AWS awscloudtrail: CloudTrail data events table reordered and expanded with new resource types
Summary
The CloudTrail data-events resource-type table was alphabetically reordered and greatly expanded: many new resource types were added (e.g. GuardDuty malware scans, IoT tunnel, Lambda MicrovmImage, EventBridge resources, Lambda function invoke, S3 access points/S3 Express Access Point, Bedrock AgentCore resources, Supply Chain, Timestream, etc.), inline markdown links were converted to 'For more information, see [...]' references, and multi-line notes (DynamoDB streams behavior, Greengrass not logging access denied events) were folded into the table cells.
Security assessment
The change expands the set of resource types for which CloudTrail data (data-plane) events can be logged, e.g. adding function Invoke activity ('AWS Lambda | AWS Lambda function execution activity (the Invoke API).'), S3 object-level activity, and GuardDuty malware scans. CloudTrail data-event logging is an audit/visibility control that supports detection and forensics, so documenting additional loggable resource types is security-relevant guidance, but there is no evidence it fixes a specific vulnerability, CVE, or incident; it is a documentation restructure/expansion rather than a security fix.
Evidence
+Amazon GuardDuty | GuardDuty API activity on malware scans. | **GuardDuty malware scan** | `AWS::GuardDuty::MalwareScan`
Diff
diff --git a/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.md b/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.md index 5c005ac5f..ff5fe4392 100644 --- a//awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.md +++ b//awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.md @@ -129,20 +129,15 @@ AWS service | Description | Resource type (console) | resources.type value -Amazon RDS | [Amazon RDS API activity](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/logging-using-cloudtrail-data-api.html#logging-using-cloudtrail-data-api.including-excluding-cloudtrail-events) on a DB Cluster. | **RDS Data API - DB Cluster** | `AWS::RDS::DBCluster` -Amazon S3 | [Amazon S3 object-level API activity](https://docs.aws.amazon.com/AmazonS3/latest/userguide/cloudtrail-logging-s3-info.html#cloudtrail-data-events) (for example, `GetObject`, `DeleteObject`, and `PutObject` API operations) on objects in general purpose buckets. | **S3** | `AWS::S3::Object` -Amazon S3 | [Amazon S3 API activity](https://docs.aws.amazon.com/AmazonS3/latest/userguide/cloudtrail-logging-s3-info.html#cloudtrail-data-events) on access points. | **S3 Access Point** | `AWS::S3::AccessPoint` -Amazon S3 | [Amazon S3 object-level API activity](https://docs.aws.amazon.com/AmazonS3/latest/userguide/cloudtrail-logging-s3-info.html#cloudtrail-data-events) (for example, `GetObject`, `DeleteObject`, and `PutObject` API operations) on objects in directory buckets. | **S3 Express** | `AWS::S3Express::Object` -Amazon S3 | [Amazon S3 Object Lambda access points API activity](https://docs.aws.amazon.com/AmazonS3/latest/userguide/cloudtrail-logging-s3-info.html#cloudtrail-data-events), such as calls to `CompleteMultipartUpload` and `GetObject`. | **S3 Object Lambda** | `AWS::S3ObjectLambda::AccessPoint` -Amazon S3 | Amazon FSx API activity on volumes. | **FSx Volume** | `AWS::FSx::Volume` -Amazon S3 Tables | Amazon S3 API activity on [tables](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-tables-create.html). | **S3 table** | `AWS::S3Tables::Table` -Amazon S3 Tables | Amazon S3 API activity on [table buckets](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-tables-buckets.html). | **S3 table bucket** | `AWS::S3Tables::TableBucket` -Amazon S3 Vectors | Amazon S3 API activity on [vector buckets](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-vectors-buckets.html). | **S3 vector bucket** | `AWS::S3Vectors::VectorBucket` -Amazon S3 Vectors | Amazon S3 API activity on [vector indexes](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-vectors-indexes.html). | **S3 vector index** | `AWS::S3Vectors::Index` -Amazon S3 on Outposts | [Amazon S3 on Outposts object-level API activity](https://docs.aws.amazon.com/AmazonS3/latest/userguide/cloudtrail-logging-s3-info.html#cloudtrail-data-events). | **S3 Outposts** | `AWS::S3Outposts::Object` -Amazon SNS | Amazon SNS [`Publish`](https://docs.aws.amazon.com/sns/latest/api/API_Publish.html) API operations on platform endpoints. | **SNS platform endpoint** | `AWS::SNS::PlatformEndpoint` -Amazon SNS | Amazon SNS [`Publish`](https://docs.aws.amazon.com/sns/latest/api/API_Publish.html) and [`PublishBatch`](https://docs.aws.amazon.com/sns/latest/api/API_PublishBatch.html) API operations on topics. | **SNS topic** | `AWS::SNS::Topic` -Amazon