AWS AmazonCloudWatch documentation change
Summary
Added documentation for the new 'include_original' parameter in CloudWatch Logs sink configuration that preserves raw log events before transformation for audit/compliance purposes, and updated related guidance.
Security assessment
The change introduces documentation for a feature that preserves original log data for audit and compliance purposes, which is a security-related capability for maintaining data integrity and meeting regulatory requirements. However, there is no evidence this addresses a specific security vulnerability or incident.
Diff
diff --git a/AmazonCloudWatch/latest/monitoring/pipeline-sinks.md b/AmazonCloudWatch/latest/monitoring/pipeline-sinks.md index dbadb02f9..cd0fe80fc 100644 --- a//AmazonCloudWatch/latest/monitoring/pipeline-sinks.md +++ b//AmazonCloudWatch/latest/monitoring/pipeline-sinks.md @@ -41,0 +42,13 @@ The name of the CloudWatch Logs log group where processed events will be sent. F +`include_original` (optional) + + +When present, stores a copy of each raw log event before any transformation takes place. This preserves the original data for audit or compliance purposes. Specify as an empty object (`{}`). Available only for pipelines with `cloudwatch_logs` sources. At least one processor must be configured when this option is enabled. + +###### Example CloudWatch Logs sink with original log preservation + + + sink: + - cloudwatch_logs: + log_group: "@original" + include_original: {} + @@ -79 +92 @@ For pipelines using the `cloudwatch_logs` source type: - * Pipelines with processors mutate the log events in the original CloudWatch log group they are intercepted from for logs from AWS services. + * Pipelines with processors mutate the log events in the original CloudWatch log group they are intercepted from for logs from AWS services. To preserve the original data, enable `include_original` in the sink configuration. @@ -94 +107 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Processor compatibility and restrictions +Expression syntax for conditional processing