AWS awscloudtrail documentation change

Service: awscloudtrail · 2026-01-13 · Documentation low

File: awscloudtrail/latest/userguide/lake-query-generator.md

Summary

Added regional processing details and encryption information for CloudTrail's generative AI query summarization feature, including opt-out instructions.

Security assessment

The change documents security features including encrypted data transmission, regional data processing boundaries, and explicit opt-out mechanisms via IAM policies. It enhances transparency about data handling but doesn't address a specific vulnerability.

Diff

diff --git a/awscloudtrail/latest/userguide/lake-query-generator.md b/awscloudtrail/latest/userguide/lake-query-generator.md
index 6ec6e2f3c..e9d8bf837 100644
--- a//awscloudtrail/latest/userguide/lake-query-generator.md
+++ b//awscloudtrail/latest/userguide/lake-query-generator.md
@@ -24,0 +25,21 @@ This feature uses generative AI large language models (LLMs); we recommend doubl
+###### Note
+
+CloudTrail will automatically select the optimal region within your geography to process inference requests while summarizing queries. This maximizes available compute resources, model availability, and delivers the best customer experience. Your data will remain stored only in the region where the request originated, however, input prompts and output results may be processed outside that region. All data will be transmitted encrypted across Amazon's secure network.
+
+CloudTrail will securely route your inference requests to available compute resources within the geographic area where the request originated, as follows: 
+
+  * Inference requests originating in the United States will be processed within the United States
+
+  * Inference requests originating within Japan will be processed within Japan
+
+  * Inference requests originating in Australia will be processed within Australia.
+
+  * Inference requests originating in European Union will be processed within the European Union
+
+  * Inference requests originating in India will be processed within India
+
+
+
+
+To opt out of the query summarization feature, you can explicitly deny or remove the `cloudtrail:GenerateQueryResultsSummary` action from the iam policy you are using. 
+