish.html) and [`PublishBatch`](https://docs.aws.amazon.com/sns/latest/api/API_PublishBatch.html) API operations on topics. | **SNS topic** | `AWS::SNS::Topic` +Amazon SQS | [Amazon SQS API activity](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-logging-using-cloudtrail.html#sqs-data-events-in-cloud-trail) on messages. | **SQS** | `AWS::SQS::Queue` +AWS Supply Chain | AWS Supply Chain API activity on an instance. | **Supply Chain** | `AWS::SCN::Instance` +Amazon SWF | [Amazon SWF API activity](https://docs.aws.amazon.com/amazonswf/latest/developerguide/ct-logging.html#cloudtrail-data-events) on [domains](https://docs.aws.amazon.com/amazonswf/latest/developerguide/swf-dev-domains.html). | **SWF domain** | `AWS::SWF::Domain` @@ -113,0 +129 @@ AWS AppSync | [AWS AppSync API activity](https://docs.aws.amazon.com/appsync/lat +Amazon Aurora DSQL | Amazon Aurora DSQL API activity on cluster resources. | **Amazon Aurora DSQL** | `AWS::DSQL::Cluster` @@ -115 +130,0 @@ AWS B2B Data Interchange | B2B Data Interchange API activity for Transformer ope -AWS Backup | AWS Backup Search Data API activity on search jobs. | **AWS Backup Search Data APIs** | `AWS::Backup::SearchJob` @@ -125 +140 @@ Amazon Bedrock | Amazon Bedrock API activity on sessions. | **Bedrock session** -Amazon CloudFront | CloudFront API activity on a [KeyValueStore](https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_KeyValueStore.html). | **CloudFront KeyValueStore** | `AWS::CloudFront::KeyValueStore` +Amazon Bedrock | Amazon Bedrock API activity on flow executions. | **Bedrock flow execution** | `AWS::Bedrock::FlowExecution` @@ -127,0 +143 @@ AWS Cloud Map | [AWS Cloud Map API activity](https://docs.aws.amazon.com/cloud-m +Amazon CloudFront | CloudFront API activity on a [KeyValueStore](https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_KeyValueStore.html). | **CloudFront KeyValueStore** | `AWS::CloudFront::KeyValueStore` @@ -141,0 +158,5 @@ AWS Deadline Cloud | [Deadline Cloud](https://docs.aws.amazon.com/deadline-cloud +Amazon DynamoDB | [Amazon DynamoDB item-level API activity](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/logging-using-cloudtrail.html#ddb-data-plane-events-in-cloudtrail) on tables (for example, `PutItem`, `DeleteItem`, and `UpdateItem` API operations). + +###### Note + +For tables with streams enabled, the `resources` field in the data event contains both `AWS::DynamoDB::Stream` and `AWS::DynamoDB::Table`. If you specify `AWS::DynamoDB::Table` for the `resources.type`, it will log both DynamoDB table and DynamoDB streams events by default. To exclude [streams events](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/logging-using-cloudtrail.html#ddb-data-plane-events-in-cloudtrail), add a filter on the `eventName` field. | **DynamoDB** | `AWS::DynamoDB::Table` @@ -142,0 +164,3 @@ Amazon DynamoDB | [Amazon DynamoDB](https://docs.aws.amazon.com/amazondynamodb/l +Amazon Elastic Block Store | [Amazon Elastic Block Store (EBS)](https://docs.aws.amazon.com/ebs/latest/userguide/logging-ebs-apis-using-cloudtrail.html) direct APIs, such as `PutSnapshotBlock`, `GetSnapshotBlock`, and `ListChangedBlocks` on Amazon EBS snapshots. | **Amazon EBS direct APIs** | `AWS::EC2::Snapshot` +Amazon Elastic Kubernetes Service | Amazon Elastic Kubernetes Service API activity on dashboards. | **Amazon Elastic Kubernetes Service dashboard** | `AWS::EKS::Dashboard` +Amazon EMR | [Amazon EMR API activity](https://docs.aws.amazon.com/emr/latest/ManagementGuide/logging-using-cloudtrail.html#cloudtrail-data-events) on a write-ahead log workspace. | **EMR