AWS waf medium security documentation change

Service: waf · 2026-01-25 · Security-related medium

File: waf/latest/developerguide/understanding-waf-entries.md

Summary

Added documentation about cross-account CloudTrail logging for specific WAF API operations

Security assessment

Documents security monitoring capabilities by clarifying cross-account audit trails for sensitive WAF operations, enhancing transparency for security teams

Diff

diff --git a/waf/latest/developerguide/understanding-waf-entries.md b/waf/latest/developerguide/understanding-waf-entries.md
index 90d347655..c310234c6 100644
--- a//waf/latest/developerguide/understanding-waf-entries.md
+++ b//waf/latest/developerguide/understanding-waf-entries.md
@@ -5 +5 @@
-Example: AWS WAF log file entriesExample: AWS WAF classic log file entries
+Cross-account CloudTrail eventsExample: AWS WAF log file entriesExample: AWS WAF classic log file entries
@@ -27,0 +28,19 @@ For more information, see [CloudTrail userIdentity Element](https://docs.aws.ama
+## Cross-account CloudTrail events
+
+For certain AWS WAF API operations that support cross-account access through resource-based policies, CloudTrail events are logged to both the caller account and the resource owner account. This applies to the following API operations:
+
+  * `CreateWebACL`
+
+  * `UpdateWebACL`
+
+  * `GetWebACL`
+
+  * `GetRuleGroup`
+
+  * `PutFirewallManagerRuleGroups`
+
+
+
+
+When these operations are performed across accounts, CloudTrail events are generated for both successful API calls and access denied calls in both the caller's account and the resource owner's account.
+