AWS AmazonECR documentation change
Summary
Added MountLayer API to CloudTrail logging events during image push with blob mounting enabled
Security assessment
The change enhances audit logging documentation by including blob mounting operations, improving security visibility. However, it's a feature update without evidence of addressing a specific security incident.
Diff
diff --git a/AmazonECR/latest/userguide/logging-using-cloudtrail.md b/AmazonECR/latest/userguide/logging-using-cloudtrail.md index 49e7c5bcd..abb409c9e 100644 --- a//AmazonECR/latest/userguide/logging-using-cloudtrail.md +++ b//AmazonECR/latest/userguide/logging-using-cloudtrail.md @@ -45 +45 @@ For an ongoing record of events in your AWS account, including events for Amazon -All Amazon ECR API actions are logged by CloudTrail and are documented in the [Amazon Elastic Container Registry API Reference](https://docs.aws.amazon.com/AmazonECR/latest/APIReference/). When you perform common tasks, sections are generated in the CloudTrail log files for each API action that is part of that task. For example, when you create a repository, `GetAuthorizationToken`, `CreateRepository` and `SetRepositoryPolicy` sections are generated in the CloudTrail log files. When you push an image to a repository, `InitiateLayerUpload`, `UploadLayerPart`, `CompleteLayerUpload`, and `PutImage` sections are generated. When you pull an image, `GetDownloadUrlForLayer` and `BatchGetImage` sections are generated. When you archive or restore an image `UpdateImageStorageClass` section is generated. When OCI clients that support the OCI 1.1 specification fetch the list of referrers, or reference artifacts, for an image using the Referrers API, a `ListImageReferrers` CloudTrail event is emitted. For examples of these common tasks, see CloudTrail log entry examples. +All Amazon ECR API actions are logged by CloudTrail and are documented in the [Amazon Elastic Container Registry API Reference](https://docs.aws.amazon.com/AmazonECR/latest/APIReference/). When you perform common tasks, sections are generated in the CloudTrail log files for each API action that is part of that task. For example, when you create a repository, `GetAuthorizationToken`, `CreateRepository` and `SetRepositoryPolicy` sections are generated in the CloudTrail log files. When you push an image to a repository, `InitiateLayerUpload`, `UploadLayerPart`, `CompleteLayerUpload`, `PutImage`, and, if blob mounting is enabled, `MountLayer` sections are generated. When you pull an image, `GetDownloadUrlForLayer` and `BatchGetImage` sections are generated. When you archive or restore an image `UpdateImageStorageClass` section is generated. When OCI clients that support the OCI 1.1 specification fetch the list of referrers, or reference artifacts, for an image using the Referrers API, a `ListImageReferrers` CloudTrail event is emitted. For examples of these common tasks, see CloudTrail log entry examples.