AWS awscloudtrail: CloudTrail data/network event service reference table overhaul
Summary
Massive reorganization of the CloudTrail concepts page: the data events 'resources.type' table is re-sorted alphabetically and expanded with many new resource types (Bedrock/AI services, S3 Vectors/Tables, EventBridge rules, SageMaker, HealthAgent, Supply Chain, Clinical Trials Tech, etc.), and prose links are converted to trailing 'For more information, see [...]' references. The 'network activity events' service list is also replaced with a re-ordered/expanded list (e.g., AWS Secrets Manager, KMS, STS, Sign-In Portal, Bedrock Agent Core). Existing caveats (Greengrass not logging access-denied events, the DynamoDB streams resources field behavior, S3 Multi-Region Access Point limitation) are reworded or relocated rather than newly introduced.
Security assessment
This is reference-table maintenance for CloudTrail data events and network activity events: entries such as the newly added/AWS Secrets Manager network activity line simply enumerate which services can emit these log types. No specific vulnerability, CVE, incident, or fixed weakness is referenced; reordering existing caveats (e.g., Greengrass access-denied logging, DynamoDB stream event filtering) is a documentation cleanup, not new security guidance.
Evidence
+ * AWS Secrets Manager
Diff
diff --git a/awscloudtrail/latest/userguide/cloudtrail-concepts.md b/awscloudtrail/latest/userguide/cloudtrail-concepts.md index 88040d338..81a404ec7 100644 --- a//awscloudtrail/latest/userguide/cloudtrail-concepts.md +++ b//awscloudtrail/latest/userguide/cloudtrail-concepts.md @@ -109,20 +109,15 @@ AWS service | Description | Resource type (console) | resources.type value -Amazon RDS | [Amazon RDS API activity](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/logging-using-cloudtrail-data-api.html#logging-using-cloudtrail-data-api.including-excluding-cloudtrail-events) on a DB Cluster. | **RDS Data API - DB Cluster** | `AWS::RDS::DBCluster` -Amazon S3 | [Amazon S3 object-level API activity](https://docs.aws.amazon.com/AmazonS3/latest/userguide/cloudtrail-logging-s3-info.html#cloudtrail-data-events) (for example, `GetObject`, `DeleteObject`, and `PutObject` API operations) on objects in general purpose buckets. | **S3** | `AWS::S3::Object` -Amazon S3 | [Amazon S3 API activity](https://docs.aws.amazon.com/AmazonS3/latest/userguide/cloudtrail-logging-s3-info.html#cloudtrail-data-events) on access points. | **S3 Access Point** | `AWS::S3::AccessPoint` -Amazon S3 | [Amazon S3 object-level API activity](https://docs.aws.amazon.com/AmazonS3/latest/userguide/cloudtrail-logging-s3-info.html#cloudtrail-data-events) (for example, `GetObject`, `DeleteObject`, and `PutObject` API operations) on objects in directory buckets. | **S3 Express** | `AWS::S3Express::Object` -Amazon S3 | [Amazon S3 Object Lambda access points API activity](https://docs.aws.amazon.com/AmazonS3/latest/userguide/cloudtrail-logging-s3-info.html#cloudtrail-data-events), such as calls to `CompleteMultipartUpload` and `GetObject`. | **S3 Object Lambda** | `AWS::S3ObjectLambda::AccessPoint` -Amazon S3 | Amazon FSx API activity on volumes. | **FSx Volume** | `AWS::FSx::Volume` -Amazon S3 Tables | Amazon S3 API activity on [tables](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-tables-create.html). | **S3 table** | `AWS::S3Tables::Table` -Amazon S3 Tables | Amazon S3 API activity on [table buckets](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-tables-buckets.html). | **S3 table bucket** | `AWS::S3Tables::TableBucket` -Amazon S3 Vectors | Amazon S3 API activity on [vector buckets](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-vectors-buckets.html). | **S3 vector bucket** | `AWS::S3Vectors::VectorBucket` -Amazon S3 Vectors | Amazon S3 API activity on [vector indexes](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-vectors-indexes.html). | **S3 vector index** | `AWS::S3Vectors::Index` -Amazon S3 on Outposts | [Amazon S3 on Outposts object-level API activity](https://docs.aws.amazon.com/AmazonS3/latest/userguide/cloudtrail-logging-s3-info.html#cloudtrail-data-events). | **S3 Outposts** | `AWS::S3Outposts::Object` -Amazon SNS | Amazon SNS [`Publish`](https://docs.aws.amazon.com/sns/latest/api/API_Publish.html) API operations on platform endpoints. | **SNS platform endpoint** | `AWS::SNS::PlatformEndpoint` -Amazon SNS | Amazon SNS [`Publish`](https://docs.aws.amazon.com/sns/latest/api/API_Publish.html) and [`PublishBatch`](https://docs.aws.amazon.com/sns/latest/api/API_PublishBatch.html) API operations on topics. | **SNS topic** | `AWS::SNS::Topic` -Amazon SQS | [Amazon SQS API