AWS awscloudtrail documentation change
Summary
Added Data events Insights support and updated CLI examples with EventCategories configuration
Security assessment
Expands documentation for security monitoring capabilities (Insights on data events) but does not address a specific vulnerability. Enhances visibility into API call/error rates for data events, which supports security monitoring.
Diff
diff --git a/awscloudtrail/latest/userguide/insights-events-CLI-enable.md b/awscloudtrail/latest/userguide/insights-events-CLI-enable.md index 51c002289..84b739696 100644 --- a//awscloudtrail/latest/userguide/insights-events-CLI-enable.md +++ b//awscloudtrail/latest/userguide/insights-events-CLI-enable.md @@ -13 +13,3 @@ You can configure your trails and event data stores to log Insights events using -To log Insights events on the API call rate, the trail or event data store must log `write` management events. To log Insights events on the API error rate, the trail or event data store must log `read` or `write` management events. +For Management events Insights: To log Insights events on the API call rate, the trail or event data store must log `write` management events. To log Insights events on the API error rate, the trail or event data store must log `read` or `write` management. + +For Data events Insights: To log Insights events on the API call rate or API error rate, the trail must log `read` or `write` data events. @@ -38 +40,5 @@ The following example response shows the Insights selectors for a trail named `i - "InsightType": "ApiCallRateInsight" + "InsightType": "ApiCallRateInsight", + "EventCategories": [ + "Management", + "Data" + ] @@ -41 +47,5 @@ The following example response shows the Insights selectors for a trail named `i - "InsightType": "ApiErrorRateInsight" + "InsightType": "ApiErrorRateInsight", + "EventCategories": [ + "Management", + "Data" + ] @@ -48 +58 @@ If the trail does not have Insights enabled, the **get-insight-selectors** comma -To configure your trail to log Insights events, run the `put-insight-selectors` command. The following example shows how to configure your trail to include Insights events. Insights selector values can be `ApiCallRateInsight`, `ApiErrorRateInsight`, or both. +To configure your trail to log Insights events, run the `put-insight-selectors` command. The following example shows how to configure your trail to include Insights events. Insights selector values can be `ApiCallRateInsight`, `ApiErrorRateInsight`, or both. Each InsightType can be enabled for management EventCategory or data EventCategory or both. @@ -51 +61 @@ To configure your trail to log Insights events, run the `put-insight-selectors` - aws cloudtrail put-insight-selectors --trail-name TrailName --insight-selectors '[{"InsightType": "ApiCallRateInsight"},{"InsightType": "ApiErrorRateInsight"}]' + aws cloudtrail put-insight-selectors --trail-name TrailName --insight-selectors '[{"InsightType": "ApiCallRateInsight", "EventCategories": ["Data"]},{"InsightType": "ApiErrorRateInsight", "EventCategories": ["Data", "Management"]}]' @@ -61 +71,4 @@ The following result shows the Insights event selector that is configured for th - "InsightType": "ApiErrorRateInsight" + "InsightType": "ApiErrorRateInsight", + "EventCategories": [ + "Data" + ] @@ -64 +77,5 @@ The following result shows the Insights event selector that is configured for th - "InsightType": "ApiCallRateInsight" + "InsightType": "ApiCallRateInsight", + "EventCategories": [ + "Data", + "Management" + ]