Document history

Updated documentation

General organizational improvements to user guide sections and page titles, which includes the following: Changed title of CloudTrail log event reference page to Understanding CloudTrail events and added descriptions of management events, data events, and Insights events. Changed title of Settings page to Configure CloudTrail settings. Moved Logging data events, Logging management events, and Logging Insights events pages to the Understanding CloudTrail events section. Moved CloudTrail log file examples page to the CloudTrail log files section. Added separate pages to list the Amazon CLI commands for CloudTrail Lake event data stores, queries, and integrations.

April 10, 2024

Updated documentation

Updated the CloudTrail Lake supported Regions page to add the Europe (Spain) Region (eu-south-2).

April 10, 2024

Added service support

This release supports Amazon Control Catalog. For more information, see Amazon Web Service topics for CloudTrail and Logging Amazon Control Catalog API calls using Amazon CloudTrail.

April 8, 2024

Added service support

This release supports Amazon Deadline Cloud. For more information, see Amazon Web Service topics for CloudTrail.

April 2, 2024

Added functionality

The Amazon CloudTrail event version is now 1.10. For more information, see CloudTrail record contents.

March 26, 2024

Added service support

This release supports Amazon Billing Conductor. For more information, see Amazon Web Service topics for CloudTrail and Logging Amazon Billing Conductor API calls using Amazon CloudTrail.

March 12, 2024

Added functionality

You can now log CloudTrail data events on Amazon X-Ray traces and Amazon Systems Manager managed nodes by using advanced event selectors. For more information, see Data events.

March 7, 2024

Added functionality

You can now log CloudTrail data events on Amazon Simple Workflow Service (Amazon SWF) domains by using advanced event selectors. For more information, see Data events.

February 14, 2024

Added functionality

CloudTrail added the ListInsightsMetricData API. The ListInsightsMetricData API returns Insights metrics data for trails that have enabled Insights. For more information, see ListInsightsMetricData in the Amazon CloudTrail API Reference.

February 6, 2024

Added functionality

You can now log CloudTrail data events for Amazon IoT, Amazon IoT SiteWise, and Amazon AppConfig by using advanced event selectors. For more information, see Data events.

January 4, 2024

Added functionality

You can now log CloudTrail data events for Amazon IoT Greengrass by using advanced event selectors. For more information, see Data events.

December 22, 2023

New Region support

CloudTrail expanded support to a new Region, the Canada West (Calgary) Region. For more information, see CloudTrail supported Regions.

December 20, 2023

Added functionality

You can now log CloudTrail data events for Amazon Keyspaces (for Apache Cassandra), Amazon IoT TwinMaker, Amazon RDS, and Amazon Supply Chain by using advanced event selectors. For more information, see Data events.

December 20, 2023

Updated Amazon managed policy

Updated the CloudTrailServiceRolePolicy managed policy to allow the following actions on an organization event data store when federation is disabled: glue:DeleteTable and lakeformation:DeregisterResource.

November 26, 2023

Added functionality

You can now can federate a CloudTrail Lake event data store to see the metadata associated with the event data store in the Amazon Glue Data Catalog and run SQL queries on the event data using Amazon Athena. The table metadata stored in the Amazon Glue Data Catalog lets the Athena query engine know how to find, read, and process the data that you want to query. For more information, see Federate an event data store.

November 26, 2023

Added functionality

You can now log CloudTrail data events for Amazon Cloud Map by using advanced event selectors. For more information, see Logging data events.

November 16, 2023

Added functionality

You can now log CloudTrail data events on Amazon SQS messages by using advanced event selectors. For more information, see Logging data events.

November 16, 2023

Added functionality

CloudTrail Lake now offers two pricing options for event data stores: one-year extendable retention pricing and seven-year retention pricing. The pricing option determines the cost for ingesting and storing events, and the default and maximum retention period for the event data store. Before this release, all event data stores used the seven-year retention pricing option. You can switch an event data store from using the seven-year retention pricing option to using the one-year extendable retention pricing by using the CloudTrail console, Amazon CLI, or the UpdateEventDataStore API operation. For more information about pricing options, see Amazon CloudTrail Pricing and Event data store pricing options.