SQS | [Amazon SQS API activity](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-logging-using-cloudtrail.html#sqs-data-events-in-cloud-trail) on messages. | **SQS** | `AWS::SQS::Queue` -Supply Chain | Supply Chain API activity on an instance. | **Supply Chain** | `AWS::SCN::Instance` -Amazon SWF | [Amazon SWF API activity](https://docs.aws.amazon.com/amazonswf/latest/developerguide/ct-logging.html#cloudtrail-data-events) on [domains](https://docs.aws.amazon.com/amazonswf/latest/developerguide/swf-dev-domains.html). | **SWF domain** | `AWS::SWF::Domain` -AWS AppConfig | [AWS AppConfig API activity](https://docs.aws.amazon.com/appconfig/latest/userguide/logging-using-cloudtrail.html#appconfig-data-events-cloudtrail) for configuration operations such as calls to `StartConfigurationSession` and `GetLatestConfiguration`. | **AWS AppConfig** | `AWS::AppConfig::Configuration` -AWS AppSync | [AWS AppSync API activity](https://docs.aws.amazon.com/appsync/latest/devguide/cloudtrail-logging.html#cloudtrail-data-events) on AppSync GraphQL APIs. | **AppSync GraphQL** | `AWS::AppSync::GraphQLApi` -Amazon Aurora DSQL | Amazon Aurora DSQL API activity on cluster resources. | **Amazon Aurora DSQL** | `AWS::DSQL::Cluster` -AWS B2B Data Interchange | B2B Data Interchange API activity for Transformer operations such as calls to `GetTransformerJob` and `StartTransformerJob`. | **B2B Data Interchange** | `AWS::B2BI::Transformer` +Amazon WorkSpaces Applications | Agents accessing WorkSpaces Applications MCP tool events | **Agent Access MCP Tools** | `AWS::AgentAccessMCP::Tools` +AWS Agent Registry | API activity on `AWS::AgentRegistry::Registry` resources. | **AWS Agent Registry** | `AWS::AgentRegistry::Registry` +Amazon AIDevOps | AIDevOps API activity on agent spaces. | **Agent Space** | `AWS::AIDevOps::AgentSpace` +Amazon AIDevOps | AIDevOps API activity on associations. | **AIDevOps association** | `AWS::AIDevOps::Association` +Amazon AIDevOps | AIDevOps API activity on operator app teams. | **AIDevOps operator app team** | `AWS::AIDevOps::OperatorAppTeam` +Amazon AIDevOps | AIDevOps API activity on pipeline metadata. | **AIDevOps Pipelines Metadata** | `AWS::AIDevOps::PipelineMetadata` +Amazon AIDevOps | AIDevOps API activity on services. | **AIDevOps service** | `AWS::AIDevOps::Service` +Amazon Q Developer | Amazon Q Developer API activity on operational investigations. For more information, see [Amazon Q Developer](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/logging_cw_api_calls.html#Q-Developer-Investigations-Cloudtrail). | **AIOps Investigation Group** | `AWS::AIOps::InvestigationGroup` +Amazon OpenSearch Serverless | API activity on `AWS::AOSS::Collection` resources. | **AWS::AOSS::Collection** | `AWS::AOSS::Collection` +AWS AppConfig | AWS AppConfig API activity for configuration operations such as calls to StartConfigurationSession and GetLatestConfiguration. For more information, see [AWS AppConfig](https://docs.aws.amazon.com/appconfig/latest/userguide/logging-using-cloudtrail.html#appconfig-data-events-cloudtrail). | **AWS AppConfig** | `AWS::AppConfig::Configuration` +CloudWatch Application Signals | API activity on `AWS::ApplicationSignals::InstrumentationConfig` resources. | **AWS::ApplicationSignals::InstrumentationConfig** | `AWS::ApplicationSignals::InstrumentationConfig` +AWS AppSync | AWS AppSync API activity on AppSync GraphQL APIs. For more information, see [AWS AppSync](https://docs.aws.amazon.com/appsync/latest/devguide/cloudtrail-logging.html#cloudtrail-data-events). | **AppSync GraphQL** | `AWS::AppSync::GraphQLApi` +External anthropic workspace | API activity on `AWS::AWSExternalAnthropic::Workspace` resources. | **External anthropic workspace** | `AWS::AWSExternalAnthropic::Workspace` +AWS B2B Data Interchange | B2B Data Interchange API activity for Transformer operations such as calls to GetTransformerJob and StartTransformerJob. | **B2B Data Interchange** | `AWS::B2BI::Transformer` +AWS Backup access point | API activity on `AWS::Backup::BackupAccessPoint` resources. | **AWS Backup access point** | `AWS::Backup::BackupAccessPoint` @@ -150 +145,2 @@ AWS Backup | AWS Backup Search Data API activity on search jobs. | **AWS Backup -Amazon Bedrock | [Amazon Bedrock API activity](https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html#service-name-data-events-cloudtrail) on an agent alias. | **Bedrock agent alias** | `AWS::Bedrock::AgentAlias` +Amazon Bedrock | Bedrock API activity on advanced optimize prompt jobs. | **AdvancedOptimizePromptJob** | `AWS::Bedrock::AdvancedOptimizePromptJob` +Amazon Bedrock | Amazon Bedrock API activity on an agent alias. For more information, see [Amazon