AWS iot documentation change

Service: iot · 2025-08-10 · Documentation medium

File: iot/latest/developerguide/cwl-format.md

Summary

Added documentation for new 'DeleteConnection' CloudWatch log entry type with attributes and example

Security assessment

Documents security-relevant logging capabilities for tracking connection deletions, including principalId and source IP attributes. Enhances audit capabilities but doesn't address a specific vulnerability.

Diff

diff --git a/iot/latest/developerguide/cwl-format.md b/iot/latest/developerguide/cwl-format.md
index 5ad6c2b9e..ef7d46297 100644
--- a//iot/latest/developerguide/cwl-format.md
+++ b//iot/latest/developerguide/cwl-format.md
@@ -43,0 +44,2 @@ The AWS IoT message broker generates log entries for the following events:
+  * DeleteConnection log entry
+
@@ -174,0 +177,48 @@ The reason why the client is disconnecting.
+### DeleteConnection log entry
+
+The AWS IoT message broker generates a log entry with an `eventType` of `DeleteConnection` when an MQTT client connection is deleted.
+
+#### DeleteConnection log entry example
+    
+    
+    {
+        "timestamp": "2017-08-10 15:37:23.476",
+        "logLevel": "INFO",
+        "traceId": "20b23f3f-d7f1-feae-169f-82263394fbdb",
+        "accountId": "123456789012",
+        "status": "Success",
+        "eventType": "DeleteConnection",
+        "protocol": "HTTP",
+        "clientId": "abf27092886e49a8a5c1922749736453",
+        "principalId": "145179c40e2219e18a909d896a5340b74cf97a39641beec2fc3eeafc5a932167",
+        "sourceIp": "205.251.233.181",
+        "sourcePort": 13490
+    }
+
+In addition to the Common CloudWatch Logs attributes, `DeleteConnection` log entries contain the following attributes:
+
+clientId
+    
+
+The ID of the client that will be disconnected.
+
+principalId
+    
+
+The ID of the principal making the request. For information about how to identify the principal using the principal ID, see [Compare IAM identities and credentials](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction_identity-management.html) in the _IAM User Guide_.
+
+protocol
+    
+
+The protocol used to make the request. The valid value is `HTTP`.
+
+sourceIp
+    
+
+The IP address where the request originated.
+
+sourcePort
+    
+
+The port where the request originated.
+