November 15, 2023

Added functionality

You can now collect Insights events in CloudTrail Lake. Amazon CloudTrail Insights help Amazon users identify and respond to unusual activity associated with API calls and API error rates by continuously analyzing CloudTrail management events. To collect Insights events in CloudTrail Lake, you need a source event data store that logs management events and enables Insights and a destination event data store that collects Insights events based upon unusual management event activity in the source event data store. For more information, see Create an event data store for CloudTrail Insights events and Logging Insights events.

November 9, 2023

Added service support

This release supports Amazon Launch Wizard. For more information, see Amazon Web Service topics for CloudTrail and Logging Amazon Launch Wizard API calls using Amazon CloudTrail.

November 8, 2023

Added service support

This release supports Amazon Bedrock. For more information, see Amazon Web Service topics for CloudTrail and Log Amazon Bedrock API calls using Amazon CloudTrail.

October 23, 2023

Added functionality

You can now log CloudTrail data events on Amazon CodeWhisperer customizations by using advanced event selectors. For more information, see Logging data events.

October 18, 2023

Added functionality

You can now log CloudTrail data events on Amazon Timestream databases and tables by using advanced event selectors. For more information, see Logging data events.

September 28, 2023

Added functionality

You can now log CloudTrail data events on Amazon SNS topics and platform endpoints by using advanced event selectors. For more information, see Logging data events.

September 28, 2023

Updated documentation

Added table to show the tasks that the management account, delegated administrator accounts, and member accounts within an Amazon Organizations organization can perform in CloudTrail. For more information, see Organization delegated administrator.

September 25, 2023

Added service support

This release supports Amazon Web Services Marketplace Agreements. For more information, see Amazon Web Service topics for CloudTrail and Logging Agreements API Calls using Amazon CloudTrail.

September 1, 2023

Added functionality

You can now log CloudTrail data events on Amazon Kinesis video streams and Amazon SageMaker endpoints by using advanced event selectors. For more information, see Logging data events.

August 31, 2023

Added service support

This release supports Amazon Application Transformation Service. Amazon Application Transformation Service is a backend service used by services like Amazon Microservice Extractor for .NET. For more information, see CloudTrail supported services and integrations.

August 26, 2023

Added functionality

You can now log CloudTrail data events on Amazon Private CA Connector for Active Directory by using advanced event selectors. For more information, see Logging data events.

August 24, 2023

Updated documentation

Added new CloudTrail Lake scenarios to show how to create event data stores, view CloudTrail Lake dashboards, copy trail events to an event data store, view and run sample queries, and save query results to an Amazon S3 bucket using the Amazon Web Services Management Console. For more information, see Scenarios for CloudTrail Lake

August 16, 2023

New Region support

CloudTrail expanded support to a new Region, the Israel (Tel Aviv) Region. For more information, see CloudTrail supported Regions.

August 1, 2023

Added service support

This release supports Amazon HealthImaging. For more information, see CloudTrail supported services and integrations and Logging Amazon HealthImaging API calls using Amazon CloudTrail.

July 26, 2023

Added functionality

You can now log CloudTrail data events on Amazon HealthImaging data stores by using advanced event selectors. For more information, see Logging data events.

July 26, 2023

Added functionality

You can now log CloudTrail data events on Amazon Systems Manager control channels and Amazon Managed Blockchain networks by using advanced event selectors. For more information, see Logging data events.

June 21, 2023

Added functionality

You can now verify your CloudTrail Lake saved query results using the aws cloudtrail verify-query-results command. For more information, see Validate saved query results with the Amazon CLI.

June 21, 2023

Added service support

This release supports Amazon Verified Permissions. For more information, see CloudTrail supported services and integrations and Logging Amazon Verified Permissions API calls using Amazon CloudTrail.

June 13, 2023

Added functionality

You can now use CloudTrail Lake dashboards to visualize the events in an event data store. For more information, see View Lake dashboards.

June 13, 2023

Added functionality

You can now log CloudTrail data events on Amazon Verified Permissions policy stores by using advanced event selectors. For more information, see Logging data events.

June 13, 2023

Added functionality

You can now log CloudTrail data events on an Amazon CodeWhisperer profile by using advanced event selectors. For more information, see Logging data events.

June 6, 2023

Added functionality

You can now start and stop event ingestion on CloudTrail event data stores. For information about stopping event ingestion using the console, see Stop an event data store from ingesting events. For information about stopping event ingestion using the Amazon CLI, see Stop ingestion on an event data store.