Bedrock](https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html#service-name-data-events-cloudtrail). | **Bedrock agent alias** | `AWS::Bedrock::AgentAlias` @@ -151,0 +148,6 @@ Amazon Bedrock | Amazon Bedrock API activity on async invocations. | **Bedrock a +Amazon Bedrock | Amazon Bedrock API activity on an automated reasoning policy. | **Bedrock Automated Reasoning Policy** | `AWS::Bedrock::AutomatedReasoningPolicy` +Amazon Bedrock | Amazon Bedrock API activity on an automated reasoning policy version. | **Bedrock Automated Reasoning Policy Version** | `AWS::Bedrock::AutomatedReasoningPolicyVersion` +Amazon Bedrock | Amazon Bedrock blueprint API activity. | **Bedrock blueprint** | `AWS::Bedrock::Blueprint` +Amazon Bedrock | Bedrock data automation invocation API activity. | **Bedrock Data Automation invocation** | `AWS::Bedrock::DataAutomationInvocation` +Amazon Bedrock | Amazon Bedrock data automation profile API activity. | **Bedrock Data Automation profile** | `AWS::Bedrock::DataAutomationProfile` +Amazon Bedrock | Amazon Bedrock data automation project API activity. | **Bedrock Data Automation project** | `AWS::Bedrock::DataAutomationProject` @@ -152,0 +155 @@ Amazon Bedrock | Amazon Bedrock API activity on a flow alias. | **Bedrock flow a +Amazon Bedrock | Amazon Bedrock API activity on flow executions. | **Flow Execution** | `AWS::Bedrock::FlowExecution` @@ -155 +158 @@ Amazon Bedrock | Amazon Bedrock API activity on inline agents. | **Bedrock Invok -Amazon Bedrock | [Amazon Bedrock API activity](https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html#service-name-data-events-cloudtrail) on a knowledge base. | **Bedrock knowledge base** | `AWS::Bedrock::KnowledgeBase` +Amazon Bedrock | Amazon Bedrock API activity on a knowledge base. For more information, see [Amazon Bedrock](https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html#service-name-data-events-cloudtrail). | **Bedrock knowledge base** | `AWS::Bedrock::KnowledgeBase` @@ -159,12 +162,2 @@ Amazon Bedrock | Amazon Bedrock API activity on sessions. | **Bedrock session** -Amazon Bedrock | Amazon Bedrock API activity on flow executions. | **Bedrock flow execution** | `AWS::Bedrock::FlowExecution` -Amazon Bedrock | Amazon Bedrock API activity on an automated reasoning policy. | **Bedrock automated reasoning policy** | `AWS::Bedrock::AutomatedReasoningPolicy` -Amazon Bedrock | Amazon Bedrock API activity on an automated reasoning policy version. | **Bedrock automated reasoning policy version** | `AWS::Bedrock::AutomatedReasoningPolicyVersion` -Amazon Bedrock | Amazon Bedrock data automation project API activity. | **Bedrock Data Automation project** | `AWS::Bedrock::DataAutomationProject` -Amazon Bedrock | Bedrock data automation invocation API activity. | **Bedrock Data Automation invocation** | `AWS::Bedrock::DataAutomationInvocation` -Amazon Bedrock | Amazon Bedrock data automation profile API activity. | **Bedrock Data Automation profile** | `AWS::Bedrock::DataAutomationProfile` -Amazon Bedrock | Amazon Bedrock blueprint API activity. | **Bedrock blueprint** | `AWS::Bedrock::Blueprint` -Amazon Bedrock | Amazon Bedrock Code-Interpreter API activity. | **Bedrock-AgentCore Code-Interpreter** | `AWS::BedrockAgentCore::CodeInterpreter` -Amazon Bedrock | Amazon Bedrock Browser API activity. | **Bedrock-AgentCore Browser** | `AWS::BedrockAgentCore::Browser` -Amazon Bedrock | Amazon Bedrock Workload Identity API activity. | **Bedrock-AgentCore Workload Identity** | `AWS::BedrockAgentCore::WorkloadIdentity` -Amazon Bedrock | Amazon Bedrock Workload Identity Directory API activity. | **Bedrock-AgentCore Workload Identity Directory** | `AWS::BedrockAgentCore::WorkloadIdentityDirectory` -Amazon Bedrock | Amazon Bedrock Token Vault API activity. | **Bedrock-AgentCore Token Vault** | `AWS::BedrockAgentCore::TokenVault` +Amazon Bedrock | Amazon Bedrock Tool API activity. | **Bedrock Tool** | `AWS::Bedrock::Tool` +Bedrock-AgentCore ABTest | API activity on `AWS::BedrockAgentCore::ABTest` resources. | **Bedrock-AgentCore ABTest** | `AWS::BedrockAgentCore::ABTest` @@ -172,2 +165,8 @@ Amazon Bedrock | Amazon Bedrock APIKey CredentialProvider API activity. | **Bedr -Amazon Bedrock | Amazon Bedrock Runtime API activity. | **Bedrock-AgentCore Runtime** | `AWS::BedrockAgentCore::Runtime` -Amazon Bedrock | Amazon Bedrock Runtime-Endpoint API activity. | **Bedrock-AgentCore Runtime-Endpoint** | `AWS::BedrockAgentCore::RuntimeEndpoint` +BedrockAgentCore batch evaluate | API activity on `AWS::BedrockAgentCore::BatchEvaluate` resources. | **BedrockAgentCore batch evaluate** | `AWS::BedrockAgentCore::BatchEvaluate` +Amazon Bedrock | Amazon Bedrock Browser API activity. | **Bedrock-AgentCore Browser** | `AWS::BedrockAgentCore::Browser` +Amazon