activity](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-logging-using-cloudtrail.html#sqs-data-events-in-cloud-trail) on messages. | **SQS** | `AWS::SQS::Queue` -Supply Chain | Supply Chain API activity on an instance. | **Supply Chain** | `AWS::SCN::Instance` -Amazon SWF | [Amazon SWF API activity](https://docs.aws.amazon.com/amazonswf/latest/developerguide/ct-logging.html#cloudtrail-data-events) on [domains](https://docs.aws.amazon.com/amazonswf/latest/developerguide/swf-dev-domains.html). | **SWF domain** | `AWS::SWF::Domain` -AWS AppConfig | [AWS AppConfig API activity](https://docs.aws.amazon.com/appconfig/latest/userguide/logging-using-cloudtrail.html#appconfig-data-events-cloudtrail) for configuration operations such as calls to `StartConfigurationSession` and `GetLatestConfiguration`. | **AWS AppConfig** | `AWS::AppConfig::Configuration` -AWS AppSync | [AWS AppSync API activity](https://docs.aws.amazon.com/appsync/latest/devguide/cloudtrail-logging.html#cloudtrail-data-events) on AppSync GraphQL APIs. | **AppSync GraphQL** | `AWS::AppSync::GraphQLApi` -Amazon Aurora DSQL | Amazon Aurora DSQL API activity on cluster resources. | **Amazon Aurora DSQL** | `AWS::DSQL::Cluster` -AWS B2B Data Interchange | B2B Data Interchange API activity for Transformer operations such as calls to `GetTransformerJob` and `StartTransformerJob`. | **B2B Data Interchange** | `AWS::B2BI::Transformer` +Amazon WorkSpaces Applications | Agents accessing WorkSpaces Applications MCP tool events | **Agent Access MCP Tools** | `AWS::AgentAccessMCP::Tools` +AWS Agent Registry | API activity on `AWS::AgentRegistry::Registry` resources. | **AWS Agent Registry** | `AWS::AgentRegistry::Registry` +Amazon AIDevOps | AIDevOps API activity on agent spaces. | **Agent Space** | `AWS::AIDevOps::AgentSpace` +Amazon AIDevOps | AIDevOps API activity on associations. | **AIDevOps association** | `AWS::AIDevOps::Association` +Amazon AIDevOps | AIDevOps API activity on operator app teams. | **AIDevOps operator app team** | `AWS::AIDevOps::OperatorAppTeam` +Amazon AIDevOps | AIDevOps API activity on pipeline metadata. | **AIDevOps Pipelines Metadata** | `AWS::AIDevOps::PipelineMetadata` +Amazon AIDevOps | AIDevOps API activity on services. | **AIDevOps service** | `AWS::AIDevOps::Service` +Amazon Q Developer | Amazon Q Developer API activity on operational investigations. For more information, see [Amazon Q Developer](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/logging_cw_api_calls.html#Q-Developer-Investigations-Cloudtrail). | **AIOps Investigation Group** | `AWS::AIOps::InvestigationGroup` +Amazon OpenSearch Serverless | API activity on `AWS::AOSS::Collection` resources. | **AWS::AOSS::Collection** | `AWS::AOSS::Collection` +AWS AppConfig | AWS AppConfig API activity for configuration operations such as calls to StartConfigurationSession and GetLatestConfiguration. For more information, see [AWS AppConfig](https://docs.aws.amazon.com/appconfig/latest/userguide/logging-using-cloudtrail.html#appconfig-data-events-cloudtrail). | **AWS AppConfig** | `AWS::AppConfig::Configuration` +CloudWatch Application Signals | API activity on `AWS::ApplicationSignals::InstrumentationConfig` resources. | **AWS::ApplicationSignals::InstrumentationConfig** | `AWS::ApplicationSignals::InstrumentationConfig` +AWS AppSync | AWS AppSync API activity on AppSync GraphQL APIs. For more information, see [AWS AppSync](https://docs.aws.amazon.com/appsync/latest/devguide/cloudtrail-logging.html#cloudtrail-data-events). | **AppSync GraphQL** | `AWS::AppSync::GraphQLApi` +External anthropic workspace | API activity on `AWS::AWSExternalAnthropic::Workspace` resources. | **External anthropic workspace** | `AWS::AWSExternalAnthropic::Workspace` +AWS B2B Data Interchange | B2B Data Interchange API activity for Transformer operations such as calls to GetTransformerJob and StartTransformerJob. | **B2B Data Interchange** | `AWS::B2BI::Transformer` +AWS Backup access point | API activity on `AWS::Backup::BackupAccessPoint` resources. | **AWS Backup access point** | `AWS::Backup::BackupAccessPoint` @@ -130 +125,2 @@ AWS Backup | AWS Backup Search Data API activity on search jobs. | **AWS Backup -Amazon Bedrock | [Amazon Bedrock API activity](https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html#service-name-data-events-cloudtrail) on an agent alias. | **Bedrock agent alias** | `AWS::Bedrock::AgentAlias` +Amazon Bedrock | Bedrock API activity on advanced optimize prompt jobs. | **AdvancedOptimizePromptJob** | `AWS::Bedrock::AdvancedOptimizePromptJob` +Amazon Bedrock | Amazon Bedrock API activity on an agent alias. For more information, see [Amazon Bedrock](https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html#service-name-data-events-cloudtrail). | **Bedrock