write-ahead log workspace** | `AWS::EMRWAL::Workspace` @@ -147,2 +171 @@ AWS End User Messaging Social | AWS End User Messaging Social API activity on Wa -Amazon Elastic Block Store | [Amazon Elastic Block Store (EBS)](https://docs.aws.amazon.com/ebs/latest/userguide/logging-ebs-apis-using-cloudtrail.html) direct APIs, such as `PutSnapshotBlock`, `GetSnapshotBlock`, and `ListChangedBlocks` on Amazon EBS snapshots. | **Amazon EBS direct APIs** | `AWS::EC2::Snapshot` -Amazon EMR | [Amazon EMR API activity](https://docs.aws.amazon.com/emr/latest/ManagementGuide/logging-using-cloudtrail.html#cloudtrail-data-events) on a write-ahead log workspace. | **EMR write-ahead log workspace** | `AWS::EMRWAL::Workspace` +Amazon EventBridge | EventBridge API activity on a connection. | **EventBridge** | `AWS::Events::Connection` @@ -155,2 +177,0 @@ AWS HealthImaging | AWS HealthImaging API activity on data stores. | **MedicalIm -AWS IoT | [AWS IoT API activity](https://docs.aws.amazon.com/greengrass/v2/developerguide/logging-using-cloudtrail.html#greengrass-data-events-cloudtrail) on [certificates](https://docs.aws.amazon.com/iot/latest/developerguide/x509-client-certs.html). | **IoT certificate** | `AWS::IoT::Certificate` -AWS IoT | [AWS IoT API activity](https://docs.aws.amazon.com/greengrass/v2/developerguide/logging-using-cloudtrail.html#greengrass-data-events-cloudtrail) on [things](https://docs.aws.amazon.com/iot/latest/developerguide/thing-registry.html). | **IoT thing** | `AWS::IoT::Thing` @@ -169,0 +191 @@ AWS IoT SiteWise Assistant | Sitewise Assistant API activity on conversations. | +AWS IoT TwinMaker | IoT TwinMaker API activity on a [component type](https://docs.aws.amazon.com/iot-twinmaker/latest/apireference/API_CreateComponentType.html). | **IoT TwinMaker component type** | `AWS::IoTTwinMaker::ComponentType` @@ -170,0 +193,2 @@ AWS IoT TwinMaker | IoT TwinMaker API activity on an [entity](https://docs.aws.a +AWS IoT TwinMaker | IoT TwinMaker API activity on a [scene](https://docs.aws.amazon.com/iot-twinmaker/latest/apireference/API_CreateScene.html). | **IoT TwinMaker scene** | `AWS::IoTTwinMaker::Scene` +AWS IoT TwinMaker | IoT TwinMaker API activity on a [sync job](https://docs.aws.amazon.com/iot-twinmaker/latest/apireference/API_CreateSyncJob.html). | **IoT TwinMaker sync job** | `AWS::IoTTwinMaker::SyncJob` @@ -173,0 +198 @@ Amazon Keyspaces (for Apache Cassandra) | [Amazon Keyspaces API activity](https: +Amazon Keyspaces (for Apache Cassandra) | Amazon Keyspaces (for Apache Cassandra) API activity on Cassandra CDC streams. | **Cassandra CDC streams** | `AWS::Cassandra::Stream` @@ -176,0 +202 @@ Amazon Kinesis Video Streams | Kinesis Video Streams API activity on video strea +AWS Lambda | AWS Lambda function execution activity (the `Invoke` API). | **Lambda** | `AWS::Lambda::Function` @@ -190,2 +215,0 @@ AWS Payment Cryptography | AWS Payment Cryptography API activity on keys. | **Pa -AWS Private CA | AWS Private CA Connector for Active Directory API activity. | **AWS Private CA Connector for Active Directory** | `AWS::PCAConnectorAD::Connector` -AWS Private CA | AWS Private CA Connector for SCEP API activity. | **AWS Private CA Connector for SCEP** | `AWS::PCAConnectorSCEP::Connector` @@ -201,9 +225 @@ Amazon Q Developer | [Amazon Q Developer API activity](https://docs.aws.amazon.c -Amazon RDS | [Amazon RDS API activity](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/logging-using-cloudtrail-data-api.html#logging-using-cloudtrail-data-api.including-excluding-cloudtrail-events) on a DB Cluster. | **RDS Data API - DB