June 2, 2023

Added functionality

You can now log CloudTrail data events on an Amazon EMR write-ahead log workspace by using advanced event selectors. For more information, see Logging data events.

May 31, 2023

Added service support

This release supports Amazon Security Lake. For more information, see CloudTrail supported services and integrations and Logging Amazon Security Lake API calls using Amazon CloudTrail.

May 30, 2023

Updated documentation

Updated CloudTrail userIdentity element topic to include an example and field descriptions for a request made on behalf of an IAM Identity Center user. For more information, see CloudTrail userIdentity element.

May 23, 2023

Updated documentation

This update supports the following patch release for the CloudTrail Processing Library: aws-cloudtrail-processing-library-1.6.1.jar. For more information, see Using the CloudTrail Processing Library and the CloudTrail Processing Library on GitHub.

May 23, 2023

Added functionality

CloudTrail Lake now supports all Presto functions and operators. For more information, see CloudTrail Lake SQL constraints.

May 9, 2023

Added functionality

You can now log CloudTrail data events on an Amazon GuardDuty detector by using advanced event selectors. For more information, see Logging data events and Logging Amazon GuardDuty API calls with Amazon CloudTrail.

March 30, 2023

Updated documentation

Added new section about creating user-defined cost allocation tags for event data stores. For more information, see Creating user-defined cost allocation tags for CloudTrail Lake event data stores.

March 24, 2023

Added service support

This release supports Amazon Telco Network Builder (Amazon TNB). For more information, see CloudTrail supported services and integrations and Logging Amazon Telco Network Builder API calls using Amazon CloudTrail.

February 21, 2023

Added functionality

You can now log CloudTrail data events on Amazon Cognito identity pools by using advanced event selectors. For more information, see Logging data events.

February 15, 2023

Updated documentation

Added new section about the learning resources available for CloudTrail Lake. For more information, see Learning resources.

February 9, 2023

Added functionality

You can now create CloudTrail Lake integrations with event sources outside of Amazon. You can log and store user activity data from any source in your hybrid environments, such as in-house or SaaS applications hosted on-premises or in the cloud, virtual machines, or containers. For more information, see Create an integration with an event source outside of Amazon.

January 31, 2023

Added functionality

You can now log CloudTrail data events on CloudTrail PutAuditEvents activity on a CloudTrail Lake channel by using advanced event selectors. For more information, see Logging data events.

January 31, 2023

New Region support

CloudTrail expanded support to a new Region, the Asia Pacific (Melbourne) Region. For more information, see CloudTrail supported Regions.

January 24, 2023

Updated documentation

Added new section about managing data consistency in CloudTrail, see Managing data consistency in CloudTrail.

January 18, 2023

Added functionality

You can now log CloudTrail data events on Amazon SageMaker feature stores by using advanced event selectors. For more information, see Logging data events.

December 27, 2022

Added service support

This release supports Amazon Web Services Marketplace Discovery. See Amazon CloudTrail Supported Services and Integrations.

December 15, 2022

Added functionality

You can now log CloudTrail data events on Amazon SageMaker metrics experiment trial components by using advanced event selectors. For more information, see Logging data events.

December 15, 2022

Added functionality

You can now create an event data store to include Amazon Config configuration items, and use the event data store to investigate non-compliant changes to your production environments. For more information, see Create an event data store for Amazon Config configuration items.

November 28, 2022

New Region support

CloudTrail expanded support to a new Region, the Asia Pacific (Hyderabad) Region. For more information, see CloudTrail supported Regions.

November 22, 2022

Added functionality

You can now log CloudTrail data events on Amazon FinSpace environments by using advanced event selectors. For more information, see Logging data events.

November 18, 2022

New Region support

CloudTrail expanded support to a new Region, the Europe (Spain) Region. For more information, see CloudTrail supported Regions.

November 16, 2022

New Region support

CloudTrail expanded support to a new Region, the Europe (Zurich) Region. For more information, see CloudTrail supported Regions.

November 9, 2022

Added functionality

The management account for an Amazon Organizations organization can now add a delegated administrator to manage the organization's CloudTrail trails and event data stores. For more information, see Organization delegated administrator.

November 7, 2022

Added functionality

You can now enable Amazon Key Management Service encryption for a CloudTrail Lake event data store. For more information, see Create an event data store.