agent alias** | `AWS::Bedrock::AgentAlias` @@ -131,0 +128,6 @@ Amazon Bedrock | Amazon Bedrock API activity on async invocations. | **Bedrock a +Amazon Bedrock | Amazon Bedrock API activity on an automated reasoning policy. | **Bedrock Automated Reasoning Policy** | `AWS::Bedrock::AutomatedReasoningPolicy` +Amazon Bedrock | Amazon Bedrock API activity on an automated reasoning policy version. | **Bedrock Automated Reasoning Policy Version** | `AWS::Bedrock::AutomatedReasoningPolicyVersion` +Amazon Bedrock | Amazon Bedrock blueprint API activity. | **Bedrock blueprint** | `AWS::Bedrock::Blueprint` +Amazon Bedrock | Bedrock data automation invocation API activity. | **Bedrock Data Automation invocation** | `AWS::Bedrock::DataAutomationInvocation` +Amazon Bedrock | Amazon Bedrock data automation profile API activity. | **Bedrock Data Automation profile** | `AWS::Bedrock::DataAutomationProfile` +Amazon Bedrock | Amazon Bedrock data automation project API activity. | **Bedrock Data Automation project** | `AWS::Bedrock::DataAutomationProject` @@ -132,0 +135 @@ Amazon Bedrock | Amazon Bedrock API activity on a flow alias. | **Bedrock flow a +Amazon Bedrock | Amazon Bedrock API activity on flow executions. | **Flow Execution** | `AWS::Bedrock::FlowExecution` @@ -135 +138 @@ Amazon Bedrock | Amazon Bedrock API activity on inline agents. | **Bedrock Invok -Amazon Bedrock | [Amazon Bedrock API activity](https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html#service-name-data-events-cloudtrail) on a knowledge base. | **Bedrock knowledge base** | `AWS::Bedrock::KnowledgeBase` +Amazon Bedrock | Amazon Bedrock API activity on a knowledge base. For more information, see [Amazon Bedrock](https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html#service-name-data-events-cloudtrail). | **Bedrock knowledge base** | `AWS::Bedrock::KnowledgeBase` @@ -139,12 +142,2 @@ Amazon Bedrock | Amazon Bedrock API activity on sessions. | **Bedrock session** -Amazon Bedrock | Amazon Bedrock API activity on flow executions. | **Bedrock flow execution** | `AWS::Bedrock::FlowExecution` -Amazon Bedrock | Amazon Bedrock API activity on an automated reasoning policy. | **Bedrock automated reasoning policy** | `AWS::Bedrock::AutomatedReasoningPolicy` -Amazon Bedrock | Amazon Bedrock API activity on an automated reasoning policy version. | **Bedrock automated reasoning policy version** | `AWS::Bedrock::AutomatedReasoningPolicyVersion` -Amazon Bedrock | Amazon Bedrock data automation project API activity. | **Bedrock Data Automation project** | `AWS::Bedrock::DataAutomationProject` -Amazon Bedrock | Bedrock data automation invocation API activity. | **Bedrock Data Automation invocation** | `AWS::Bedrock::DataAutomationInvocation` -Amazon Bedrock | Amazon Bedrock data automation profile API activity. | **Bedrock Data Automation profile** | `AWS::Bedrock::DataAutomationProfile` -Amazon Bedrock | Amazon Bedrock blueprint API activity. | **Bedrock blueprint** | `AWS::Bedrock::Blueprint` -Amazon Bedrock | Amazon Bedrock Code-Interpreter API activity. | **Bedrock-AgentCore Code-Interpreter** | `AWS::BedrockAgentCore::CodeInterpreter` -Amazon Bedrock | Amazon Bedrock Browser API activity. | **Bedrock-AgentCore Browser** | `AWS::BedrockAgentCore::Browser` -Amazon Bedrock | Amazon Bedrock Workload Identity API activity. | **Bedrock-AgentCore Workload Identity** | `AWS::BedrockAgentCore::WorkloadIdentity` -Amazon Bedrock | Amazon Bedrock Workload Identity Directory API activity. | **Bedrock-AgentCore Workload Identity Directory** | `AWS::BedrockAgentCore::WorkloadIdentityDirectory` -Amazon Bedrock | Amazon Bedrock Token Vault API activity. | **Bedrock-AgentCore Token Vault** | `AWS::BedrockAgentCore::TokenVault` +Amazon Bedrock | Amazon Bedrock Tool API activity. | **Bedrock Tool** | `AWS::Bedrock::Tool` +Bedrock-AgentCore ABTest | API activity on `AWS::BedrockAgentCore::ABTest` resources. | **Bedrock-AgentCore ABTest** | `AWS::BedrockAgentCore::ABTest` @@ -152,2 +145,8 @@ Amazon Bedrock | Amazon Bedrock APIKey CredentialProvider API activity. | **Bedr -Amazon Bedrock | Amazon Bedrock Runtime API activity. | **Bedrock-AgentCore Runtime** | `AWS::BedrockAgentCore::Runtime` -Amazon Bedrock | Amazon Bedrock Runtime-Endpoint API activity. | **Bedrock-AgentCore Runtime-Endpoint** | `AWS::BedrockAgentCore::RuntimeEndpoint` +BedrockAgentCore batch evaluate | API activity on `AWS::BedrockAgentCore::BatchEvaluate` resources. | **BedrockAgentCore batch evaluate** | `AWS::BedrockAgentCore::BatchEvaluate` +Amazon Bedrock | Amazon Bedrock Browser API activity. | **Bedrock-AgentCore Browser** | `AWS::BedrockAgentCore::Browser` +Amazon Bedrock | Amazon Bedrock Browser-Custom