AWS AmazonRDS documentation change
Summary
Removed the entire section 'Excluding Data API events from an AWS CloudTrail trail (Aurora Serverless v1 only)' which provided instructions and warnings about excluding Data API events from CloudTrail logs.
Security assessment
The change removes documentation about a feature (excluding Data API events from CloudTrail) that could impact auditability and security monitoring. However, there is no concrete evidence in the diff that this removal is directly related to a specific security vulnerability, weakness, or incident. The removal might be due to feature deprecation or documentation reorganization. The removed section did contain security warnings about obscuring actions and permission risks, but the change itself is removing that security documentation rather than adding it.
Diff
diff --git a/AmazonRDS/latest/AuroraUserGuide/logging-using-cloudtrail-data-api.md b/AmazonRDS/latest/AuroraUserGuide/logging-using-cloudtrail-data-api.md index 676d3566b..5f4a451bf 100644 --- a//AmazonRDS/latest/AuroraUserGuide/logging-using-cloudtrail-data-api.md +++ b//AmazonRDS/latest/AuroraUserGuide/logging-using-cloudtrail-data-api.md @@ -94,23 +93,0 @@ You can configure advanced event selectors to additionally filter on the `readOn -### Excluding Data API events from an AWS CloudTrail trail (Aurora Serverless v1 only) - -For Aurora Serverless v1, Data API events are management events. By default, all Data API events are included in an AWS CloudTrail trail. However, because Data API can generate a large number of events, you might want to exclude these events from your CloudTrail trail. The **Exclude Amazon RDS Data API events** setting excludes all Data API events from the trail. You can't exclude specific Data API events. - -To exclude Data API events from a trail, do the following: - - * In the CloudTrail console, choose the **Exclude Amazon RDS Data API events** setting when you [create a trail](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-create-a-trail-using-the-console-first-time.html) or [update a trail](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-update-a-trail-console.html). - - * In the CloudTrail API, use the [PutEventSelectors](https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_PutEventSelectors.html) operation. If you're using advanced event selectors, you can exclude Data API events by setting the `eventSource` field not equal to `rdsdata.amazonaws.com`. If you're using basic event selectors, you can exclude Data API events by setting the value of the `ExcludeManagementEventSources` attribute to `rdsdata.amazonaws.com`. For more information, see [Logging events with the AWS Command Line Interface](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-management-events-with-cloudtrail.html#creating-mgmt-event-selectors-with-the-AWS-CLI) in the _AWS CloudTrail User Guide_. - - - - -###### Warning - -Excluding Data API events from a CloudTrail log can obscure Data API actions. Be cautious when giving principals the `cloudtrail:PutEventSelectors` permission that is required to perform this operation. - -You can turn off this exclusion at any time by changing the console setting or the event selectors for a trail. The trail will then start recording Data API events. However, it can't recover Data API events that occurred while the exclusion was effective. - -When you exclude Data API events by using the console or API, the resulting CloudTrail `PutEventSelectors` API operation is also logged in your CloudTrail logs. If Data API events don't appear in your CloudTrail logs, look for a `PutEventSelectors` event with the `ExcludeManagementEventSources` attribute set to `rdsdata.amazonaws.com`. - -For more information, see [Logging management events for trails](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-management-events-with-cloudtrail.html) in the _AWS CloudTrail User Guide_. -