AWS vpc: Document CloudTrail logging for 1:1 NAT API calls
Summary
Adds a note that ModifyTransitGatewayAttachmentNatConfiguration is logged as a write management event and GetTransitGatewayAttachmentNatConfiguration as a read management event in CloudTrail.
Security assessment
The change documents audit/CloudTrail logging coverage for the new 1:1 NAT configuration APIs, clarifying which operations are recorded as write vs read management events. This is security-relevant logging/audit documentation, hence medium severity, but it does not address a specific vulnerability.
Evidence
+For 1:1 NAT, `ModifyTransitGatewayAttachmentNatConfiguration` is logged as a write management event. `GetTransitGatewayAttachmentNatConfiguration` is logged as a read management event, which appears only if your trail records read events.
Diff
diff --git a/vpc/latest/tgw/logging-using-cloudtrail.md b/vpc/latest/tgw/logging-using-cloudtrail.md index 67fa61b..a0447eb 100644 --- a//vpc/latest/tgw/logging-using-cloudtrail.md +++ b//vpc/latest/tgw/logging-using-cloudtrail.md @@ -49,0 +50,2 @@ AWS Transit Gateway logs all Transit Gateway control plane operations as managem +For 1:1 NAT, `ModifyTransitGatewayAttachmentNatConfiguration` is logged as a write management event. `GetTransitGatewayAttachmentNatConfiguration` is logged as a read management event, which appears only if your trail records read events. +