API activity. | **Bedrock-AgentCore Browser-Custom** | `AWS::BedrockAgentCore::BrowserCustom` +Bedrock-AgentCore Browser Profile | API activity on `AWS::BedrockAgentCore::BrowserProfile` resources. | **Bedrock-AgentCore Browser Profile** | `AWS::BedrockAgentCore::BrowserProfile` +BedrockAgentCore CapacityProvider | API activity on `AWS::BedrockAgentCore::CapacityProvider` resources. | **BedrockAgentCore CapacityProvider** | `AWS::BedrockAgentCore::CapacityProvider` +Amazon Bedrock | Amazon Bedrock Code-Interpreter API activity. | **Bedrock-AgentCore Code-Interpreter** | `AWS::BedrockAgentCore::CodeInterpreter` +Amazon Bedrock | Amazon Bedrock Code-Interpreter-Custom API activity. | **Bedrock-AgentCore Code-Interpreter-Custom** | `AWS::BedrockAgentCore::CodeInterpreterCustom` +Amazon Bedrock AgentCore | Bedrock AgentCore API activity on evaluators. | **Bedrock-AgentCore Evaluator** | `AWS::BedrockAgentCore::Evaluator` @@ -157,11 +156,29 @@ Amazon Bedrock | Amazon Bedrock Oauth2 CredentialProvider API activity. | **Bedr -Amazon Bedrock | Amazon Bedrock Browser-Custom API activity. | **Bedrock-AgentCore Browser-Custom** | `AWS::BedrockAgentCore::BrowserCustom` -Amazon Bedrock | Amazon Bedrock Code-Interpreter-Custom API activity. | **Bedrock-AgentCore Code-Interpreter-Custom** | `AWS::BedrockAgentCore::CodeInterpreterCustom` -Amazon Bedrock | Amazon Bedrock Tool API activity. | **Bedrock Tool** | `AWS::Bedrock::Tool` -AWS Cloud Map | [AWS Cloud Map API activity](https://docs.aws.amazon.com/cloud-map/latest/dg/cloudtrail-data-events.html) on a [namespace](https://docs.aws.amazon.com/cloud-map/latest/api/API_Namespace.html). | **AWS Cloud Map namespace** | ``AWS::ServiceDiscovery::Namespace`` -AWS Cloud Map | [AWS Cloud Map API activity](https://docs.aws.amazon.com/cloud-map/latest/dg/cloudtrail-data-events.html) on a [service](https://docs.aws.amazon.com/cloud-map/latest/api/API_Service.html). | **AWS Cloud Map service** | ``AWS::ServiceDiscovery::Service`` -Amazon CloudFront | CloudFront API activity on a [KeyValueStore](https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_KeyValueStore.html). | **CloudFront KeyValueStore** | `AWS::CloudFront::KeyValueStore` -AWS CloudTrail | CloudTrail [`PutAuditEvents`](https://docs.aws.amazon.com/awscloudtraildata/latest/APIReference/API_PutAuditEvents.html) activity on a [CloudTrail Lake channel](./query-event-data-store-integration.html) that is used to log events from outside AWS. | **CloudTrail channel** | `AWS::CloudTrail::Channel` -Amazon CloudWatch | [Amazon CloudWatch API activity](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/logging_cw_api_calls.html#CloudWatch-data-plane-events) on metrics. | **CloudWatch metric** | `AWS::CloudWatch::Metric` -Amazon CloudWatch Network Flow Monitor | Amazon CloudWatch Network Flow Monitor API activity on monitors. | **Network Flow Monitor monitor** | `AWS::NetworkFlowMonitor::Monitor` -Amazon CloudWatch Network Flow Monitor | Amazon CloudWatch Network Flow Monitor API activity on scopes. | **Network Flow Monitor scope** | `AWS::NetworkFlowMonitor::Scope` -Amazon CloudWatch RUM | Amazon CloudWatch RUM API activity on app monitors. | **RUM app monitor** | `AWS::RUM::AppMonitor` +Bedrock-AgentCore payments | API activity on `AWS::BedrockAgentCore::Payments` resources. | **Bedrock-AgentCore payments** | `AWS::BedrockAgentCore::Payments` +Bedrock-AgentCore policy | API activity on `AWS::BedrockAgentCore::Policy` resources. | **Bedrock-AgentCore policy** | `AWS::BedrockAgentCore::Policy` +Bedrock-AgentCore policy engine | API activity on `AWS::BedrockAgentCore::PolicyEngine` resources. | **Bedrock-AgentCore policy engine** | `AWS::BedrockAgentCore::PolicyEngine` +Bedrock-AgentCore Recommendation | API activity on `AWS::BedrockAgentCore::Recommendation` resources. | **Bedrock-AgentCore Recommendation** | `AWS::BedrockAgentCore::Recommendation` +Bedrock-AgentCore Registry | API activity on `AWS::BedrockAgentCore::Registry` resources. | **Bedrock-AgentCore Registry** | `AWS::BedrockAgentCore::Registry` +Amazon Bedrock | Amazon Bedrock Runtime API activity. | **Bedrock-AgentCore Runtime** | `AWS::BedrockAgentCore::Runtime` +Amazon Bedrock | Amazon Bedrock Runtime-Endpoint API activity. | **Bedrock-AgentCore Runtime-Endpoint** | `AWS::BedrockAgentCore::RuntimeEndpoint` +Amazon Bedrock | Amazon Bedrock Token Vault API activity. | **Bedrock-AgentCore Token Vault** | `AWS::BedrockAgentCore::TokenVault` +Amazon Bedrock | Amazon Bedrock Workload Identity API activity. | **Bedrock-AgentCore Workload Identity** | `AWS::BedrockAgentCore::WorkloadIdentity` +Amazon Bedrock | Amazon Bedrock Workload Identity Directory API activity. | **Bedrock-AgentCore Workload