AWS eventbridge documentation change
Summary
Updated CloudTrail logging documentation to add comprehensive coverage of data events, including new sections on data event logging, updated tables for resource types, and detailed examples of PutEvents, PutPartnerEvents, and global endpoint events.
Security assessment
The changes enhance security documentation by detailing how to log data events (PutEvents and PutPartnerEvents) which are critical for security auditing and monitoring. It explicitly notes that the 'detail' field is redacted in CloudTrail logs to protect sensitive data, and provides guidance on configuring advanced event selectors for better security monitoring. However, there is no evidence this addresses a specific security vulnerability or incident.
Diff
diff --git a/eventbridge/latest/userguide/logging-using-cloudtrail.md b/eventbridge/latest/userguide/logging-using-cloudtrail.md index 000556906..df61b4e00 100644 --- a//eventbridge/latest/userguide/logging-using-cloudtrail.md +++ b//eventbridge/latest/userguide/logging-using-cloudtrail.md @@ -7 +7 @@ -Management eventsEvent examplesEvents for Pipe actions +Management eventsData eventsManagement event examplesData event examplesEvents for Pipe actions @@ -48 +48 @@ CloudTrail Lake event data stores and queries incur costs. When you create an ev -Amazon EventBridge logs all EventBridge control plane operations as management events. For a list of the Amazon EventBridge control plane operations that EventBridge logs to CloudTrail, see the [Amazon EventBridge API Reference](https://docs.aws.amazon.com/eventbridge/latest/APIReference/Welcome.html). +All Amazon EventBridge API operations except [PutEvents](https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_PutEvents.html) and [PutPartnerEvents](https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_PutPartnerEvents.html) are control plane operations. For a complete list, see [Actions](https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_Operations.html) in the _Amazon EventBridge API Reference_. For example management events, see EventBridge management event examples. @@ -50 +50 @@ Amazon EventBridge logs all EventBridge control plane operations as management e -The following table lists the EventBridge resource types for which you can log events. The **Event type (console)** column shows the value to choose from the **Event type** list on the CloudTrail console. The **APIs logged to CloudTrail** column shows the API calls logged to CloudTrail for the resource type. +## EventBridge data events in CloudTrail @@ -52,3 +52 @@ The following table lists the EventBridge resource types for which you can log e -Event type (console) | APIs logged to CloudTrail ----|--- -**Event bus** | +[Data events](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html#logging-data-events) provide information about the resource operations performed on or in a resource (for example, publishing events to an event bus). These are also known as data plane operations. Data events are often high-volume activities. By default, CloudTrail doesn't log data events. The CloudTrail **Event history** doesn't record data events. @@ -56 +54 @@ Event type (console) | APIs logged to CloudTrail - * [DescribeEventBus](https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DescribeRule.html) +Additional charges apply for data events. For more information about CloudTrail pricing, see [AWS CloudTrail Pricing](https://aws.amazon.com/cloudtrail/pricing/). @@ -57,0 +56 @@ Event type (console) | APIs logged to CloudTrail +You can log data events for the EventBridge resource types by using the CloudTrail console, AWS CLI, or CloudTrail API operations. For more information about how to log data events, see [Logging data events with the AWS Management Console](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html#logging-data-events-console) and [Logging data events with the AWS Command Line Interface](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html#creating-data-event-selectors-with-the-AWS-CLI) in the _AWS CloudTrail User Guide_. @@ -59 +58 @@ Event type (console) | APIs logged to CloudTrail -**Event bus rule** | +The following table lists the EventBridge resource types for which you can log data events. The **Resource type (console)** column shows the value to choose from the **Resource type** list on the CloudTrail console. The **resources.type value** column shows the `resources.type` value, which you would specify when configuring advanced event selectors using the AWS CLI or CloudTrail APIs. The **Data APIs logged to CloudTrail** column shows the API calls logged to CloudTrail for the resource type. @@ -61,11 +60,3 @@ Event type (console) | APIs logged to CloudTrail - * [DeleteRule](https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DeleteRule.html) - * [DescribeRule](https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DescribeRule.html) - * [DisableRule](https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DisableRule.html) - * [EnableRule](https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_EnableRule.html) - * [ListRuleNamesByTarget](https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_ListRuleNamesByTarget.html) - * [ListRules](https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_ListRules.html) - * [ListTargetsByRule](https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_ListTargetsByRule.html) - * [PutRule](https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_PutRule.html) - * [PutTargets](https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_PutTargets.html) - * [RemoveTargets](https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_RemoveTargets.html) - * [TestEventPattern](https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_TestEventPattern.html) +Resource type (console) | resources.type value | Data APIs logged to CloudTrail +---|---|--- +**EventBridge