AWS IAM medium security documentation change
Summary
Updated CloudTrail logging documentation to clarify that denied AWS STS requests for cross-account role assumptions and privileged sessions via AssumeRoot API are not logged in the target account.
Security assessment
This change documents a security-relevant logging limitation: denied AWS STS requests for cross-account role assumptions and privileged sessions via AssumeRoot API are not logged in target accounts. This is directly related to security monitoring and audit capabilities, as it clarifies a gap in security logging for specific high-privilege operations.
Diff
diff --git a/IAM/latest/UserGuide/cloudtrail-integration.md b/IAM/latest/UserGuide/cloudtrail-integration.md index f228e0ca9..f8137e577 100644 --- a//IAM/latest/UserGuide/cloudtrail-integration.md +++ b//IAM/latest/UserGuide/cloudtrail-integration.md @@ -59 +59 @@ All IAM and AWS STS actions are logged by CloudTrail and are documented in the [ -CloudTrail logs all authenticated API requests to IAM and AWS STS API operations. CloudTrail also logs non-authenticated requests to the AWS STS actions, `AssumeRoleWithSAML` and `AssumeRoleWithWebIdentity`, and logs information provided by the identity provider. However, some non-authenticated AWS STS requests might not be logged because they do not meet the minimum expectation of being sufficiently valid to be trusted as a legitimate request. For cross-account role assumption requests, CloudTrail does not log denied AWS STS requests in the target account's CloudTrail. +CloudTrail logs all authenticated API requests to IAM and AWS STS API operations. CloudTrail also logs non-authenticated requests to the AWS STS actions, `AssumeRoleWithSAML` and `AssumeRoleWithWebIdentity`, and logs information provided by the identity provider. However, some non-authenticated AWS STS requests might not be logged because they do not meet the minimum expectation of being sufficiently valid to be trusted as a legitimate request. CloudTrail does not log denied AWS STS requests in the target account for cross-account role assumptions and privileged sessions initiated via the `AssumeRoot` API.