AWS awscloudtrail documentation change
Summary
Added deprecation notice for CloudTrail Lake and updated migration instructions, removing CLI usage notes including permissions and regionality requirements.
Security assessment
The changes announce service deprecation and adjust migration steps, but there is no evidence of a security vulnerability being addressed. The removal of CLI notes about permissions and regionality could impact security awareness, but it is not directly tied to a security issue.
Diff
diff --git a/awscloudtrail/latest/userguide/cloudtrail-lake-service-availability-change.md b/awscloudtrail/latest/userguide/cloudtrail-lake-service-availability-change.md index 7f83ee795..34619af00 100644 --- a//awscloudtrail/latest/userguide/cloudtrail-lake-service-availability-change.md +++ b//awscloudtrail/latest/userguide/cloudtrail-lake-service-availability-change.md @@ -8,0 +9,4 @@ Continued support for existing event data storesMigration optionsComparing archi +###### Note + +AWS CloudTrail Lake will no longer be open to new customers starting on May 31, 2026. For capabilities similar to CloudTrail Lake, explore CloudWatch. + @@ -146 +150 @@ You will need the Amazon Resource Name (ARN) of your CloudTrail Lake Event Data -Use the `logs` service to create the task. You must specify the destination log group, the source ARN, and the source type. +Use the `logs` service to create the task. You must specify the source ARN of the Event Data Store. @@ -173,11 +176,0 @@ Because the import is asynchronous, you can check the progress of the migration -###### Important Notes for CLI Usage - - * **Permissions:** The IAM entity executing this command must have `logs:CreateImportTask` permissions. - - * **Regionality:** Ensure that both the CloudTrail Lake Event Data Store and the CloudWatch Log Group are in the same AWS Region, or specify the `--region` flag in your command. - - * **Log Group Existence:** The destination log group must already exist before you start the import task. You can create one using `aws logs create-log-group --log-group-name `name``. - - - -