AWS transfer documentation change
Summary
Added detailed documentation about enabling S3 data event logging, authentication log examples, data access tracking, and CloudTrail log analysis procedures for Transfer Family web apps
Security assessment
The changes add comprehensive logging documentation including authentication tracking and data access monitoring, which are security best practices but do not address a specific vulnerability. The examples show how to monitor user activity and file operations for security purposes.
Diff
diff --git a/transfer/latest/userguide/webapp-cloudtrail.md b/transfer/latest/userguide/webapp-cloudtrail.md index 2bc4c774e..372f78b60 100644 --- a//transfer/latest/userguide/webapp-cloudtrail.md +++ b//transfer/latest/userguide/webapp-cloudtrail.md @@ -4,0 +5,2 @@ +Enabling Amazon S3 data eventsAuthentication log examplesData access log exampleViewing log entries + @@ -9 +11,10 @@ CloudTrail is an AWS service that creates a record of actions taken within your -For Transfer Family web apps, see the following documentation for details on how view the logs for your end users' activity. +For Transfer Family web apps, you can track both authentication events and data access operations performed by your users. To enable comprehensive logging, you need to: + + 1. Configure CloudTrail to log management events for tracking authentication activities. + + 2. Enable Amazon S3 data events to track file operations performed through your web app. + + + + +See also @@ -23,0 +35,468 @@ For Transfer Family web apps, see the following documentation for details on how +## Enabling Amazon S3 data events + +To track file operations performed through Transfer Family web apps on your Amazon S3 buckets, you need to enable data events for those buckets. Data events provide object-level API activity and are particularly useful for tracking file uploads, downloads, and other operations performed by web app users. + +To enable Amazon S3 data events for your Transfer Family web app: + + 1. Open the CloudTrail console at [https://console.aws.amazon.com/cloudtrail/](https://console.aws.amazon.com/cloudtrail/). + + 2. In the navigation pane, choose **Trails** , and then select an existing trail or create a new one. + + 3. Under **Data events** , choose **Edit**. + + 4. For **Data event type** , select **S3**. + + 5. Choose the Amazon S3 buckets to log data events for. You can log data events for all buckets or specify individual buckets. + + 6. Choose whether to log **Read** events, **Write** events, or both. + + 7. Choose **Save changes**. + + + + +After enabling data events, you can access these logs in the Amazon S3 bucket configured for CloudTrail. The logs include details such as the user who performed the action, the action timestamp, the specific object affected, and the `onBehalfOf` field that helps trace the `userId` for actions performed through Transfer Family web apps. + +## Authentication log examples + +CloudTrail logs authentication events for Transfer Family web apps, which can help you track successful and failed sign-in attempts. These logs are particularly useful for security monitoring and compliance purposes. + +###### Topics + + * Example log entry for credential verification + + * Example log entry for sign-in authentication + + * Example log entry for ListCallerAccessGrants + + * Example log entry for GetDataAccess event + + + + +### Example log entry for credential verification + +The following example shows a CloudTrail log entry for a credential verification event that occurs during the authentication