Bedrock | Amazon Bedrock Browser-Custom API activity. | **Bedrock-AgentCore Browser-Custom** | `AWS::BedrockAgentCore::BrowserCustom` +Bedrock-AgentCore Browser Profile | API activity on `AWS::BedrockAgentCore::BrowserProfile` resources. | **Bedrock-AgentCore Browser Profile** | `AWS::BedrockAgentCore::BrowserProfile` +BedrockAgentCore CapacityProvider | API activity on `AWS::BedrockAgentCore::CapacityProvider` resources. | **BedrockAgentCore CapacityProvider** | `AWS::BedrockAgentCore::CapacityProvider` +Amazon Bedrock | Amazon Bedrock Code-Interpreter API activity. | **Bedrock-AgentCore Code-Interpreter** | `AWS::BedrockAgentCore::CodeInterpreter` +Amazon Bedrock | Amazon Bedrock Code-Interpreter-Custom API activity. | **Bedrock-AgentCore Code-Interpreter-Custom** | `AWS::BedrockAgentCore::CodeInterpreterCustom` +Amazon Bedrock AgentCore | Bedrock AgentCore API activity on evaluators. | **Bedrock-AgentCore Evaluator** | `AWS::BedrockAgentCore::Evaluator` @@ -177,11 +176,29 @@ Amazon Bedrock | Amazon Bedrock Oauth2 CredentialProvider API activity. | **Bedr -Amazon Bedrock | Amazon Bedrock Browser-Custom API activity. | **Bedrock-AgentCore Browser-Custom** | `AWS::BedrockAgentCore::BrowserCustom` -Amazon Bedrock | Amazon Bedrock Code-Interpreter-Custom API activity. | **Bedrock-AgentCore Code-Interpreter-Custom** | `AWS::BedrockAgentCore::CodeInterpreterCustom` -Amazon Bedrock | Amazon Bedrock Tool API activity. | **Bedrock Tool** | `AWS::Bedrock::Tool` -AWS Cloud Map | [AWS Cloud Map API activity](https://docs.aws.amazon.com/cloud-map/latest/dg/cloudtrail-data-events.html) on a [namespace](https://docs.aws.amazon.com/cloud-map/latest/api/API_Namespace.html). | **AWS Cloud Map namespace** | ``AWS::ServiceDiscovery::Namespace`` -AWS Cloud Map | [AWS Cloud Map API activity](https://docs.aws.amazon.com/cloud-map/latest/dg/cloudtrail-data-events.html) on a [service](https://docs.aws.amazon.com/cloud-map/latest/api/API_Service.html). | **AWS Cloud Map service** | ``AWS::ServiceDiscovery::Service`` -Amazon CloudFront | CloudFront API activity on a [KeyValueStore](https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_KeyValueStore.html). | **CloudFront KeyValueStore** | `AWS::CloudFront::KeyValueStore` -AWS CloudTrail | CloudTrail [`PutAuditEvents`](https://docs.aws.amazon.com/awscloudtraildata/latest/APIReference/API_PutAuditEvents.html) activity on a [CloudTrail Lake channel](./query-event-data-store-integration.html) that is used to log events from outside AWS. | **CloudTrail channel** | `AWS::CloudTrail::Channel` -Amazon CloudWatch | [Amazon CloudWatch API activity](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/logging_cw_api_calls.html#CloudWatch-data-plane-events) on metrics. | **CloudWatch metric** | `AWS::CloudWatch::Metric` -Amazon CloudWatch Network Flow Monitor | Amazon CloudWatch Network Flow Monitor API activity on monitors. | **Network Flow Monitor monitor** | `AWS::NetworkFlowMonitor::Monitor` -Amazon CloudWatch Network Flow Monitor | Amazon CloudWatch Network Flow Monitor API activity on scopes. | **Network Flow Monitor scope** | `AWS::NetworkFlowMonitor::Scope` -Amazon CloudWatch RUM | Amazon CloudWatch RUM API activity on app monitors. | **RUM app monitor** | `AWS::RUM::AppMonitor` +Bedrock-AgentCore payments | API activity on `AWS::BedrockAgentCore::Payments` resources. | **Bedrock-AgentCore payments** | `AWS::BedrockAgentCore::Payments` +Bedrock-AgentCore policy | API activity on `AWS::BedrockAgentCore::Policy` resources. | **Bedrock-AgentCore policy** | `AWS::BedrockAgentCore::Policy` +Bedrock-AgentCore policy engine | API activity on `AWS::BedrockAgentCore::PolicyEngine` resources. | **Bedrock-AgentCore policy engine** | `AWS::BedrockAgentCore::PolicyEngine` +Bedrock-AgentCore Recommendation | API activity on `AWS::BedrockAgentCore::Recommendation` resources. | **Bedrock-AgentCore Recommendation** | `AWS::BedrockAgentCore::Recommendation` +Bedrock-AgentCore Registry | API activity on `AWS::BedrockAgentCore::Registry` resources. | **Bedrock-AgentCore Registry** | `AWS::BedrockAgentCore::Registry` +Amazon Bedrock | Amazon Bedrock Runtime API activity. | **Bedrock-AgentCore Runtime** | `AWS::BedrockAgentCore::Runtime` +Amazon Bedrock | Amazon Bedrock Runtime-Endpoint API activity. | **Bedrock-AgentCore Runtime-Endpoint** | `AWS::BedrockAgentCore::RuntimeEndpoint` +Amazon Bedrock | Amazon Bedrock Token Vault API activity. | **Bedrock-AgentCore Token Vault** | `AWS::BedrockAgentCore::TokenVault` +Amazon Bedrock | Amazon Bedrock Workload Identity API activity. | **Bedrock-AgentCore Workload Identity** | `AWS::BedrockAgentCore::WorkloadIdentity` +Amazon Bedrock | Amazon Bedrock Workload Identity Directory API