AWS awscloudtrail: CloudTrail network activity events: expanded service and event-source lists
Summary
The list of services that can emit CloudTrail network activity events was rewritten and expanded (e.g., Amazon Aurora DSQL, Amazon Bedrock, AWS Secrets Manager, AWS SSO, Route 53 Public DNS, S3 Vectors, Security Token Service (STS), Sign-In Portal), entries were alphabetized/renamed, and many new event source domains were added to the valid `eventSource` values (e.g., `sts.amazonaws.com`, `sso.amazonaws.com`, `signin.amazonaws.com`, `route53.amazonaws.com`, `s3vectors.amazonaws.com`). A former note stating that Amazon S3 Multi-Region Access Points are not supported was removed, and obsolete domains (`cloudoptimization.amazonaws.com`, `nova-act.amazonaws.com`, `transform-agents.amazonaws.com`, `transform-custom.amazonaws.com`) were replaced.
Security assessment
This is a maintenance/refresh of reference lists for CloudTrail network activity events (supported services and accepted eventSource domains). It improves coverage of what can be logged, which is logging/audit-adjacent, but it references no vulnerability, incident, or configuration weakness and removes a purely functional S3 MRAP caveat. No auth, encryption, credential, or exposure guidance is added.
Evidence
+ * `sts.amazonaws.com`
Diff
diff --git a/awscloudtrail/latest/userguide/logging-network-events-with-cloudtrail.md b/awscloudtrail/latest/userguide/logging-network-events-with-cloudtrail.md index c84c75aad..bef30c57b 100644 --- a//awscloudtrail/latest/userguide/logging-network-events-with-cloudtrail.md +++ b//awscloudtrail/latest/userguide/logging-network-events-with-cloudtrail.md @@ -15 +15 @@ You can log network activity events for the following services: - * AWS AppConfig + * Amazon Aurora DSQL @@ -17 +17 @@ You can log network activity events for the following services: - * AWS App Mesh + * Amazon Bedrock @@ -19 +19 @@ You can log network activity events for the following services: - * Amazon Athena + * Amazon Connect Voice ID @@ -21 +21 @@ You can log network activity events for the following services: - * AWS B2B Data Interchange + * Amazon EventBridge Scheduler @@ -23 +23 @@ You can log network activity events for the following services: - * AWS Backup gateway + * Amazon Fraud Detector @@ -25 +25 @@ You can log network activity events for the following services: - * Amazon Bedrock + * Amazon HealthLake @@ -27 +27 @@ You can log network activity events for the following services: - * Billing and Cost Management + * Amazon Lookout for Equipment @@ -29 +29 @@ You can log network activity events for the following services: - * AWS Pricing Calculator + * Amazon Lookout for Vision @@ -31 +31 @@ You can log network activity events for the following services: - * AWS Cost Explorer + * Amazon Q Subscriptions @@ -33 +33 @@ You can log network activity events for the following services: - * AWS Cloud Control API + * Amazon QuickSight @@ -35 +35 @@ You can log network activity events for the following services: - * AWS CloudHSM + * Amazon Rekognition @@ -37 +37 @@ You can log network activity events for the following services: - * AWS Cloud Map + * Amazon SageMaker @@ -39 +39 @@ You can log network activity events for the following services: - * AWS CloudFormation + * Amazon Textract @@ -41 +41 @@ You can log network activity events for the following services: - * AWS CloudTrail + * Amazon Transcribe Streaming Service @@ -43 +43 @@ You can log network activity events for the following services: - * Amazon CloudWatch + * Amazon Verified Permissions @@ -45 +45 @@ You can log network activity events for the following services: - * CloudWatch Application Signals + * Amazon WorkMail @@ -47 +47 @@ You can log network activity events for the following services: - * AWS CodeDeploy + * Anthropic Claude Developer Platform on AWS @@ -49 +49 @@ You can log network activity events for the following services: - * Amazon Comprehend Medical + * Athena @@ -51 +51 @@ You can log network activity events for the following services: - * AWS Config + * AWS Agent Registry @@ -53 +53 @@ You can log network activity events for the following services: - * AWS Data Exports + * AWS AppConfig @@ -55 +55 @@ You can log network activity events for the following services: - * Amazon Data Firehose + * aws assurance @@ -57 +57 @@ You can log network activity events for the following services: - * AWS Directory Service + * AWS B2B Data Interchange @@ -59 +59 @@ You can log network activity events for the following services: - * Amazon DynamoDB + * AWS BCM Pricing Calculator @@ -61 +61 @@ You can log network activity events for the following services: - * Amazon EC2 + * AWS Billing @@ -63 +63 @@ You can log network activity events for the following services: - * Amazon Elastic Container Service + * AWS Cloud Map @@ -65 +65 @@ You can log network activity events for the following services: - * Amazon Elastic File System + * AWS Glue @@ -67 +67 @@ You can log network activity events for the following services: - * Elastic Load Balancing + * AWS IdentityStore