Identity Directory** | `AWS::BedrockAgentCore::WorkloadIdentityDirectory` +Bedrock Mantle Project | API activity on `AWS::BedrockMantle::Project` resources. | **Bedrock Mantle Project** | `AWS::BedrockMantle::Project` +Bedrock Web Search Tool | API activity on `AWS::BedrockWebSearch::Tool` resources. | **Bedrock Web Search Tool** | `AWS::BedrockWebSearch::Tool` +Amazon Keyspaces (for Apache Cassandra) | Amazon Keyspaces (for Apache Cassandra) API activity on Cassandra CDC streams. | **Cassandra CDC streams** | `AWS::Cassandra::Stream` +Amazon Keyspaces (for Apache Cassandra) | Amazon Keyspaces API activity on a table. For more information, see [Amazon Keyspaces (for Apache Cassandra)](https://docs.aws.amazon.com/keyspaces/latest/devguide/logging-using-cloudtrail.html#keyspaces-in-cloudtrail-dml). | **Cassandra table** | `AWS::Cassandra::Table` +Certificate Manager | API activity on `AWS::CertificateManager::AcmeEndpoint` resources. | **AWS::CertificateManager::AcmeEndpoint** | `AWS::CertificateManager::AcmeEndpoint` +Clinical Trials Tech codelist | API activity on `AWS::ClinicalTrialsTech::Codelist` resources. | **Clinical Trials Tech codelist** | `AWS::ClinicalTrialsTech::Codelist` +Clinical Trials Tech dataset | API activity on `AWS::ClinicalTrialsTech::Dataset` resources. | **Clinical Trials Tech dataset** | `AWS::ClinicalTrialsTech::Dataset` +Clinical Trials Tech execution | API activity on `AWS::ClinicalTrialsTech::Execution` resources. | **Clinical Trials Tech execution** | `AWS::ClinicalTrialsTech::Execution` +Clinical Trials Tech instance | API activity on `AWS::ClinicalTrialsTech::Instance` resources. | **Clinical Trials Tech instance** | `AWS::ClinicalTrialsTech::Instance` +Clinical Trials Tech mapping | API activity on `AWS::ClinicalTrialsTech::Mapping` resources. | **Clinical Trials Tech mapping** | `AWS::ClinicalTrialsTech::Mapping` +Clinical Trials Tech schedule | API activity on `AWS::ClinicalTrialsTech::Schedule` resources. | **Clinical Trials Tech schedule** | `AWS::ClinicalTrialsTech::Schedule` +Clinical Trials Tech study | API activity on `AWS::ClinicalTrialsTech::Study` resources. | **Clinical Trials Tech study** | `AWS::ClinicalTrialsTech::Study` +Amazon CloudFront | CloudFront API activity on a KeyValueStore. For more information, see [Amazon CloudFront](https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_KeyValueStore.html). | **CloudFront KeyValueStore** | `AWS::CloudFront::KeyValueStore` +Amazon Cost Optimization | CloudOptimization API activity on profiles. | **AWS::CloudOptimization::Profile** | `AWS::CloudOptimization::Profile` +Amazon Cost Optimization | CloudOptimization API activity on recommendations. | **AWS::CloudOptimization::Recommendation** | `AWS::CloudOptimization::Recommendation` +AWS CloudTrail | CloudTrail PutAuditEvents activity on a CloudTrail Lake channel that is used to log events from outside AWS. For more information, see [AWS CloudTrail](https://docs.aws.amazon.com/awscloudtraildata/latest/APIReference/API_PutAuditEvents.html). | **CloudTrail channel** | `AWS::CloudTrail::Channel` +CloudWatch dataset | API activity on `AWS::CloudWatch::Dataset` resources. | **CloudWatch dataset** | `AWS::CloudWatch::Dataset` +Observability ingestion endpoint | API activity on `AWS::CloudWatch::IngestionEndpoint` resources. | **Observability ingestion endpoint** | `AWS::CloudWatch::IngestionEndpoint` +Amazon CloudWatch | Amazon CloudWatch API activity on metrics. For more information, see [Amazon CloudWatch](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/logging_cw_api_calls.html#CloudWatch-data-plane-events). | **CloudWatch metric** | `AWS::CloudWatch::Metric` @@ -171 +188 @@ Amazon CodeWhisperer | Amazon CodeWhisperer API activity on a profile. | **CodeW -Amazon Cognito | Amazon Cognito API activity on Amazon Cognito [identity pools](https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-info-in-cloudtrail.html#identity-pools-cloudtrail-events). | **Cognito Identity Pools** | `AWS::Cognito::IdentityPool` +Amazon Cognito | Amazon Cognito API activity on Amazon Cognito identity pools. For more information, see [Amazon Cognito](https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-info-in-cloudtrail.html#identity-pools-cloudtrail-events). | **Cognito Identity Pools** | `AWS::Cognito::IdentityPool` @@ -173,12 +190,8 @@ AWS Data Exchange | AWS Data Exchange API activity on assets. | **Data Exchange -Amazon Data Firehose | Amazon Data Firehose delivery stream API activity. | **Amazon Data Firehose** | `AWS::KinesisFirehose::DeliveryStream` -AWS Deadline Cloud | [Deadline Cloud](https://docs.aws.amazon.com/deadline-cloud/latest/userguide/logging-using-cloudtrail.html#cloudtrail-data-events) API