activity. | **Bedrock-AgentCore Workload Identity Directory** | `AWS::BedrockAgentCore::WorkloadIdentityDirectory` +Bedrock Mantle Project | API activity on `AWS::BedrockMantle::Project` resources. | **Bedrock Mantle Project** | `AWS::BedrockMantle::Project` +Bedrock Web Search Tool | API activity on `AWS::BedrockWebSearch::Tool` resources. | **Bedrock Web Search Tool** | `AWS::BedrockWebSearch::Tool` +Amazon Keyspaces (for Apache Cassandra) | Amazon Keyspaces (for Apache Cassandra) API activity on Cassandra CDC streams. | **Cassandra CDC streams** | `AWS::Cassandra::Stream` +Amazon Keyspaces (for Apache Cassandra) | Amazon Keyspaces API activity on a table. For more information, see [Amazon Keyspaces (for Apache Cassandra)](https://docs.aws.amazon.com/keyspaces/latest/devguide/logging-using-cloudtrail.html#keyspaces-in-cloudtrail-dml). | **Cassandra table** | `AWS::Cassandra::Table` +Certificate Manager | API activity on `AWS::CertificateManager::AcmeEndpoint` resources. | **AWS::CertificateManager::AcmeEndpoint** | `AWS::CertificateManager::AcmeEndpoint` +Clinical Trials Tech codelist | API activity on `AWS::ClinicalTrialsTech::Codelist` resources. | **Clinical Trials Tech codelist** | `AWS::ClinicalTrialsTech::Codelist` +Clinical Trials Tech dataset | API activity on `AWS::ClinicalTrialsTech::Dataset` resources. | **Clinical Trials Tech dataset** | `AWS::ClinicalTrialsTech::Dataset` +Clinical Trials Tech execution | API activity on `AWS::ClinicalTrialsTech::Execution` resources. | **Clinical Trials Tech execution** | `AWS::ClinicalTrialsTech::Execution` +Clinical Trials Tech instance | API activity on `AWS::ClinicalTrialsTech::Instance` resources. | **Clinical Trials Tech instance** | `AWS::ClinicalTrialsTech::Instance` +Clinical Trials Tech mapping | API activity on `AWS::ClinicalTrialsTech::Mapping` resources. | **Clinical Trials Tech mapping** | `AWS::ClinicalTrialsTech::Mapping` +Clinical Trials Tech schedule | API activity on `AWS::ClinicalTrialsTech::Schedule` resources. | **Clinical Trials Tech schedule** | `AWS::ClinicalTrialsTech::Schedule` +Clinical Trials Tech study | API activity on `AWS::ClinicalTrialsTech::Study` resources. | **Clinical Trials Tech study** | `AWS::ClinicalTrialsTech::Study` +Amazon CloudFront | CloudFront API activity on a KeyValueStore. For more information, see [Amazon CloudFront](https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_KeyValueStore.html). | **CloudFront KeyValueStore** | `AWS::CloudFront::KeyValueStore` +Amazon Cost Optimization | CloudOptimization API activity on profiles. | **AWS::CloudOptimization::Profile** | `AWS::CloudOptimization::Profile` +Amazon Cost Optimization | CloudOptimization API activity on recommendations. | **AWS::CloudOptimization::Recommendation** | `AWS::CloudOptimization::Recommendation` +AWS CloudTrail | CloudTrail PutAuditEvents activity on a CloudTrail Lake channel that is used to log events from outside AWS. For more information, see [AWS CloudTrail](https://docs.aws.amazon.com/awscloudtraildata/latest/APIReference/API_PutAuditEvents.html). | **CloudTrail channel** | `AWS::CloudTrail::Channel` +CloudWatch dataset | API activity on `AWS::CloudWatch::Dataset` resources. | **CloudWatch dataset** | `AWS::CloudWatch::Dataset` +Observability ingestion endpoint | API activity on `AWS::CloudWatch::IngestionEndpoint` resources. | **Observability ingestion endpoint** | `AWS::CloudWatch::IngestionEndpoint` +Amazon CloudWatch | Amazon CloudWatch API activity on metrics. For more information, see [Amazon CloudWatch](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/logging_cw_api_calls.html#CloudWatch-data-plane-events). | **CloudWatch metric** | `AWS::CloudWatch::Metric` @@ -191 +208 @@ Amazon CodeWhisperer | Amazon CodeWhisperer API activity on a profile. | **CodeW -Amazon Cognito | Amazon Cognito API activity on Amazon Cognito [identity pools](https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-info-in-cloudtrail.html#identity-pools-cloudtrail-events). | **Cognito Identity Pools** | `AWS::Cognito::IdentityPool` +Amazon Cognito | Amazon Cognito API activity on Amazon Cognito identity pools. For more information, see [Amazon Cognito](https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-info-in-cloudtrail.html#identity-pools-cloudtrail-events). | **Cognito Identity Pools** | `AWS::Cognito::IdentityPool` @@ -193,12 +210,8 @@ AWS Data Exchange | AWS Data Exchange API activity on assets. | **Data Exchange -Amazon Data Firehose | Amazon Data Firehose delivery stream API activity. | **Amazon Data Firehose** | `AWS::KinesisFirehose::DeliveryStream` -AWS Deadline Cloud | [Deadline Cloud](https://docs.aws.amazon.com/deadline-cloud/latest/userguide/logging-using-cloudtrail.html#cloudtrail-data-events) API