AWS awscloudtrail documentation change
Summary
Added clarification about delayed event delivery after logging is stopped and event selector behavior
Security assessment
The change explains CloudTrail's behavior regarding delayed event delivery after logging stops, which is operational documentation rather than addressing a security flaw. While it affects audit logging visibility, there is no evidence of a vulnerability being patched.
Diff
diff --git a/awscloudtrail/latest/userguide/cloudtrail-additional-cli-commands.md b/awscloudtrail/latest/userguide/cloudtrail-additional-cli-commands.md index 0ccdc60b7..f2f0b309e 100644 --- a//awscloudtrail/latest/userguide/cloudtrail-additional-cli-commands.md +++ b//awscloudtrail/latest/userguide/cloudtrail-additional-cli-commands.md @@ -803,0 +804,6 @@ If you stop logging or delete a trail, CloudTrail Insights is disabled on that t +###### Event delivery after logging is stopped + +After you stop logging for a trail, the trail can still receive events that occurred before logging was stopped. Events can be delayed for a number of reasons, including high network traffic, connectivity issues, a service outage, or updates to existing events. CloudTrail uses the most recent time that logging was stopped to determine whether to deliver delayed events, rather than the logging state of the trail at the time the event occurred. As a result, delayed events that occurred before logging was last stopped can still be delivered to the trail. For more information about delayed event delivery, see the `addendum` field in [CloudTrail record contents for management, data, and network activity events](./cloudtrail-event-reference-record-contents.html). + +Additionally, event selectors and advanced event selectors are not evaluated for delayed events delivered to a trail after logging is stopped. This means that a trail can receive any type of event that occurred before logging was stopped, regardless of the trail's event selector configuration. +