process. + + + { + "eventVersion": "1.09", + "userIdentity": { + "type": "Unknown", + "principalId": "123456789012", + "arn": "", + "accountId": "123456789012", + "accessKeyId": "", + "userName": "demo-user-2", + "onBehalfOf": { + "userId": "f12bb510-a011-702f-10dd-5607e2776dbc", + "identityStoreArn": "arn:aws:identitystore::123456789012:identitystore/d-9a670c546e" + }, + "credentialId": "58138a11-87e5-401d-8f0b-7161c9389112" + }, + "eventTime": "2025-08-08T15:29:30Z", + "eventSource": "signin.amazonaws.com", + "eventName": "CredentialVerification", + "awsRegion": "us-east-2", + "sourceIPAddress": "192.0.2.224", + "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36", + "requestParameters": null, + "responseElements": null, + "additionalEventData": { + "AuthWorkflowID": "f304a48b-7b6d-41c8-b136-4f49c91c1f31", + "CredentialType": "PASSWORD" + }, + "requestID": "ff936828-4a81-453c-802d-81368b6bca1a", + "eventID": "70cb7008-493d-42c2-a9eb-38bf168af6a8", + "readOnly": false, + "eventType": "AWSServiceEvent", + "managementEvent": true, + "recipientAccountId": "123456789012", + "serviceEventDetails": { + "CredentialVerification": "Success" + }, + "eventCategory": "Management" + } + +This event provides additional detail about the credential verification step in the authentication process, showing the specific credential ID and authentication workflow ID used. + +### Example log entry for sign-in authentication + +The following example shows a CloudTrail log entry for a successful user authentication event during web app sign-in using IAM Identity Center. + + + { + "eventVersion": "1.09", + "userIdentity": { + "type": "Unknown", + "principalId": "123456789012", + "arn": "", + "accountId": "123456789012", + "accessKeyId": "", + "userName": "demo-user-2", + "onBehalfOf": { + "userId": "f12bb510-a011-702f-10dd-5607e2776dbc", + "identityStoreArn": "arn:aws:identitystore::123456789012:identitystore/d-9a670c546e" + }, + "credentialId": "b41f0a02-1635-4d07-a414-aecf9e14b906" + }, + "eventTime": "2025-08-07T14:09:07Z", + "eventSource": "signin.amazonaws.com", + "eventName": "UserAuthentication", + "awsRegion": "us-east-2", + "sourceIPAddress": "192.0.2.14", + "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36", + "requestParameters": null, + "responseElements": null, + "additionalEventData": { + "AuthWorkflowID": "7a4ef12c-7c4b-4bc3-b5bd-c2469afcc795", + "LoginTo": "https://example.awsapps.com/start/", + "CredentialType": "PASSWORD" + }, + "requestID": "fc91bcf0-ac53-4454-a1a0-fb911eacc095", + "eventID": "18522007-1e60-4a71-b2b5-150baf504ab3", + "readOnly": false, + "eventType": "AWSServiceEvent", + "managementEvent": true, + "recipientAccountId": "123456789012", + "serviceEventDetails": { + "UserAuthentication": "Success" + }, + "eventCategory": "Management" + } + +In this example, note the following important fields: + + * `eventSource`: Shows "signin.amazonaws.com", indicating this is an IAM Identity Center authentication event. + + * `userIdentity.onBehalfOf`: Contains the user ID and identity store ARN for the web app user. + + * `additionalEventData.LoginTo`: Shows the IAM Identity Center application URL being accessed. + + * `additionalEventData.CredentialType`: Indicates the authentication method used (PASSWORD). + + * `serviceEventDetails`: Shows the authentication result (Success). + + + + +### Example log entry for ListCallerAccessGrants + +The following example shows a CloudTrail log entry for a ListCallerAccessGrants event, which occurs when Transfer Family web app queries available access grants for a user. + + + { + "eventVersion": "1.11", + "userIdentity": { + "type": "AssumedRole", + "principalId": "AROAEXAMPLEID:aws-transfer", + "arn": "arn:aws:sts::123456789012:assumed-role/AWSTransferWebAppIdentityBearer-us-east-2/aws-transfer", + "accountId": "123456789012", + "accessKeyId": "ASIAEXAMPLEKEY", + "sessionContext": { + "sessionIssuer": { + "type": "Role", + "principalId": "AROAEXAMPLEID", + "arn": "arn:aws:iam::123456789012:role/service-role/AWSTransferWebAppIdentityBearer-us-east-2", + "accountId": "123456789012", + "userName": "AWSTransferWebAppIdentityBearer-us-east-2" + }, + "attributes": { + "creationDate": "2025-08-08T15:29:34Z", + "mfaAuthenticated": "false" + } + }, + "invokedBy": "transfer.amazonaws.com", + "onBehalfOf": { + "userId": "f12bb510-a011-702f-10dd-5607e2776dbc", + "identityStoreArn": "arn:aws:identitystore::123456789012:identitystore/d-9a670c546e" + } + },