AWS managedservices medium security documentation change
Summary
Clarified CloudTrail trail deployment options during onboarding, added automatic trail management logic to prevent duplicate logging
Security assessment
The change explicitly addresses security logging configuration by ensuring only one active CloudTrail trail exists to maintain audit coverage and prevent gaps. The automatic removal of redundant trails prevents potential security visibility issues and misconfigurations that could occur from duplicate trails.
Diff
diff --git a/managedservices/latest/accelerate-guide/acc-log-mgmt.md b/managedservices/latest/accelerate-guide/acc-log-mgmt.md index 35d459c37..687ed1cb3 100644 --- a//managedservices/latest/accelerate-guide/acc-log-mgmt.md +++ b//managedservices/latest/accelerate-guide/acc-log-mgmt.md @@ -28 +28,12 @@ AMS Accelerate provides a range of operational services to help you achieve oper -AMS Accelerate relies on AWS CloudTrail logging in order to manage audits and compliance for all resources in your account. During onboarding, you choose whether Accelerate deploys a CloudTrail multi-region trail in your primary AWS Region or uses events generated by your account or Organization trail. If your account does not have a trail configured, then Accelerate will deploy a CloudTrail multi-region trail during onboarding. If you choose to integrate Accelerate with your CloudTrail trail, work with your Cloud Architect (CA) to review and configure your trail resources to [ Accelerate required configurations](https://docs.aws.amazon.com/managedservices/latest/accelerate-guide/acc-onb-trail-choices.html), and enable Accelerate to [use Athena to query and analyze events](https://docs.aws.amazon.com/managedservices/latest/accelerate-guide/acc-change-record.html). +AMS Accelerate requires AWS CloudTrail logging to manage audits and compliance for all resources in your account. While onboarding, you can choose one of the following options: + + * AMS deployed trail: If you choose this option, AMS creates, deploys, and manages a CloudTrail multi-Region trail in your primary AWS Region, independent of any existing trails in your account. + + * Bring your own trail: If you choose to provide your own account or organization CloudTrail trail, then you must work with your Cloud Architect (CA) to make sure it meet required configurations for Accelerate. If you choose this option but don’t provide your own trail, then Accelerate automatically deploys its own CloudTrail trail to maintain continuous security and audit coverage. If you provide your own trail later, AMS removes its deployed trail to avoid redundancy and additional costs. This approach helps maintain a single active CloudTrail trail in your account and prevents duplicate logging costs. + + + + +###### Note + +If your account has an existing CloudTrail trail and you have not specifically configured or requested an AMS managed trail during onboarding, AMS Accelerate automatically removes the AMS deployed trail from your account. This prevents duplicate logging, optimizes resource usage, and saves additional cost.