activity on fleets. | **Deadline Cloud fleet** | `AWS::Deadline::Fleet` -AWS Deadline Cloud | [Deadline Cloud](https://docs.aws.amazon.com/deadline-cloud/latest/userguide/logging-using-cloudtrail.html#cloudtrail-data-events) API activity on jobs. | **Deadline Cloud job** | `AWS::Deadline::Job` -AWS Deadline Cloud | [Deadline Cloud](https://docs.aws.amazon.com/deadline-cloud/latest/userguide/logging-using-cloudtrail.html#cloudtrail-data-events) API activity on queues. | **Deadline Cloud queue** | `AWS::Deadline::Queue` -AWS Deadline Cloud | [Deadline Cloud](https://docs.aws.amazon.com/deadline-cloud/latest/userguide/logging-using-cloudtrail.html#cloudtrail-data-events) API activity on workers. | **Deadline Cloud worker** | `AWS::Deadline::Worker` -Amazon DynamoDB | [Amazon DynamoDB item-level API activity](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/logging-using-cloudtrail.html#ddb-data-plane-events-in-cloudtrail) on tables (for example, `PutItem`, `DeleteItem`, and `UpdateItem` API operations). - -###### Note - -For tables with streams enabled, the `resources` field in the data event contains both `AWS::DynamoDB::Stream` and `AWS::DynamoDB::Table`. If you specify `AWS::DynamoDB::Table` for the `resources.type`, it will log both DynamoDB table and DynamoDB streams events by default. To exclude [streams events](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/logging-using-cloudtrail.html#ddb-data-plane-events-in-cloudtrail), add a filter on the `eventName` field. | **DynamoDB** | `AWS::DynamoDB::Table` -Amazon DynamoDB | [Amazon DynamoDB](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/logging-using-cloudtrail.html#ddb-data-plane-events-in-cloudtrail) API activity on streams. | **DynamoDB Streams** | `AWS::DynamoDB::Stream` -Amazon Elastic Block Store | [Amazon Elastic Block Store (EBS)](https://docs.aws.amazon.com/ebs/latest/userguide/logging-ebs-apis-using-cloudtrail.html) direct APIs, such as `PutSnapshotBlock`, `GetSnapshotBlock`, and `ListChangedBlocks` on Amazon EBS snapshots. | **Amazon EBS direct APIs** | `AWS::EC2::Snapshot` +AWS Deadline Cloud | Deadline Cloud API activity on fleets. For more information, see [AWS Deadline Cloud](https://docs.aws.amazon.com/deadline-cloud/latest/userguide/logging-using-cloudtrail.html#cloudtrail-data-events). | **Deadline Cloud fleet** | `AWS::Deadline::Fleet` +AWS Deadline Cloud | Deadline Cloud API activity on jobs. For more information, see [AWS Deadline Cloud](https://docs.aws.amazon.com/deadline-cloud/latest/userguide/logging-using-cloudtrail.html#cloudtrail-data-events). | **Deadline Cloud job** | `AWS::Deadline::Job` +AWS Deadline Cloud | Deadline Cloud API activity on queues. For more information, see [AWS Deadline Cloud](https://docs.aws.amazon.com/deadline-cloud/latest/userguide/logging-using-cloudtrail.html#cloudtrail-data-events). | **Deadline Cloud queue** | `AWS::Deadline::Queue` +AWS Deadline Cloud | Deadline Cloud API activity on workers. For more information, see [AWS Deadline Cloud](https://docs.aws.amazon.com/deadline-cloud/latest/userguide/logging-using-cloudtrail.html#cloudtrail-data-events). | **Deadline Cloud worker** | `AWS::Deadline::Worker` +Diode Alerting linked alert | API activity on `AWS::DiodeAlerting::LinkedAlert` resources. | **Diode Alerting linked alert** | `AWS::DiodeAlerting::LinkedAlert` +Amazon Aurora DSQL | Amazon Aurora DSQL API activity on cluster resources. | **Amazon Aurora DSQL** | `AWS::DSQL::Cluster` +Amazon DynamoDB | Amazon DynamoDB API activity on streams. For more information, see [Amazon DynamoDB](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/logging-using-cloudtrail.html#ddb-data-plane-events-in-cloudtrail). | **DynamoDB Streams** | `AWS::DynamoDB::Stream` +Amazon DynamoDB | Amazon DynamoDB item-level API activity on tables (for example, PutItem, DeleteItem, and UpdateItem API operations). For tables with streams enabled, the resources field in the data event contains both AWS::DynamoDB::Stream and AWS::DynamoDB::Table. If you specify AWS::DynamoDB::Table for the resources.type, it will log both DynamoDB table and DynamoDB streams events by default. To exclude streams events, add a filter on the eventName field. For more information, see [Amazon DynamoDB](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/logging-using-cloudtrail.html#ddb-data-plane-events-in-cloudtrail). | **DynamoDB** | `AWS::DynamoDB::Table` @@ -205,0 +219 @@ Amazon Elastic Compute Cloud | Amazon EC2 instance connect endpoint API activity +Amazon Elastic Block Store | Amazon Elastic Block Store (EBS) direct APIs, such as PutSnapshotBlock, GetSnapshotBlock, and ListChangedBlocks on Amazon EBS snapshots. For more