AWS AmazonCloudWatch documentation change

Service: AmazonCloudWatch · 2026-04-01 · Documentation low

File: AmazonCloudWatch/latest/monitoring/telemetry-config-rules.md

Summary

Added telemetry configuration rules for AWS Security Hub, Amazon Bedrock Agentcore Gateway, Amazon Bedrock Agentcore Memory, and Amazon CloudFront Distribution, including log group patterns and conditions for enabling log deliveries.

Security assessment

The change documents how to configure telemetry for AWS Security Hub and other services, which includes security-related logging. It provides operational guidance but does not address a specific security vulnerability.

Diff

diff --git a/AmazonCloudWatch/latest/monitoring/telemetry-config-rules.md b/AmazonCloudWatch/latest/monitoring/telemetry-config-rules.md
index c7e0c2591..1998ba8f0 100644
--- a//AmazonCloudWatch/latest/monitoring/telemetry-config-rules.md
+++ b//AmazonCloudWatch/latest/monitoring/telemetry-config-rules.md
@@ -227,0 +228,2 @@ When enabling resolver query logging:
+  * You can use <account-id> macros to split log groups.
+
@@ -288,0 +291,46 @@ When enabling detailed monitoring:
+**AWS Security Hub Telemetry**
+    
+
+When enabling Security Hub logging:
+
+  * Uses managed CloudWatch log group pattern /aws/securityhub_cspm/findings 
+
+  * CloudWatch does not enable log deliveries for Security Hub that already are ingesting logs to manged CloudWatch Logs
+
+
+
+
+**Amazon Bedrock Agentcore Gateway Telemetry**
+    
+
+When enabling Bedrock Agentcore Gateway logging:
+
+  * Uses default CloudWatch log group pattern /aws/bedrock/agentcore if none specified
+
+  * CloudWatch does not enable log deliveries for Bedrock Agentcore Gateway that already are ingesting logs to CloudWatch Logs
+
+
+
+
+**Amazon Bedrock Agentcore Memory Telemetry**
+    
+
+When enabling Bedrock Agentcore Memory logging:
+
+  * Uses default CloudWatch log group pattern /aws/bedrock/agentcore if none specified
+
+  * CloudWatch does not enable log deliveries for Bedrock Agentcore Memory that already are ingesting logs to CloudWatch Logs
+
+
+
+
+**Amazon CloudFront Distribution Telemetry**
+    
+
+When enabling CloudFront Distribution logging:
+
+  * CloudWatch does not enable log deliveries for CloudFront distributions that already are ingesting logs to CloudWatch Logs
+
+
+
+