event bus** | `AWS::Events::EventBus` | @@ -72,0 +64 @@ Event type (console) | APIs logged to CloudTrail + * [PutEvents](https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_PutEvents.html) @@ -74 +65,0 @@ Event type (console) | APIs logged to CloudTrail -**Pipe** | @@ -76,7 +67 @@ Event type (console) | APIs logged to CloudTrail - * [CreatePipe](https://docs.aws.amazon.com/eventbridge/latest/pipes-reference/API_CreatePipe.html) - * [DeletePipe](https://docs.aws.amazon.com/eventbridge/latest/pipes-reference/API_DeletePipe.html) - * [DescribePipe](https://docs.aws.amazon.com/eventbridge/latest/pipes-reference/API_DescribePipe.html) - * [ListPipes](https://docs.aws.amazon.com/eventbridge/latest/pipes-reference/API_ListPipes.html) - * [StartPipe](https://docs.aws.amazon.com/eventbridge/latest/pipes-reference/API_StartPipe.html) - * [StopPipe](https://docs.aws.amazon.com/eventbridge/latest/pipes-reference/API_StopPipe.html) - * [UpdatePipe](https://docs.aws.amazon.com/eventbridge/latest/pipes-reference/API_UpdatePipe.html) +**EventBridge partner event source** | `AWS::Events::EventSource` | @@ -83,0 +69 @@ Event type (console) | APIs logged to CloudTrail + * [PutPartnerEvents](https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_PutPartnerEvents.html) @@ -86 +72,19 @@ Event type (console) | APIs logged to CloudTrail -## EventBridge event examples +**EventBridge endpoint** | `AWS::Events::Endpoint` | + + * [PutEvents](https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_PutEvents.html) (when using a [global endpoint](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-global-endpoints.html); successful calls only, not populated on `AccessDenied`) + + + +You can configure advanced event selectors to filter on the `eventName`, `readOnly`, and `resources.ARN` fields to log only those events that are important to you. For more information about these fields, see [AdvancedFieldSelector](https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_AdvancedFieldSelector.html) in the _AWS CloudTrail API Reference_. + +###### Note + +Data events are delivered only to the AWS account of the API caller. If you send events to a cross-account event bus, the resource owner's account does not receive a CloudTrail data event. + +###### Note + +The `detail` field in event entries is redacted in CloudTrail data event logs to protect sensitive data. + +For examples of data events that EventBridge logs to CloudTrail, see EventBridge data event examples. + +## EventBridge management event examples @@ -132,0 +137,217 @@ For information about CloudTrail record contents, see [CloudTrail record content +## EventBridge data event examples + +The following example shows a CloudTrail data event for a successful `PutEvents` call. + + + { + "eventVersion": "1.11", + "userIdentity": { + "type": "AssumedRole", + "principalId": "AROA3XFRBF23EXAMPLE:johndoe-session", + "arn": "arn:aws:sts::111122223333:assumed-role/MyRole/johndoe-session", + "accountId": "111122223333", + "accessKeyId": "AKIAIOSFODNN7EXAMPLE", + "sessionContext": { + "sessionIssuer": { + "type": "Role", + "principalId": "AROA3XFRBF23EXAMPLE", + "arn": "arn:aws:iam::111122223333:role/MyRole", + "accountId": "111122223333", + "userName": "MyRole" + }, + "attributes": { + "creationDate": "2026-03-07T00:49:09Z", + "mfaAuthenticated": "false" + } + } + }, + "eventTime": "2026-03-07T00:51:07Z", + "eventSource": "events.amazonaws.com", + "eventName": "PutEvents", + "awsRegion": "us-east-1", + "sourceIPAddress": "192.0.2.1", + "userAgent": "aws-cli/2.33.13", + "requestParameters": { + "entries": [ + { + "source": "my-application", + "detailType": "MyDetailType", + "detail": "HIDDEN_DUE_TO_SECURITY_REASONS", + "eventBusName": "default" + } + ] + }, + "responseElements": { + "failedEntryCount": 0, + "entries": [ + { + "eventId": "a1b2c3d4-5678-90ab-cdef-EXAMPLE11111" + } + ] + }, + "requestID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE22222", + "eventID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE33333", + "readOnly": false, + "resources": [ + { + "type": "AWS::Events::EventBus", + "ARN": "arn:aws:events:us-east-1:111122223333:event-bus/default" + } + ], + "eventType": "AwsApiCall", + "apiVersion": "2015-10-07", + "managementEvent": false, + "recipientAccountId": "111122223333", + "eventCategory": "Data", + "tlsDetails": { + "tlsVersion": "TLSv1.3", + "cipherSuite": "TLS_AES_128_GCM_SHA256", + "clientProvidedHostHeader": "events.us-east-1.amazonaws.com" + } + } + +The following example shows a CloudTrail data event for a `PutEvents` call using a [global endpoint](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-global-endpoints.html). Note the additional `AWS::Events::Endpoint` resource in the `resources` array. + + + { + "eventVersion": "1.11", + "userIdentity": { + "type": "AssumedRole", + "principalId": "AROA3XFRBF23EXAMPLE:johndoe-session", + "arn": "arn:aws:sts::111122223333:assumed-role/MyRole/johndoe-session", + "accountId": "111122223333", + "accessKeyId": "AKIAIOSFODNN7EXAMPLE", + "sessionContext": { + "sessionIssuer": { + "type": "Role", + "principalId": "AROA3XFRBF23EXAMPLE", + "arn": "arn:aws:iam::111122223333:role/MyRole", + "accountId": "111122223333", + "userName": "MyRole" + }, + "attributes": { + "creationDate": "2026-03-07T00:49:09Z", + "mfaAuthenticated": "false" + } + } + }, + "eventTime": "2026-03-07T00:51:06Z", + "eventSource": "events.amazonaws.com", + "eventName": "PutEvents", + "awsRegion": "us-east-1", + "sourceIPAddress": "192.0.2.1", + "userAgent": "aws-cli/2.33.13", + "requestParameters": { + "entries": [ + { + "source": "my-application", + "detailType": "MyDetailType", + "detail": "HIDDEN_DUE_TO_SECURITY_REASONS", + "eventBusName": "default" + } + ], + "endpointId": "abc1234567.us-east-1" + }, + "responseElements": { + "failedEntryCount": 0, + "entries": [ + { + "eventId": "a1b2c3d4-5678-90ab-cdef-EXAMPLE44444" + } + ] + },