AWS awscloudtrail documentation change
Summary
Added details about event delivery behavior after logging is turned off and event selector limitations
Security assessment
Clarifies operational behavior of CloudTrail post-logging disablement but does not address or document security vulnerabilities/protections. Changes are informational rather than security-focused.
Diff
diff --git a/awscloudtrail/latest/userguide/cloudtrail-turning-off-logging.md b/awscloudtrail/latest/userguide/cloudtrail-turning-off-logging.md index 2fa0956c8..a8993cf7f 100644 --- a//awscloudtrail/latest/userguide/cloudtrail-turning-off-logging.md +++ b//awscloudtrail/latest/userguide/cloudtrail-turning-off-logging.md @@ -12,0 +13,6 @@ When you turn off logging, existing logs are still stored in the trail's Amazon +###### Event delivery after logging is stopped + +After you turn off logging for a trail, the trail can still receive events that occurred before logging was turned off. Events can be delayed for a number of reasons, including high network traffic, connectivity issues, a service outage, or updates to existing events. CloudTrail uses the most recent time that logging was turned off to determine whether to deliver delayed events, rather than the logging state of the trail at the time the event occurred. As a result, delayed events that occurred before logging was last turned off can still be delivered to the trail. For more information about delayed event delivery, see the `addendum` field in [CloudTrail record contents for management, data, and network activity events](./cloudtrail-event-reference-record-contents.html). + +Additionally, event selectors and advanced event selectors are not evaluated for delayed events delivered to a trail after logging is turned off. This means that a trail can receive any type of event that occurred before logging was turned off, regardless of the trail's event selector configuration. +