AWS Security ChangesHomeSearch

AWS eventbridge documentation change

Service: eventbridge · 2026-05-10 · Documentation low

File: eventbridge/latest/userguide/eb-service-event-cloudtrail.md

Summary

Added documentation for 'AWS Network Activity Event via CloudTrail' and clarified event delivery rules for CloudTrail events.

Security assessment

Introduces documentation for network activity events (security-relevant for monitoring VPC endpoint traffic) and explicitly details security-related event handling requirements (e.g., rule states for management/data events). This enhances security visibility but doesn't address a specific vulnerability.

Diff

diff --git a/eventbridge/latest/userguide/eb-service-event-cloudtrail.md b/eventbridge/latest/userguide/eb-service-event-cloudtrail.md
index ad978be1d..84963eb37 100644
--- a//eventbridge/latest/userguide/eb-service-event-cloudtrail.md
+++ b//eventbridge/latest/userguide/eb-service-event-cloudtrail.md
@@ -42,0 +43,6 @@ For more information, see [CloudTrail Insights](https://docs.aws.amazon.com/awsc
+  * `AWS Network Activity Event via CloudTrail`
+
+Network activity events capture API calls made through VPC endpoints from private VPCs. These events require a trail configured with network activity event selectors for the relevant event source.
+
+For more information, see [Logging network activity events](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-network-events-with-cloudtrail.html) in the _AWS CloudTrail User Guide_.
+
@@ -47,0 +54,17 @@ To record events with one of the CloudTrail `detail-type` values, you must enabl
+###### Note
+
+All CloudTrail events are delivered to the default event bus only. To process CloudTrail events on a custom event bus, create a rule on the default bus that forwards matching events to your custom bus.
+
+The rule state controls which event categories are matched:
+
+  * _Write (mutating) management events_ — Matched by rules in the default `ENABLED` state. No special configuration needed beyond an active trail.
+
+  * _Read-only management events_ — Matched only by rules with state set to `ENABLED_WITH_ALL_CLOUDTRAIL_MANAGEMENT_EVENTS`. For more information, see [Receiving read-only management events from AWS services](./eb-service-event-cloudtrail-management.html).
+
+  * _Data events_ — Matched by rules in the default `ENABLED` state. The trail must be configured to capture the specific data event types. For more information, see [Logging data events](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html) in the _AWS CloudTrail User Guide_.
+
+  * _Network activity events_ — Matched by rules in the default `ENABLED` state. The trail must be configured with network activity event selectors for the relevant event source, and the API call must be made through a VPC endpoint.
+
+
+
+