Cluster** | `AWS::RDS::DBCluster` -AWS Resource Explorer | Resource Explorer API activity on [managed views](https://docs.aws.amazon.com/resource-explorer/latest/userguide/aws-managed-views.html). | **AWS Resource Explorer managed-view** | `AWS::ResourceExplorer2::ManagedView` -AWS Resource Explorer | Resource Explorer API activity on views. | **AWS Resource Explorer view** | `AWS::ResourceExplorer2::View` -Amazon S3 | [Amazon S3 API activity](https://docs.aws.amazon.com/AmazonS3/latest/userguide/cloudtrail-logging-s3-info.html#cloudtrail-data-events) on access points. | **S3 Access Point** | `AWS::S3::AccessPoint` -Amazon S3 | [Amazon S3 object-level API activity](https://docs.aws.amazon.com/AmazonS3/latest/userguide/cloudtrail-logging-s3-info.html#cloudtrail-data-events) (for example, `GetObject`, `DeleteObject`, and `PutObject` API operations) on objects in directory buckets. | **S3 Express** | `AWS::S3Express::Object` -Amazon S3 | [Amazon S3 Object Lambda access points API activity](https://docs.aws.amazon.com/AmazonS3/latest/userguide/cloudtrail-logging-s3-info.html#cloudtrail-data-events), such as calls to `CompleteMultipartUpload` and `GetObject`. | **S3 Object Lambda** | `AWS::S3ObjectLambda::AccessPoint` -Amazon S3 Tables | Amazon S3 API activity on [tables](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-tables-create.html). | **S3 table** | `AWS::S3Tables::Table` -Amazon S3 Tables | Amazon S3 API activity on [table buckets](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-tables-buckets.html). | **S3 table bucket** | `AWS::S3Tables::TableBucket` -Amazon S3 on Outposts | [Amazon S3 on Outposts object-level API activity](https://docs.aws.amazon.com/AmazonS3/latest/userguide/cloudtrail-logging-s3-info.html#cloudtrail-data-events). | **S3 Outposts** | `AWS::S3Outposts::Object` +Amazon Q Developer | Amazon Q Developer API activity on projects. | **Q Developer project** | `AWS::QDeveloper::Project` @@ -215 +230,0 @@ AWS Signer | Signer API activity on signing profiles. | **Signer signing profile -Amazon SimpleDB | Amazon SimpleDB API activity on domains. | **SimpleDB domain** | `AWS::SDB::Domain` @@ -219,3 +234,2 @@ Amazon Simple Email Service | Amazon Simple Email Service (Amazon SES) API activ -Amazon SNS | Amazon SNS [`Publish`](https://docs.aws.amazon.com/sns/latest/api/API_Publish.html) API operations on platform endpoints. | **SNS platform endpoint** | `AWS::SNS::PlatformEndpoint` -Amazon SNS | Amazon SNS [`Publish`](https://docs.aws.amazon.com/sns/latest/api/API_Publish.html) and [`PublishBatch`](https://docs.aws.amazon.com/sns/latest/api/API_PublishBatch.html) API operations on topics. | **SNS topic** | `AWS::SNS::Topic` -Amazon SQS | [Amazon SQS API activity](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-logging-using-cloudtrail.html#sqs-data-events-in-cloud-trail) on messages. | **SQS** | `AWS::SQS::Queue` +Amazon SimpleDB | Amazon SimpleDB API activity on domains. | **SimpleDB domain** | `AWS::SDB::Domain` +AWS Step Functions | Step Functions API activity on a rate control. | **Step Functions rate control** | `AWS::StepFunctions::RateControl` @@ -224,2 +237,0 @@ AWS Step Functions | [Step Functions API activity](https://docs.aws.amazon.com/s -AWS Supply Chain | AWS Supply Chain API activity on an instance. | **Supply Chain** | `AWS::SCN::Instance` -Amazon SWF | [Amazon SWF API activity](https://docs.aws.amazon.com/amazonswf/latest/developerguide/ct-logging.html#cloudtrail-data-events) on [domains](https://docs.aws.amazon.com/amazonswf/latest/developerguide/swf-dev-domains.html). | **SWF domain** | `AWS::SWF::Domain`