AWS awscloudtrail documentation change
Summary
Updated documentation to clarify CloudTrail Insights cost calculations for both management and data events. Added details about data events Insights being trail-only, introduced new billing usage type (DataInsightsEvents), and added a new example scenario analyzing data events.
Security assessment
The changes focus on cost calculation details and feature availability (data events Insights being trail-only). There is no evidence of addressing security vulnerabilities or describing security controls. The updates are operational/financial in nature rather than security-related.
Diff
diff --git a/awscloudtrail/latest/userguide/insights-events-costs.md b/awscloudtrail/latest/userguide/insights-events-costs.md index b98e61b03..13bc14cf4 100644 --- a//awscloudtrail/latest/userguide/insights-events-costs.md +++ b//awscloudtrail/latest/userguide/insights-events-costs.md @@ -7 +7 @@ -When you enable Insights events on an existing trail or event data store, CloudTrail analyzes the past 28 days of management events collected by the trail or event data store to establish a baseline of normal activity. After the initial baseline is created, the baseline is recalculated every day on the past 28 days of data. There are no CloudTrail charges for the baseline analysis. +###### Note @@ -9 +9 @@ When you enable Insights events on an existing trail or event data store, CloudT -After the baseline analysis, you incur CloudTrail charges for any future management events analyzed by CloudTrail. You incur charges based on the number of management events analyzed for the enabled Insights types. +Insights events on data events are only supported on trails. @@ -11 +11 @@ After the baseline analysis, you incur CloudTrail charges for any future managem -If you choose to log both Insights types for a trail or event data store that logs `read` and `write` management events, the total number of events analyzed will be greater than the total number of recorded management events. This is because CloudTrail will analyze the write-only management events twice, once for calculating the API call rate and again for determining the API error rate. The read-only management events will be analyzed once to calculate the API error rate. +When you enable Insights events on an existing trail or event data store, CloudTrail analyzes the past 28 days of management and data events collected by the trail or event data store to establish a baseline of normal activity. After the initial baseline is created, the baseline is recalculated every day on the past 28 days of data. There are no CloudTrail charges for the baseline analysis. @@ -13 +13 @@ If you choose to log both Insights types for a trail or event data store that lo -You can identify the charges for Insights events on your bill by looking for the `InsightsEvents` usage type. For more information, see [Viewing your CloudTrail cost and usage with AWS Cost Explorer](./cloudtrail-costs.html). +After the baseline analysis, you incur CloudTrail charges for any future management and data events analyzed by CloudTrail. You incur charges based on the number of management and data events analyzed for the enabled Insights types. @@ -15 +15 @@ You can identify the charges for Insights events on your bill by looking for the -You will incur separate Insights events charges for each trail and event data store with Insights enabled. For more information about pricing, see [AWS CloudTrail Pricing](https://aws.amazon.com/cloudtrail/pricing/). +If you choose to log both API call rate and API error rate Insights types for management events for a trail or event data store that logs `read` and `write` management events, the total number of events analyzed will be greater than the total number of recorded management events. This is because CloudTrail will analyze the write-only management events twice, once for calculating the API call rate and again for determining the API error rate. The read-only management events will be analyzed once to calculate the API error rate. @@ -17 +17 @@ You will incur separate Insights events charges for each trail and event data st -**Example 1 – Enable Insights for API call rate and API error rate on a trail** +Similarly, if you choose to log both API call rate and API error rate Insights types for data events for a trail that logs `read` and `write` data events, the total number of events analyzed will be greater than the total number of recorded data events. This is because CloudTrail will analyze all data events twice, once for calculating the API call rate and again for determining the API error rate. @@ -19 +19,7 @@ You will incur separate Insights events charges for each trail and event data st -In this first example, you enable Insights on a trail and choose to collect both Insights types. The trail in this example is logging both `read` and `write` management events. +You can identify the charges for Insights for management and data events on your bill by looking for the `InsightsEvents` and `DataInsightsEvents` usage type respectively. For more information, see [Viewing your CloudTrail cost and usage with AWS Cost Explorer](./cloudtrail-costs.html). + +You will incur separate Insights charges for both trails and event data stores, and separate data events Insights for trails. For more information about pricing, see [AWS CloudTrail Pricing](https://aws.amazon.com/cloudtrail/pricing/). + +**Example 1 – Enable Insights on management events for API call rate and API error rate on a trail** + +In this first example, you enable Insights on a trail logging management events and choose to collect both Insights types. The trail in this example is logging both `read` and `write` management events. @@ -34 +40 @@ In this first example, you enable Insights on a trail and choose to collect both -**Example 2 – Enable Insights for two trails** +**Example 2 – Enable Insights on management events for two trails** @@ -36 +42 @@ In this first example, you enable Insights on a trail and choose to collect both -In this next example, you enable Insights on two trails, trail A and trail B. You choose to enable API call rate Insights only on trail A and API error rate Insights only on trail B. Both trails log `read` and `write` management events. +In this next example, you enable Insights on two trails logging management events, trail A and trail B. You choose to enable API call rate Insights only on trail A and API error rate Insights only on trail B. Both trails log `read` and `write` management events. @@ -61 +67 @@ For trail B, the following analysis occurs: -**Example 3 – Enable Insights for API call rate and API error rate on a trail and an event data store** +**Example 3 – Enable Insights on management events for API call rate and API error rate on a trail and an event data store** @@ -63 +69 @@ For trail B, the following analysis occurs: -In this final example, you enable Insights for API call rate and API error rate on both a trail and an event data store. Both the trail and event data store are logging `read` and `write` management events. You will incur charges for CloudTrail Insights for the trail and event data store separately as you enabled Insights on both. +In this example, you enable Insights for API call rate and API error rate on both a trail and an event data store logging management events. Both the trail and event data store are logging `read` and `write` management events. You will incur charges for CloudTrail Insights for the trail and event data store separately as you enabled Insights on both. @@ -87,0 +94,17 @@ For the event data store, the following analysis occurs: +**Example 4 – Enable management events Insights and data events Insights for API call rate and API error rate on a trail** + +In this final example, you enable Insights on management and data events. The trail in this example is logging `read` and `write` management and data events. + + * CloudTrail analyzes the management and data events logged in the past 28 days to form a baseline. There are no CloudTrail charges for the analysis. + + * After the baseline is created, the trail logs 300,000 management events, of which 270,000 are read management events and 30,000 are write management events. The trail also logs 400,000 data events, of which 340,000 are read data events and 60,000 are write data events. + + * The `write` management events are analyzed twice, once for the API call rate and once for the API error rate (30,000 * 2=60,000). The `read` management events are analyzed once for the API error rate (270,000 *1=270,000). The total management events analyzed is 330,000 (60,000 + 270,000). + + * The `read` and `write` data events are analyzed twice, once for the API call rate and once for the API error rate (400,000 * 2). The total data events analyzed is 800,000. + + * You will incur costs for analyzing 1,130,000 management and data events for this trail. + + + +