November 7, 2022

Added functionality

You can now save CloudTrail Lake query results to an Amazon S3 bucket when you run a query. For more information about running a query, see Run a query and save query results. For more information about downloading query results, see Get and download saved query results.

October 21, 2022

Added functionality

You can now copy CloudTrail trail events to a CloudTrail Lake event data store. For more information, see Copying trail events to CloudTrail Lake.

September 19, 2022

Updated documentation

Added list of supported Amazon CloudWatch metrics for CloudTrail Lake. For more information, see Supported CloudWatch metrics.

September 16, 2022

Added functionality

You can now view CloudTrail service-linked channels using the Amazon CLI. For more information, see Viewing service-linked channels for CloudTrail by using the Amazon CLI.

September 9, 2022

New Region support

CloudTrail expanded support to a new Region, the Middle East (UAE) Region. For more information, see CloudTrail supported Regions.

August 30, 2022

Changed functionality

CloudTrail has changed the name of the managed policy AWSCloudTrailReadOnlyAccess to AWSCloudTrail_ReadOnlyAccess. Permissions in this policy have been scoped down. By default, the policy no longer grants permission to list all Amazon S3 buckets, Amazon Lambda functions, or Amazon KMS aliases. For more information, see Read-only access.

June 6, 2022

Changed functionality

As a security best practice, you can now add an aws:SourceArn or aws:SourceAccount condition key to an s3:GetBucketAcl ACL checking block in Amazon S3 bucket policies. For more information, see Configure Amazon S3 bucket policies for CloudTrail.

May 11, 2022

Changed functionality

Starting Feb 24, 2022, Amazon CloudTrail began changing the userAgent and sourceIPAddress field values in any event that originated from an Amazon Web Services Management Console session where a proxy client was used. For these events, CloudTrail replaces the values of the userAgent and sourceIPAddress fields with AWS Internal. CloudTrail made this change to standardize how it logs information for service actions across all Amazon services. For more information, see CloudTrail record contents.

April 12, 2022

Added service support

This release supports Amazon GameSparks. See Amazon CloudTrail Supported Services and Integrations.

March 24, 2022

Added service support

This release supports Amazon App Mesh Envoy Management Service. See Amazon CloudTrail Supported Services and Integrations.

March 18, 2022

Updated documentation

New query examples have been added for CloudTrail Lake, a new feature that lets you run fine-grained, multiple-field SQL queries on your events. Also, a new field, BytesScanned, has been added to the query metadata results of DescribeQuery and GetQueryResults operations. For more information, see Working with CloudTrail Lake.

March 4, 2022

Changed functionality

CloudTrail now removes the account ID of the Amazon S3 bucket owner in the resources block of a data event if both of the following conditions are met: the data event API call is from a different Amazon account than the Amazon S3 bucket owner, and the API caller received an AccessDenied error that was only for the caller account. For more information, see Redacting bucket owner account IDs for data events called by other accounts.

March 3, 2022

Updated documentation

This update supports the following release for the CloudTrail Processing Library: Added support for implementing a custom S3 manager, event logging to log file parsing-related exceptions, support for parsing an optional errorCode field in insightDetails, and updated the account ID parsing regex to accept non-numerical values. For more information, see Using the CloudTrail Processing Library and the CloudTrail Processing Library on GitHub.

January 28, 2022

Added functionality

CloudTrail introduces CloudTrail Lake, a new feature that lets you run fine-grained, multiple-field SQL queries on your events. Events are aggregated into event data stores, which are immutable collections of events based on criteria that you select by applying advanced event selectors. For more information, see Working with CloudTrail Lake.

January 5, 2022

New Region support

CloudTrail expanded support to a new Region, the Asia Pacific (Jakarta) Region. For more information, see CloudTrail supported Regions.

December 13, 2021

Added service support

This release supports Amazon WorkSpaces Web. See Amazon CloudTrail Supported Services and Integrations.

December 3, 2021

Added functionality

You can now log CloudTrail data events on Amazon Glue tables created by Lake Formation by using advanced event selectors. For more information, see Logging data events.

November 30, 2021

Changed functionality

As a security best practice, you can now add an aws:SourceArn or aws:SourceAccount condition key to Amazon KMS key policies and Amazon S3 bucket policies. For more information, see Configure Amazon KMS key policies for CloudTrail and Configure Amazon S3 bucket policies for CloudTrail.