activity on fleets. | **Deadline Cloud fleet** | `AWS::Deadline::Fleet` -AWS Deadline Cloud | [Deadline Cloud](https://docs.aws.amazon.com/deadline-cloud/latest/userguide/logging-using-cloudtrail.html#cloudtrail-data-events) API activity on jobs. | **Deadline Cloud job** | `AWS::Deadline::Job` -AWS Deadline Cloud | [Deadline Cloud](https://docs.aws.amazon.com/deadline-cloud/latest/userguide/logging-using-cloudtrail.html#cloudtrail-data-events) API activity on queues. | **Deadline Cloud queue** | `AWS::Deadline::Queue` -AWS Deadline Cloud | [Deadline Cloud](https://docs.aws.amazon.com/deadline-cloud/latest/userguide/logging-using-cloudtrail.html#cloudtrail-data-events) API activity on workers. | **Deadline Cloud worker** | `AWS::Deadline::Worker` -Amazon DynamoDB | [Amazon DynamoDB item-level API activity](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/logging-using-cloudtrail.html#ddb-data-plane-events-in-cloudtrail) on tables (for example, `PutItem`, `DeleteItem`, and `UpdateItem` API operations). - -###### Note - -For tables with streams enabled, the `resources` field in the data event contains both `AWS::DynamoDB::Stream` and `AWS::DynamoDB::Table`. If you specify `AWS::DynamoDB::Table` for the `resources.type`, it will log both DynamoDB table and DynamoDB streams events by default. To exclude [streams events](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/logging-using-cloudtrail.html#ddb-data-plane-events-in-cloudtrail), add a filter on the `eventName` field. | **DynamoDB** | `AWS::DynamoDB::Table` -Amazon DynamoDB | [Amazon DynamoDB](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/logging-using-cloudtrail.html#ddb-data-plane-events-in-cloudtrail) API activity on streams. | **DynamoDB Streams** | `AWS::DynamoDB::Stream` -Amazon Elastic Block Store | [Amazon Elastic Block Store (EBS)](https://docs.aws.amazon.com/ebs/latest/userguide/logging-ebs-apis-using-cloudtrail.html) direct APIs, such as `PutSnapshotBlock`, `GetSnapshotBlock`, and `ListChangedBlocks` on Amazon EBS snapshots. | **Amazon EBS direct APIs** | `AWS::EC2::Snapshot` +AWS Deadline Cloud | Deadline Cloud API activity on fleets. For more information, see [AWS Deadline Cloud](https://docs.aws.amazon.com/deadline-cloud/latest/userguide/logging-using-cloudtrail.html#cloudtrail-data-events). | **Deadline Cloud fleet** | `AWS::Deadline::Fleet` +AWS Deadline Cloud | Deadline Cloud API activity on jobs. For more information, see [AWS Deadline Cloud](https://docs.aws.amazon.com/deadline-cloud/latest/userguide/logging-using-cloudtrail.html#cloudtrail-data-events). | **Deadline Cloud job** | `AWS::Deadline::Job` +AWS Deadline Cloud | Deadline Cloud API activity on queues. For more information, see [AWS Deadline Cloud](https://docs.aws.amazon.com/deadline-cloud/latest/userguide/logging-using-cloudtrail.html#cloudtrail-data-events). | **Deadline Cloud queue** | `AWS::Deadline::Queue` +AWS Deadline Cloud | Deadline Cloud API activity on workers. For more information, see [AWS Deadline Cloud](https://docs.aws.amazon.com/deadline-cloud/latest/userguide/logging-using-cloudtrail.html#cloudtrail-data-events). | **Deadline Cloud worker** | `AWS::Deadline::Worker` +Diode Alerting linked alert | API activity on `AWS::DiodeAlerting::LinkedAlert` resources. | **Diode Alerting linked alert** | `AWS::DiodeAlerting::LinkedAlert` +Amazon Aurora DSQL | Amazon Aurora DSQL API activity on cluster resources. | **Amazon Aurora DSQL** | `AWS::DSQL::Cluster` +Amazon DynamoDB | Amazon DynamoDB API activity on streams. For more information, see [Amazon DynamoDB](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/logging-using-cloudtrail.html#ddb-data-plane-events-in-cloudtrail). | **DynamoDB Streams** | `AWS::DynamoDB::Stream` +Amazon DynamoDB | Amazon DynamoDB item-level API activity on tables (for example, PutItem, DeleteItem, and UpdateItem API operations). For tables with streams enabled, the resources field in the data event contains both AWS::DynamoDB::Stream and AWS::DynamoDB::Table. If you specify AWS::DynamoDB::Table for the resources.type, it will log both DynamoDB table and DynamoDB streams events by default. To exclude streams events, add a filter on the eventName field. For more information, see [Amazon DynamoDB](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/logging-using-cloudtrail.html#ddb-data-plane-events-in-cloudtrail). | **DynamoDB** | `AWS::DynamoDB::Table` @@ -185,0 +199 @@ Amazon Elastic Compute Cloud | Amazon EC2 instance connect endpoint API activity +Amazon Elastic Block Store | Amazon Elastic Block Store (EBS) direct APIs, such as PutSnapshotBlock, GetSnapshotBlock, and ListChangedBlocks on Amazon EBS snapshots. For more information, see [Amazon