AWS awsconsolehelpdocs documentation change
Summary
Added documentation for UXC data events logging in CloudTrail, including event types, resource details, and configuration instructions
Security assessment
The change significantly expands auditing capabilities documentation by adding data events logging for UXC resources. This enhances security visibility but shows no evidence of fixing a specific vulnerability.
Diff
diff --git a/awsconsolehelpdocs/latest/gsg/log-using-cloudtrail.md b/awsconsolehelpdocs/latest/gsg/log-using-cloudtrail.md index 13522f340..02c4cafa4 100644 --- a//awsconsolehelpdocs/latest/gsg/log-using-cloudtrail.md +++ b//awsconsolehelpdocs/latest/gsg/log-using-cloudtrail.md @@ -7 +7 @@ -UXC management events in CloudTrailUXC event examples +UXC data events in CloudTrailUXC management events in CloudTrailUXC event examples @@ -11 +11 @@ UXC management events in CloudTrailUXC event examples -AWS User Experience Customization is integrated with [AWS CloudTrail](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html), a service that provides a record of actions taken by a user, role, or an AWS service. CloudTrail captures all API calls for UXC as events. The calls captured include calls from the UXC console and code calls to the UXC API operations. Using the information collected by CloudTrail, you can determine the request that was made to UXC, the IP address from which the request was made, when it was made, and additional details. +AWS User Experience Customization is integrated with [AWS CloudTrail](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html), a service that provides a record of actions taken by a user, role, or an AWS service. CloudTrail captures API calls for UXC as events, including management events and data events. The calls captured include calls from the UXC console and code calls to the UXC API operations. Using the information collected by CloudTrail, you can determine the request that was made to UXC, the IP address from which the request was made, when it was made, and additional details. @@ -16,0 +17,20 @@ For an ongoing record of events in your AWS account past 90 days, create a trail +## UXC data events in CloudTrail + +[Data events](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html#logging-data-events) provide information about the resource operations performed on or in a resource (for example, reading or writing to an Amazon S3 object). These are also known as data plane operations. Data events are often high-volume activities. By default, CloudTrail doesn’t log data events. The CloudTrail **Event history** doesn't record data events. + +Additional charges apply for data events. For more information about CloudTrail pricing, see [AWS CloudTrail Pricing](https://aws.amazon.com/cloudtrail/pricing/). + +You can log data events for the UXC resource types by using the CloudTrail console, AWS CLI, or CloudTrail API operations. For more information about how to log data events, see [Logging data events with the AWS Management Console](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html#logging-data-events-console) and [Logging data events with the AWS Command Line Interface](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html#creating-data-event-selectors-with-the-AWS-CLI) in the _AWS CloudTrail User Guide_. + +The following table lists the UXC resource types for which you can log data events. The **Resource type (console)** column shows the value to choose from the **Resource type** list on the CloudTrail console. The **resources.type value** column shows the `resources.type` value, which you would specify when configuring advanced event selectors using the AWS CLI or CloudTrail APIs. The **Data APIs logged to CloudTrail** column shows the API calls logged to CloudTrail for the resource type. + +Resource type (console) | resources.type value | Data APIs logged to CloudTrail +---|---|--- +**UXC account customization** | `AWS::UXC::AccountCustomization` | + + * [GetAccountCustomizations](https://docs.aws.amazon.com/awsconsolehelpdocs/latest/APIReference/API_GetAccountCustomizations.html) + + + +You can configure advanced event selectors to filter on the `eventName`, `readOnly`, and `resources.ARN` fields to log only those events that are important to you. For more information about these fields, see [AdvancedFieldSelector](https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_AdvancedFieldSelector.html) in the _AWS CloudTrail API Reference_. + @@ -21 +41,6 @@ For an ongoing record of events in your AWS account past 90 days, create a trail -AWS User Experience Customization logs all UXC control plane operations as management events. For a list of the AWS User Experience Customization control plane operations that UXC logs to CloudTrail, see the [AWS User Experience Customization API Reference](https://docs.aws.amazon.com/awsconsolehelpdocs/latest/APIReference/Welcome.html). +AWS User Experience Customization logs the following UXC control plane operations to CloudTrail as management events. + + * [UpdateAccountCustomizations](https://docs.aws.amazon.com/awsconsolehelpdocs/latest/APIReference/API_UpdateAccountCustomizations.html) + + +