November 15, 2021

Added service support

This release supports Amazon Resilience Hub. See Amazon CloudTrail Supported Services and Integrations.

November 10, 2021

Added functionality

A new CloudTrail Insights event type is available: error rate Insights events. An error rate Insights event captures unusual activity on an error that occurs on APIs called in your account. For more information, see Logging Insights events for trails.

November 10, 2021

Added functionality

You can now log CloudTrail data events on DynamoDB streams by using advanced event selectors. For more information, see Logging data events.

September 22, 2021

Added functionality

You can now log data events on Amazon S3 access points. You can log Amazon S3 access point data events by using advanced event selectors. For more information, see Logging data events.

August 24, 2021

Changed functionality

When you configure a trail to send notifications to Amazon SNS, CloudTrail adds a policy statement to your SNS topic access policy that allows CloudTrail to send content to an SNS topic. As a security best practice, we recommend adding an aws:SourceArn or aws:SourceAccount condition key to the CloudTrail policy statement. For more information, see Amazon SNS topic policy for CloudTrail.

August 16, 2021

Added service support

This release supports Amazon Route 53 Application Recovery Controller. See Amazon CloudTrail Supported Services and Integrations.

July 27, 2021

Added functionality

You can now log data events on Amazon EBS direct APIs run on EBS snapshots. You can log Amazon EBS direct API data events by using advanced event selectors. For more information, see Logging data events.

July 27, 2021

Changed functionality

When CloudTrail processes data events, it preserves numbers in their original format, whether that is an integer (int) or a float. In events that have integers in the fields of a data event, CloudTrail historically processed these numbers as floats. Now, CloudTrail keeps the original format of integers in data events. For more information, see Using the CloudTrail Processing Library.

July 13, 2021

Added service support

This release supports Amazon BugBust. See Amazon CloudTrail Supported Services and Integrations.

June 24, 2021

Added service support

This release supports Amazon Managed Grafana and Amazon Managed Service for Prometheus. See Amazon CloudTrail Supported Services and Integrations.

June 2, 2021

Added service support

This release supports Amazon App Runner. See Amazon CloudTrail Supported Services and Integrations.

May 18, 2021

Added service support

This release supports Amazon Systems Manager Incident Manager. See Amazon CloudTrail Supported Services and Integrations.

May 10, 2021

Updated documentation

This update describes data event logging requirements for Amazon Config conformance packs, especially for compliance frameworks such as HIPAA or FedRAMP. For more information, see Logging data events.

May 7, 2021

Added service support

This release supports Service Quotas and Amazon EBS direct APIs. See Amazon CloudTrail Supported Services and Integrations.

April 13, 2021

Added functionality

After an IAM administrator configures Amazon STS, CloudTrail logs sourceIdentity information in events when users assume an IAM role, or perform any actions with the assumed role. For more information, see CloudTrail userIdentity Element.

April 13, 2021

Updated documentation

This update documents limits, in kilobytes (KB), for content in some CloudTrail event record fields. For more information, see CloudTrail record contents.

April 8, 2021

Added functionality

After an IAM administrator configures Amazon STS, CloudTrail logs sourceIdentity information in events when users assume an IAM role, or perform any actions with the assumed role. For more information, see CloudTrail userIdentity Element.

April 6, 2021

Added functionality

You can now log data events on Amazon DynamoDB tables. You can log DynamoDB data events by using either event selectors or advanced event selectors. For more information, see Logging data events.

March 23, 2021

Added service support

This release supports Amazon Managed Workflows for Apache Airflow. See Amazon CloudTrail Supported Services and Integrations.

March 22, 2021

Added functionality

You can now log data events on S3 Object Lambda access points if you have opted in to use advanced event selectors. For more information, see Logging data events.

March 18, 2021

Added service support

This release supports Amazon Fault Injection Simulator. See Amazon CloudTrail Supported Services and Integrations.

March 15, 2021

Added functionality

You can now log data events on Ethereum nodes in Amazon Managed Blockchain if you have opted in to use advanced event selectors. For more information, see Logging data events.

March 1, 2021

Added service support

This release supports Amazon Managed Blockchain and the preview of Ethereum for Managed Blockchain. See Amazon CloudTrail Supported Services and Integrations.

February 4, 2021

Added service support

This release supports Amazon Amplify. See Amazon CloudTrail Supported Services and Integrations.

