AWS awscloudtrail documentation change
Summary
Added Important note clarifying that deleting a CloudTrail trail does not delete associated S3/CloudWatch resources and explains logging impacts
Security assessment
The change adds documentation about the security implications of trail deletion (preserving logs) but does not address a specific vulnerability. It improves awareness of logging persistence, which supports security best practices.
Diff
diff --git a/awscloudtrail/latest/userguide/cloudtrail-additional-cli-commands.md b/awscloudtrail/latest/userguide/cloudtrail-additional-cli-commands.md index 1db6ed922..0ccdc60b7 100644 --- a//awscloudtrail/latest/userguide/cloudtrail-additional-cli-commands.md +++ b//awscloudtrail/latest/userguide/cloudtrail-additional-cli-commands.md @@ -809,0 +810,6 @@ You can delete a trail with the following command. You can delete a trail only i +###### Important + +While deleting a CloudTrail trail is an irreversible action, CloudTrail does not delete log files in the Amazon S3 bucket for that trail, the Amazon S3 bucket itself, or the CloudWatch log group to which the trail delivers events. Deleting a multi-Region trail will stop logging of events in all AWS Regions enabled in your AWS account. Deleting a single-Region trail will stop logging of events in that Region only. It will not stop logging of events in other Regions even if the trails in those other Regions have identical names to the deleted trail. + +For information about account closure and deletion of CloudTrail trails, see [AWS account closure and trails](./cloudtrail-account-closure.html). +