Elastic Block Store](https://docs.aws.amazon.com/ebs/latest/userguide/logging-ebs-apis-using-cloudtrail.html). | **EBS direct APIs** | `AWS::EC2::Snapshot` @@ -187,38 +201,10 @@ Amazon Elastic Container Service | Amazon Elastic Container Service API activity -Amazon Elastic Kubernetes Service | Amazon Elastic Kubernetes Service API activity on dashboards. | **Amazon Elastic Kubernetes Service dashboard** | `AWS::EKS::Dashboard` -Amazon EMR | [Amazon EMR API activity](https://docs.aws.amazon.com/emr/latest/ManagementGuide/logging-using-cloudtrail.html#cloudtrail-data-events) on a write-ahead log workspace. | **EMR write-ahead log workspace** | `AWS::EMRWAL::Workspace` -AWS End User Messaging SMS | [AWS End User Messaging SMS](https://docs.aws.amazon.com/sms-voice/latest/userguide/logging-using-cloudtrail.html#cloudtrail-data-events) API activity on origination identities. | **SMS Voice origination identity** | `AWS::SMSVoice::OriginationIdentity` -AWS End User Messaging SMS | [AWS End User Messaging SMS](https://docs.aws.amazon.com/sms-voice/latest/userguide/logging-using-cloudtrail.html#cloudtrail-data-events) API activity on messages. | **SMS Voice message** | `AWS::SMSVoice::Message` -AWS End User Messaging Social | [AWS End User Messaging Social](https://docs.aws.amazon.com/social-messaging/latest/userguide/logging-using-cloudtrail.html#cloudtrail-data-events) API activity on phone number IDs. | **Social-Messaging Phone Number Id** | `AWS::SocialMessaging::PhoneNumberId` -AWS End User Messaging Social | AWS End User Messaging Social API activity on Waba IDs. | **Social-Messaging Waba ID** | `AWS::SocialMessaging::WabaId` -Amazon FinSpace | [Amazon FinSpace](https://docs.aws.amazon.com/finspace/latest/userguide/logging-cloudtrail-events.html#finspace-dataplane-events) API activity on environments. | **FinSpace** | `AWS::FinSpace::Environment` -Amazon GameLift Streams | Amazon GameLift Streams [streaming API activity](https://docs.aws.amazon.com/gameliftstreams/latest/developerguide/logging-using-cloudtrail.html#cloudtrail-data-events) on applications. | **GameLift Streams application** | `AWS::GameLiftStreams::Application` -Amazon GameLift Streams | Amazon GameLift Streams [streaming API activity](https://docs.aws.amazon.com/gameliftstreams/latest/developerguide/logging-using-cloudtrail.html#cloudtrail-data-events) on stream groups. | **GameLift Streams stream group** | `AWS::GameLiftStreams::StreamGroup` -AWS Glue | AWS Glue API activity on tables that were created by Lake Formation. | **Lake Formation** | `AWS::Glue::Table` -Amazon GuardDuty | Amazon GuardDuty API activity for a [detector](https://docs.aws.amazon.com/guardduty/latest/ug/logging-using-cloudtrail.html#guardduty-data-events-in-cloudtrail). | **GuardDuty detector** | `AWS::GuardDuty::Detector` -AWS HealthImaging | AWS HealthImaging API activity on data stores. | **MedicalImaging data store** | `AWS::MedicalImaging::Datastore` -AWS HealthImaging | AWS HealthImaging image set API activity. | **MedicalImaging image set** | `AWS::MedicalImaging::Imageset` -AWS IoT | [AWS IoT API activity](https://docs.aws.amazon.com/greengrass/v2/developerguide/logging-using-cloudtrail.html#greengrass-data-events-cloudtrail) on [certificates](https://docs.aws.amazon.com/iot/latest/developerguide/x509-client-certs.html). | **IoT certificate** | `AWS::IoT::Certificate` -AWS IoT | [AWS IoT API activity](https://docs.aws.amazon.com/greengrass/v2/developerguide/logging-using-cloudtrail.html#greengrass-data-events-cloudtrail) on [things](https://docs.aws.amazon.com/iot/latest/developerguide/thing-registry.html). | **IoT thing** | `AWS::IoT::Thing` -AWS IoT Greengrass Version 2 | [Greengrass API activity](https://docs.aws.amazon.com/greengrass/v2/developerguide/logging-using-cloudtrail.html#greengrass-data-events-cloudtrail) from a Greengrass core device on a component version. - -###### Note - -Greengrass doesn't log access denied events. | **IoT Greengrass component version** | `AWS::GreengrassV2::ComponentVersion` -AWS IoT Greengrass Version 2 | [Greengrass API activity](https://docs.aws.amazon.com/greengrass/v2/developerguide/logging-using-cloudtrail.html#greengrass-data-events-cloudtrail) from a Greengrass core device on a deployment. - -###### Note - -Greengrass doesn't log access denied events. | **IoT Greengrass deployment** | `AWS::GreengrassV2::Deployment` -AWS IoT SiteWise | [IoT SiteWise API activity](https://docs.aws.amazon.com/iot-sitewise/latest/userguide/logging-using-cloudtrail.html#service-name-data-events-cloudtrail) on [assets](https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_CreateAsset.html). | **IoT SiteWise asset** | `AWS::IoTSiteWise::Asset` -AWS IoT SiteWise | [IoT