AWS awscloudtrail documentation change
Summary
Added documentation about backfill digest files including filename patterns and a new 'x-amz-meta-backfill-generation-timestamp' metadata property for signature validation.
Security assessment
These changes document new aspects of CloudTrail's log validation security feature (digest file structure). The timestamp metadata property specifically supports cryptographic signature validation, but there's no evidence this addresses a specific vulnerability.
Diff
diff --git a/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-digest-file-structure.md b/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-digest-file-structure.md index 1885b5d29..49b00a349 100644 --- a//awscloudtrail/latest/userguide/cloudtrail-log-file-validation-digest-file-structure.md +++ b//awscloudtrail/latest/userguide/cloudtrail-log-file-validation-digest-file-structure.md @@ -29,0 +30,9 @@ For organization trails, the bucket location also includes the organization unit +###### Note + +Backfill digest files are delivered when CloudTrail needs to include log files that were not referenced in the original digest due to processing delays. Backfill digest files use the `_backfill` suffix in their filename, as follows: + + + s3://amzn-s3-demo-bucket/optional-prefix/AWSLogs/aws-account-id/CloudTrail-Digest/ + region/digest-end-year/digest-end-month/digest-end-date/ + aws-account-id_CloudTrail-Digest_region_trail-name_region_digest_end_timestamp_backfill.json.gz + @@ -229,0 +239,6 @@ The following shows an example value of the algorithm used to generate the diges + * `x-amz-meta-backfill-generation-timestamp` + +The UTC timestamp when the backfill digest was generated. This metadata property is present only in backfill digest files and is used to identify the correct public key for signature validation. The following is an example timestamp: + +`2025-05-20T00:00:00.000Z` +