February 3, 2021

Added service support

This release supports Amazon Lookout for Metrics. See Amazon CloudTrail Supported Services and Integrations.

February 1, 2021

Updated documentation

This update supports the following patch release for the CloudTrail Processing Library: Update the .jar file references in the user guide to use the latest version, aws-cloudtrail-processing-library-1.4.0.jar. For more information, see Using the CloudTrail Processing Library and the CloudTrail Processing Library on GitHub.

January 12, 2021

Added functionality

You can now log data events on Amazon S3 on Amazon Outposts. For more information, see Logging data events.

December 21, 2020

Added service support

This release supports Amazon Lookout for Equipment, Amazon Well-Architected Tool, and Amazon Location Service. See Amazon CloudTrail Supported Services and Integrations.

December 16, 2020

Added service support

This release supports Amazon IoT Greengrass V2. See Amazon CloudTrail Supported Services and Integrations.

December 15, 2020

Added service support

This release supports Amazon EMR on EKS. See Amazon CloudTrail Supported Services and Integrations.

December 10, 2020

Added service support

This release supports Amazon Audit Manager and Amazon HealthLake. See Amazon CloudTrail Supported Services and Integrations.

December 8, 2020

Added service support

This release supports Amazon Lookout for Vision. See Amazon CloudTrail Supported Services and Integrations.

December 1, 2020

Added functionality

The Amazon CloudTrail event version is now 1.08. Version 1.08 introduces new fields for CloudTrail. For more information, see CloudTrail record contents.

November 24, 2020

Added functionality

Amazon CloudTrail introduces advanced event selectors for data events. Advanced event selectors allow finer-grained control over the data events that you log to your trail. You can include or exclude data events for specific Amazon resources, and select specific APIs on those resources to log to your trail. For more information, see Logging data events.

November 24, 2020

Added service support

This release supports Amazon Network Firewall. See Amazon CloudTrail Supported Services and Integrations.

November 17, 2020

Added service support

This release supports Amazon Trusted Advisor. See Amazon CloudTrail Supported Services and Integrations.

October 22, 2020

Updated documentation

Added two new examples of event records for root user sign-in events. For more information, see Amazon Console sign-in events.

October 13, 2020

Changed functionality

Permissions in the AWSCloudTrail_FullAccess policy have been narrowed. This policy no longer allows you to delete Amazon SNS topics or Amazon S3 buckets, and the getObject action has been removed. For more information, see Granting custom permissions for CloudTrail users.

September 29, 2020

Updated documentation

This update supports the following patch release for the CloudTrail Processing Library: Update the .jar file references in the user guide to use the latest version, aws-cloudtrail-processing-library-1.3.0.jar. For more information, see Using the CloudTrail Processing Library and the CloudTrail Processing Library on GitHub.

August 28, 2020

Added service support

This release supports Amazon Outposts. See Amazon CloudTrail Supported Services and Integrations.

August 28, 2020

Added functionality

Amazon CloudTrail Insights introduces attribution fields for CloudTrail Insights events. Attribution fields show the top user identities, user agents, and error codes that are associated with the anomalous activity that triggers Insights events. For comparison, attribution fields also show the top user identities, user agents, and error codes associated with normal, or baseline, activity. For more information, see Logging Insights events for trails.

August 13, 2020

Added functionality

The Amazon CloudTrail console has a new look that's designed to make it easier to use. The Amazon CloudTrail User Guide has been updated with changes to procedures for how to perform tasks in the console, such as creating trails, updating trails, and downloading event history.

August 13, 2020

Added service support

This release supports Amazon Interactive Video Service. See Amazon CloudTrail Supported Services and Integrations.

July 15, 2020

Added service support

This release supports Amazon Honeycode. See Amazon CloudTrail Supported Services and Integrations.

June 24, 2020

Added service support

This release supports Amazon Macie. See Amazon CloudTrail Supported Services and Integrations.

May 19, 2020

Added service support

This release supports Amazon Kendra. See Amazon CloudTrail Supported Services and Integrations.

May 13, 2020

Added service support

This release supports Amazon IoT SiteWise. See Amazon CloudTrail Supported Services and Integrations.

April 29, 2020

Added Region support

This release supports an additional Region: Europe (Milan). See Amazon CloudTrail Supported Regions.

