AWS eventbridge documentation change
Summary
Added documentation for 'AWS Network Activity Event via CloudTrail' and clarified event delivery rules for CloudTrail events.
Security assessment
Introduces documentation for network activity events (security-relevant for monitoring VPC endpoint traffic) and explicitly details security-related event handling requirements (e.g., rule states for management/data events). This enhances security visibility but doesn't address a specific vulnerability.
Diff
diff --git a/eventbridge/latest/userguide/eb-service-event-cloudtrail.md b/eventbridge/latest/userguide/eb-service-event-cloudtrail.md index ad978be1d..84963eb37 100644 --- a//eventbridge/latest/userguide/eb-service-event-cloudtrail.md +++ b//eventbridge/latest/userguide/eb-service-event-cloudtrail.md @@ -42,0 +43,6 @@ For more information, see [CloudTrail Insights](https://docs.aws.amazon.com/awsc + * `AWS Network Activity Event via CloudTrail` + +Network activity events capture API calls made through VPC endpoints from private VPCs. These events require a trail configured with network activity event selectors for the relevant event source. + +For more information, see [Logging network activity events](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-network-events-with-cloudtrail.html) in the _AWS CloudTrail User Guide_. + @@ -47,0 +54,17 @@ To record events with one of the CloudTrail `detail-type` values, you must enabl +###### Note + +All CloudTrail events are delivered to the default event bus only. To process CloudTrail events on a custom event bus, create a rule on the default bus that forwards matching events to your custom bus. + +The rule state controls which event categories are matched: + + * _Write (mutating) management events_ — Matched by rules in the default `ENABLED` state. No special configuration needed beyond an active trail. + + * _Read-only management events_ — Matched only by rules with state set to `ENABLED_WITH_ALL_CLOUDTRAIL_MANAGEMENT_EVENTS`. For more information, see [Receiving read-only management events from AWS services](./eb-service-event-cloudtrail-management.html). + + * _Data events_ — Matched by rules in the default `ENABLED` state. The trail must be configured to capture the specific data event types. For more information, see [Logging data events](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html) in the _AWS CloudTrail User Guide_. + + * _Network activity events_ — Matched by rules in the default `ENABLED` state. The trail must be configured with network activity event selectors for the relevant event source, and the API call must be made through a VPC endpoint. + + + +