Service @@ -69 +69 @@ You can log network activity events for the following services: - * Amazon EventBridge + * AWS Invoicing @@ -71 +71 @@ You can log network activity events for the following services: - * Amazon EventBridge Scheduler + * AWS IoT FleetWise @@ -73 +73 @@ You can log network activity events for the following services: - * Amazon Fraud Detector + * AWS IoT Secured Tunneling @@ -75 +75 @@ You can log network activity events for the following services: - * AWS Free Tier + * AWS IoT SiteWise @@ -77 +77 @@ You can log network activity events for the following services: - * Amazon FSx + * AWS License Manager @@ -79 +79 @@ You can log network activity events for the following services: - * AWS Glue + * AWS Partner Central Revenue Measurement @@ -81 +81 @@ You can log network activity events for the following services: - * AWS HealthLake + * AWS Secrets Manager @@ -83 +83 @@ You can log network activity events for the following services: - * AWS IoT FleetWise + * AWS SSO @@ -85 +85 @@ You can log network activity events for the following services: - * AWS IoT Secure Tunneling + * AWS Step Functions @@ -87 +87 @@ You can log network activity events for the following services: - * AWS Invoicing + * AWS Transfer Family @@ -89 +89 @@ You can log network activity events for the following services: - * Amazon Keyspaces (for Apache Cassandra) + * AWS Transform @@ -91 +91 @@ You can log network activity events for the following services: - * AWS KMS + * AWSBillingAndCostManagementDataExports @@ -95 +95 @@ You can log network activity events for the following services: - * AWS Lambda + * Backup Gateway @@ -97 +97 @@ You can log network activity events for the following services: - * AWS License Manager + * Bedrock Agent Core @@ -99 +99 @@ You can log network activity events for the following services: - * Amazon Lookout for Equipment + * Cloud Control API @@ -101 +101 @@ You can log network activity events for the following services: - * Amazon Lookout for Vision + * CloudFormation @@ -103 +103 @@ You can log network activity events for the following services: - * Amazon Personalize + * CloudHSM @@ -105 +105 @@ You can log network activity events for the following services: - * Amazon Q Business + * CloudTrail @@ -107 +107 @@ You can log network activity events for the following services: - * Amazon Rekognition + * CodeDeploy @@ -109 +109 @@ You can log network activity events for the following services: - * Amazon Relational Database Service + * Comprehend medical @@ -111 +111 @@ You can log network activity events for the following services: - * Amazon S3 + * Compute Optimizer Automation @@ -113 +113 @@ You can log network activity events for the following services: -###### Note + * DynamoDB @@ -115 +115 @@ You can log network activity events for the following services: -Amazon S3 [Multi-Region Access Points](https://docs.aws.amazon.com/AmazonS3/latest/userguide/MultiRegionAccessPointRequests.html) are not supported. + * EC2 Auto Scaling @@ -117 +117 @@ Amazon S3 [Multi-Region Access Points](https://docs.aws.amazon.com/AmazonS3/late - * Amazon SageMaker AI + * Elastic Compute Cloud (EC2) @@ -119 +119 @@ Amazon S3 [Multi-Region Access Points](https://docs.aws.amazon.com/AmazonS3/late - * AWS Secrets Manager + * Elastic File System (EFS) @@ -121 +121 @@ Amazon S3 [Multi-Region Access Points](https://docs.aws.amazon.com/AmazonS3/late - * Amazon Simple Notification Service + * IoT @@ -123 +123 @@ Amazon S3 [Multi-Region Access Points](https://docs.aws.amazon.com/AmazonS3/late - * Amazon Simple Queue Service + * Key Management Service (KMS) @@ -125 +125 @@ Amazon S3 [Multi-Region Access Points](https://docs.aws.amazon.com/AmazonS3/late - * Amazon Simple Workflow Service + * Lambda @@ -127 +127 @@ Amazon S3 [Multi-Region Access Points](https://docs.aws.amazon.com/AmazonS3/late - * AWS Storage Gateway + * Relational Database Service (RDS) Core Control Plane @@ -129 +129 @@ Amazon S3 [Multi-Region Access Points](https://docs.aws.amazon.com/AmazonS3/late - * AWS Systems Manager Incident Manager + * Route 53 Public DNS @@ -131 +131 @@ Amazon S3 [Multi-Region Access Points](https://docs.aws.amazon.com/AmazonS3/late - * Amazon Textract + * S3 Vectors @@ -133 +133 @@ Amazon S3 [Multi-Region Access Points](https://docs.aws.amazon.com/AmazonS3/late - * Amazon Transcribe + * Security Token Service (STS) @@ -135 +135 @@ Amazon S3 [Multi-Region Access Points](https://docs.aws.amazon.com/AmazonS3/late - * Amazon Translate + * Sign-In Portal @@ -137 +137 @@ Amazon S3 [Multi-Region Access Points](https://docs.aws.amazon.com/AmazonS3/late - * AWS Transform + * Simple Email Service (SES) @@ -139 +139 @@ Amazon S3 [Multi-Region Access Points](https://docs.aws.amazon.com/AmazonS3/late - * Amazon Verified Permissions + * Simple Notification Service (SNS) @@ -141 +141,9 @@ Amazon S3 [Multi-Region Access Points](https://docs.aws.amazon.com/AmazonS3/late - * Amazon WorkMail + * Simple Queue Service (SQS) + + * Simple Storage Service (S3) + + * Simple Workflow Service (SWF) + + * SSM Contacts +