SiteWise API activity](https://docs.aws.amazon.com/iot-sitewise/latest/userguide/logging-using-cloudtrail.html#service-name-data-events-cloudtrail) on [time series](https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_DescribeTimeSeries.html). | **IoT SiteWise time series** | `AWS::IoTSiteWise::TimeSeries` -AWS IoT SiteWise Assistant | Sitewise Assistant API activity on conversations. | **Sitewise Assistant conversation** | `AWS::SitewiseAssistant::Conversation` -AWS IoT TwinMaker | IoT TwinMaker API activity on an [entity](https://docs.aws.amazon.com/iot-twinmaker/latest/apireference/API_CreateEntity.html). | **IoT TwinMaker entity** | `AWS::IoTTwinMaker::Entity` -AWS IoT TwinMaker | IoT TwinMaker API activity on a [workspace](https://docs.aws.amazon.com/iot-twinmaker/latest/apireference/API_CreateWorkspace.html). | **IoT TwinMaker workspace** | `AWS::IoTTwinMaker::Workspace` -Amazon Kendra Intelligent Ranking | Amazon Kendra Intelligent Ranking API activity on [rescore execution plans](https://docs.aws.amazon.com/kendra/latest/dg/cloudtrail-intelligent-ranking.html#cloud-trail-intelligent-ranking-log-entry). | **Kendra Ranking** | `AWS::KendraRanking::ExecutionPlan` -Amazon Keyspaces (for Apache Cassandra) | [Amazon Keyspaces API activity](https://docs.aws.amazon.com/keyspaces/latest/devguide/logging-using-cloudtrail.html#keyspaces-in-cloudtrail-dml) on a table. | **Cassandra table** | `AWS::Cassandra::Table` -Amazon Keyspaces (for Apache Cassandra) | Amazon Keyspaces (for Apache Cassandra) API activity on Cassandra CDC streams. | **Cassandra CDC streams** | `AWS::Cassandra::Stream` -Amazon Kinesis Data Streams | Kinesis Data Streams API activity on [streams](https://docs.aws.amazon.com/streams/latest/dev/working-with-streams.html). | **Kinesis stream** | `AWS::Kinesis::Stream` -Amazon Kinesis Data Streams | Kinesis Data Streams API activity on [stream consumers](https://docs.aws.amazon.com/streams/latest/dev/building-consumers.html). | **Kinesis stream consumer** | `AWS::Kinesis::StreamConsumer` -Amazon Kinesis Video Streams | Kinesis Video Streams API activity on video streams, such as calls to `GetMedia` and `PutMedia`. | **Kinesis video stream** | `AWS::KinesisVideo::Stream` -Amazon Kinesis Video Streams | Kinesis Video Streams video signaling channel API activity. | **Kinesis video signaling channel** | `AWS::KinesisVideo::SignalingChannel` -AWS Lambda | AWS Lambda function execution activity (the `Invoke` API). | **Lambda** | `AWS::Lambda::Function` +Amazon Elastic Kubernetes Service | Amazon Elastic Kubernetes Service API activity on dashboards. | **EKS dashboard** | `AWS::EKS::Dashboard` +Amazon EMR | Amazon EMR API activity on a write-ahead log workspace. For more information, see [Amazon EMR](https://docs.aws.amazon.com/emr/latest/ManagementGuide/logging-using-cloudtrail.html#cloudtrail-data-events). | **EMR write-ahead log workspace** | `AWS::EMRWAL::Workspace` +EventBridge endpoint | API activity on `AWS::Events::Endpoint` resources. | **EventBridge endpoint** | `AWS::Events::Endpoint` +EventBridge event bus | API activity on `AWS::Events::EventBus` resources. | **EventBridge event bus** | `AWS::Events::EventBus` +EventBridge partner event source | API activity on `AWS::Events::EventSource` resources. | **EventBridge partner event source** | `AWS::Events::EventSource` +EventBridge rule | API activity on `AWS::Events::Rule` resources. | **EventBridge rule** | `AWS::Events::Rule` +Amazon FinSpace | Amazon FinSpace API activity on environments. For more information, see [Amazon FinSpace](https://docs.aws.amazon.com/finspace/latest/userguide/logging-cloudtrail-events.html#finspace-dataplane-events). | **FinSpace** | `AWS::FinSpace::Environment` +Amazon FSx | Amazon FSx API activity on volumes. | **FSx Volume** | `AWS::FSx::Volume` +Amazon GameLift Streams | Amazon GameLift Streams streaming API activity on applications. For more information, see [Amazon GameLift Streams](https://docs.aws.amazon.com/gameliftstreams/latest/developerguide/logging-using-cloudtrail.html#cloudtrail-data-events). | **GameLift Streams application** | `AWS::GameLiftStreams::Application` +Amazon GameLift Streams | Amazon GameLift Streams streaming API activity on stream groups. For more information, see [Amazon GameLift Streams](https://docs.aws.amazon.com/gameliftstreams/latest/developerguide/logging-using-cloudtrail.html#cloudtrail-data-events). | **GameLift Streams stream group** | `AWS::GameLiftStreams::StreamGroup` @@ -228 +214,34 @@ Amazon Location Routes | Amazon Location Routes API activity. | **Geo Routes** | -Amazon Machine Learning | Machine Learning API activity on ML models. | **Maching Learning MlModel** | `AWS::MachineLearning::MlModel`