AWS AmazonCloudWatch documentation change
Summary
Updated processor compatibility requirements to enforce 'Must be first processor' placement for multiple processors across all source types, and clarified parser processor placement rules.
Security assessment
The changes enforce stricter pipeline configuration rules but do not explicitly reference security vulnerabilities or exploits. The updates focus on ensuring correct processing order for data parsing reliability rather than addressing documented security flaws.
Diff
diff --git a/AmazonCloudWatch/latest/monitoring/processor-compatibility.md b/AmazonCloudWatch/latest/monitoring/processor-compatibility.md index 14f4a9ac3..01aadb5f1 100644 --- a//AmazonCloudWatch/latest/monitoring/processor-compatibility.md +++ b//AmazonCloudWatch/latest/monitoring/processor-compatibility.md @@ -19 +19 @@ Parser placement -Parser processors (OCSF, CSV, Grok, etc.) must be the first processor in a pipeline. +Parser processors (OCSF, CSV, Grok, etc.), if used, must be the first processor in a pipeline. @@ -33 +33 @@ The following processors can appear only once per pipeline: -Source compatibility matrix Processor Type | CloudWatch Logs Source | S3 Source | API-based Sources +Processor Type | CloudWatch Logs Source | S3 Source | API-based Sources @@ -35 +35 @@ Source compatibility matrix Processor Type | CloudWatch Logs Source | S3 Source -OCSF | Compatible with CloudTrail only | Fully compatible | Compatible with specific schemas +OCSF | Must be first processor | Must be first processor | Must be first processor @@ -38,2 +38,2 @@ parse_route53 | Must be first processor | Not applicable | Not applicable -parse_json | Must be first processor | Fully compatible | Fully compatible -grok | Must be first processor | Fully compatible | Fully compatible +parse_json | Must be first processor | Must be first processor | Must be first processor +grok | Must be first processor | Must be first processor | Must be first processor @@ -41,6 +41,6 @@ csv | Must be first processor | Not compatible | Not compatible -key_value | Must be first processor | Fully compatible | Fully compatible -add_entries | Compatible (max 1) | Compatible (max 1) | Compatible (max 1) -copy_values | Compatible (max 1) | Compatible (max 1) | Compatible (max 1) -String processors (lowercase, uppercase, trim) | Fully compatible | Fully compatible | Fully compatible -Field processors (move_keys, rename_keys) | Fully compatible | Fully compatible | Fully compatible -Data transformation (date, flatten) | Fully compatible | Fully compatible | Fully compatible +key_value | Must be first processor | Must be first processor | Must be first processor +add_entries | Must be first processor | Must be first processor | Must be first processor +copy_values | Must be first processor | Must be first processor | Must be first processor +String processors (lowercase, uppercase, trim) | Must be first processor | Must be first processor | Must be first processor +Field processors (move_keys, rename_keys) | Must be first processor | Must be first processor | Must be first processor +Data transformation (date, flatten) | Must be first processor | Must be first processor | Must be first processor @@ -50,5 +49,0 @@ Data transformation (date, flatten) | Fully compatible | Fully compatible | Full -Fully compatible - - -Can be used without restrictions with the source type - @@ -60,5 +54,0 @@ When used, must be the first processor in the pipeline configuration -Compatible with restrictions - - -Can be used but has specific limitations or requirements - @@ -97 +87 @@ parse_vpc | CloudWatch Logs | - * Source field must contain raw VPC Flow Log format + * Input must contain raw VPC Flow Log format @@ -104 +94 @@ parse_route53 | CloudWatch Logs | - * Source field must contain Route 53 Resolver query log format + * Input must contain Route 53 Resolver query log format