information, see [Amazon Elastic Block Store](https://docs.aws.amazon.com/ebs/latest/userguide/logging-ebs-apis-using-cloudtrail.html). | **EBS direct APIs** | `AWS::EC2::Snapshot` @@ -207,38 +221,10 @@ Amazon Elastic Container Service | Amazon Elastic Container Service API activity -Amazon Elastic Kubernetes Service | Amazon Elastic Kubernetes Service API activity on dashboards. | **Amazon Elastic Kubernetes Service dashboard** | `AWS::EKS::Dashboard` -Amazon EMR | [Amazon EMR API activity](https://docs.aws.amazon.com/emr/latest/ManagementGuide/logging-using-cloudtrail.html#cloudtrail-data-events) on a write-ahead log workspace. | **EMR write-ahead log workspace** | `AWS::EMRWAL::Workspace` -AWS End User Messaging SMS | [AWS End User Messaging SMS](https://docs.aws.amazon.com/sms-voice/latest/userguide/logging-using-cloudtrail.html#cloudtrail-data-events) API activity on origination identities. | **SMS Voice origination identity** | `AWS::SMSVoice::OriginationIdentity` -AWS End User Messaging SMS | [AWS End User Messaging SMS](https://docs.aws.amazon.com/sms-voice/latest/userguide/logging-using-cloudtrail.html#cloudtrail-data-events) API activity on messages. | **SMS Voice message** | `AWS::SMSVoice::Message` -AWS End User Messaging Social | [AWS End User Messaging Social](https://docs.aws.amazon.com/social-messaging/latest/userguide/logging-using-cloudtrail.html#cloudtrail-data-events) API activity on phone number IDs. | **Social-Messaging Phone Number Id** | `AWS::SocialMessaging::PhoneNumberId` -AWS End User Messaging Social | AWS End User Messaging Social API activity on Waba IDs. | **Social-Messaging Waba ID** | `AWS::SocialMessaging::WabaId` -Amazon FinSpace | [Amazon FinSpace](https://docs.aws.amazon.com/finspace/latest/userguide/logging-cloudtrail-events.html#finspace-dataplane-events) API activity on environments. | **FinSpace** | `AWS::FinSpace::Environment` -Amazon GameLift Streams | Amazon GameLift Streams [streaming API activity](https://docs.aws.amazon.com/gameliftstreams/latest/developerguide/logging-using-cloudtrail.html#cloudtrail-data-events) on applications. | **GameLift Streams application** | `AWS::GameLiftStreams::Application` -Amazon GameLift Streams | Amazon GameLift Streams [streaming API activity](https://docs.aws.amazon.com/gameliftstreams/latest/developerguide/logging-using-cloudtrail.html#cloudtrail-data-events) on stream groups. | **GameLift Streams stream group** | `AWS::GameLiftStreams::StreamGroup` -AWS Glue | AWS Glue API activity on tables that were created by Lake Formation. | **Lake Formation** | `AWS::Glue::Table` -Amazon GuardDuty | Amazon GuardDuty API activity for a [detector](https://docs.aws.amazon.com/guardduty/latest/ug/logging-using-cloudtrail.html#guardduty-data-events-in-cloudtrail). | **GuardDuty detector** | `AWS::GuardDuty::Detector` -AWS HealthImaging | AWS HealthImaging API activity on data stores. | **MedicalImaging data store** | `AWS::MedicalImaging::Datastore` -AWS HealthImaging | AWS HealthImaging image set API activity. | **MedicalImaging image set** | `AWS::MedicalImaging::Imageset` -AWS IoT | [AWS IoT API activity](https://docs.aws.amazon.com/greengrass/v2/developerguide/logging-using-cloudtrail.html#greengrass-data-events-cloudtrail) on [certificates](https://docs.aws.amazon.com/iot/latest/developerguide/x509-client-certs.html). | **IoT certificate** | `AWS::IoT::Certificate` -AWS IoT | [AWS IoT API activity](https://docs.aws.amazon.com/greengrass/v2/developerguide/logging-using-cloudtrail.html#greengrass-data-events-cloudtrail) on [things](https://docs.aws.amazon.com/iot/latest/developerguide/thing-registry.html). | **IoT thing** | `AWS::IoT::Thing` -AWS IoT Greengrass Version 2 | [Greengrass API activity](https://docs.aws.amazon.com/greengrass/v2/developerguide/logging-using-cloudtrail.html#greengrass-data-events-cloudtrail) from a Greengrass core device on a component version. - -###### Note - -Greengrass doesn't log access denied events. | **IoT Greengrass component version** | `AWS::GreengrassV2::ComponentVersion` -AWS IoT Greengrass Version 2 | [Greengrass API activity](https://docs.aws.amazon.com/greengrass/v2/developerguide/logging-using-cloudtrail.html#greengrass-data-events-cloudtrail) from a Greengrass core device on a deployment. - -###### Note - -Greengrass doesn't log access denied events. | **IoT Greengrass deployment** | `AWS::GreengrassV2::Deployment` -AWS IoT SiteWise | [IoT SiteWise API activity](https://docs.aws.amazon.com/iot-sitewise/latest/userguide/logging-using-cloudtrail.html#service-name-data-events-cloudtrail) on [assets](https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_CreateAsset.html). | **IoT SiteWise asset** | `AWS::IoTSiteWise::Asset` -AWS IoT SiteWise | [IoT SiteWise API activity](https://docs.aws.amazon.com/iot-sitewise/latest/userguide/logging-using-cloudtrail.html#service-name-data-events-cloudtrail) on [time series](https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_DescribeTimeSeries.html). | **IoT SiteWise time series** | `AWS::IoTSiteWise::TimeSeries` -AWS IoT SiteWise Assistant | Sitewise Assistant API activity on conversations. | **Sitewise Assistant conversation** | `AWS::SitewiseAssistant::Conversation` -AWS IoT TwinMaker | IoT TwinMaker API activity on an [entity](https://docs.aws.amazon.com/iot-twinmaker/latest/apireference/API_CreateEntity.html). | **IoT TwinMaker entity** | `AWS::IoTTwinMaker::Entity` -AWS IoT TwinMaker | IoT TwinMaker API activity on a [workspace](https://docs.aws.amazon.com/iot-twinmaker/latest/apireference/API_CreateWorkspace.html). | **IoT TwinMaker workspace** | `AWS::IoTTwinMaker::Workspace` -Amazon Kendra Intelligent Ranking | Amazon Kendra Intelligent Ranking API activity on [rescore execution plans](https://docs.aws.amazon.com/kendra/latest/dg/cloudtrail-intelligent-ranking.html#cloud-trail-intelligent-ranking-log-entry). | **Kendra Ranking** | `AWS::KendraRanking::ExecutionPlan` -Amazon Keyspaces (for Apache Cassandra) | [Amazon Keyspaces API activity](https://docs.aws.amazon.com/keyspaces/latest/devguide/logging-using-cloudtrail.html#keyspaces-in-cloudtrail-dml) on a table. | **Cassandra table** | `AWS::Cassandra::Table` -Amazon Keyspaces (for Apache Cassandra) | Amazon Keyspaces (for Apache Cassandra) API activity on Cassandra CDC streams. | **Cassandra CDC streams** | `AWS::Cassandra::Stream` -Amazon Kinesis Data Streams | Kinesis Data Streams API activity on [streams](https://docs.aws.amazon.com/streams/latest/dev/working-with-streams.html). | **Kinesis stream** | `AWS::Kinesis::Stream` -Amazon Kinesis Data Streams | Kinesis Data Streams API activity on [stream consumers](https://docs.aws.amazon.com/streams/latest/dev/building-consumers.html). | **Kinesis stream consumer** | `AWS::Kinesis::StreamConsumer` -Amazon Kinesis Video Streams | Kinesis Video Streams API activity on video streams, such as calls to `GetMedia` and `PutMedia`. | **Kinesis video stream** | `AWS::KinesisVideo::Stream` -Amazon Kinesis Video Streams | Kinesis Video Streams video signaling channel API activity. | **Kinesis video signaling channel** | `AWS::KinesisVideo::SignalingChannel` -AWS Lambda | AWS Lambda function execution activity (the `Invoke` API). | **Lambda** | `AWS::Lambda::Function` +Amazon Elastic Kubernetes Service | Amazon Elastic Kubernetes Service API activity on dashboards. | **EKS dashboard** | `AWS::EKS::Dashboard` +Amazon EMR | Amazon EMR API activity on a write-ahead log workspace. For more information, see [Amazon EMR](https://docs.aws.amazon.com/emr/latest/ManagementGuide/logging-using-cloudtrail.html#cloudtrail-data-events). | **EMR write-ahead log workspace** | `AWS::EMRWAL::Workspace` +EventBridge endpoint | API activity on `AWS::Events::Endpoint` resources. | **EventBridge endpoint** | `AWS::Events::Endpoint` +EventBridge event bus | API activity on `AWS::Events::EventBus` resources. | **EventBridge event bus** | `AWS::Events::EventBus` +EventBridge partner event source | API activity on `AWS::Events::EventSource` resources. | **EventBridge partner event source** | `AWS::Events::EventSource` +EventBridge rule | API activity on `AWS::Events::Rule` resources. | **EventBridge rule** | `AWS::Events::Rule` +Amazon FinSpace | Amazon FinSpace API activity on environments. For more information, see [Amazon FinSpace](https://docs.aws.amazon.com/finspace/latest/userguide/logging-cloudtrail-events.html#finspace-dataplane-events). | **FinSpace** | `AWS::FinSpace::Environment` +Amazon FSx | Amazon FSx API activity on volumes. | **FSx Volume** | `AWS::FSx::Volume` +Amazon GameLift Streams | Amazon GameLift Streams streaming API activity on applications. For more information, see [Amazon GameLift Streams](https://docs.aws.amazon.com/gameliftstreams/latest/developerguide/logging-using-cloudtrail.html#cloudtrail-data-events). | **GameLift Streams application** | `AWS::GameLiftStreams::Application` +Amazon GameLift Streams | Amazon GameLift Streams streaming API activity on stream groups. For more information, see [Amazon GameLift Streams](https://docs.aws.amazon.com/gameliftstreams/latest/developerguide/logging-using-cloudtrail.html#cloudtrail-data-events). | **GameLift Streams stream group** | `AWS::GameLiftStreams::StreamGroup` @@ -248 +234,34 @@ Amazon Location Routes | Amazon Location Routes API activity. | **Geo Routes** | -Amazon Machine Learning | Machine Learning API activity on ML models. | **Maching Learning MlModel** | `AWS::MachineLearning::MlModel`