April 28, 2020

Added service and Region support

This release supports Amazon AppFlow. See Amazon CloudTrail Supported Services and Integrations. Support has also been added for the Africa (Cape Town) Region. See Amazon CloudTrail Supported Regions.

April 22, 2020

Added functionality

High-volume Amazon KMS actions such as Encrypt, Decrypt, and GenerateDataKey are now logged as Read events. If you choose to log all Amazon KMS events on your trail, and also choose to log Write management events, your trail logs relevant Amazon KMS actions like Disable, Delete and ScheduleKey.

April 7, 2020

Added service support

This release supports Amazon CodeGuru Reviewer. See Amazon CloudTrail Supported Services and Integrations.

February 7, 2020

Added service support

This release supports Amazon Managed Apache Cassandra Service. See Amazon CloudTrail Supported Services and Integrations.

January 17, 2020

Added service support

This release supports Amazon Connect. See Amazon CloudTrail Supported Services and Integrations.

December 13, 2019

Updated documentation

This update supports the following patch release for the CloudTrail Processing Library: Update the .jar file references in the user guide to use the latest version, aws-cloudtrail-processing-library-1.2.0.jar. For more information, see Using the CloudTrail Processing Library and the CloudTrail Processing Library on GitHub.

November 21, 2019

Added functionality

This release supports Amazon CloudTrail Insights for helping you detect unusual activity in your account. See Logging Insights events for Trails.

November 20, 2019

Added functionality

This release adds an option for filtering Amazon Key Management Service events out of a trail. See Creating a Trail.

November 20, 2019

Added service support

This release supports AWS CodeStar Notifications. See Amazon CloudTrail Supported Services and Integrations.

November 7, 2019

Added functionality

This release supports adding tags when you create a trail in CloudTrail, whether you use the CloudTrail console or API. This release adds two new APIs, GetTrail and ListTrails.

November 1, 2019

Added service support

This release supports Amazon App Mesh. See Amazon CloudTrail Supported Services and Integrations.

October 17, 2019

Added service support

This release supports Amazon Translate. See Amazon CloudTrail Supported Services and Integrations.

October 17, 2019

Documentation update

The Unsupported Services topic has been restored and updated to include only those Amazon services that do not currently log events in CloudTrail. See CloudTrail Unsupported Services.

October 7, 2019

Documentation update

The documentation has been updated with changes to the AWSCloudTrailFullAccess policy. A policy example that shows equivalent permissions to AWSCloudTrailFullAccess has been updated to restrict the resources on which the iam:PassRole action can act to those matching the following condition statement: "iam:PassedToService": "cloudtrail.amazonaws.com". See Amazon CloudTrail Identity-Based Policy Examples.

September 24, 2019

Documentation update

The documentation has been updated with a new topic, Managing CloudTrail Costs, to help you get the log data you need out of CloudTrail while staying within a budget.

September 3, 2019

Added service support

This release supports Amazon Control Tower. See Amazon CloudTrail Supported Services and Integrations.

August 13, 2019

Added Region support

This release supports an additional Region: Middle East (Bahrain). See Amazon CloudTrail Supported Regions.

July 29, 2019

Documentation update

The documentation has been updated with information about security for CloudTrail. See Security in Amazon CloudTrail.

July 3, 2019

Added service support

This release supports Amazon Ground Station. See Amazon CloudTrail Supported Services and Integrations.

June 6, 2019

Added service support

This release supports Amazon IoT Things Graph. See Amazon CloudTrail Supported Services and Integrations.

June 4, 2019

Added service support

This release supports Amazon AppStream 2.0. See Amazon CloudTrail Supported Services and Integrations.

April 25, 2019

Added Region support

This release supports an additional Region: Asia Pacific (Hong Kong). See Amazon CloudTrail Supported Regions.

April 24, 2019

Added service support

This release supports Amazon Managed Service for Apache Flink. See Amazon CloudTrail Supported Services and Integrations.

March 22, 2019

Added service support

This release supports Amazon Backup. See Amazon CloudTrail Supported Services and Integrations.

February 4, 2019

Added service support

This release supports Amazon WorkLink. See Amazon CloudTrail Supported Services and Integrations.

January 23, 2019

Added service support

This release supports Amazon Cloud9. See Amazon CloudTrail Supported Services and Integrations.

January 21, 2019

Added service support

This release supports AWS Elemental MediaLive. See Amazon CloudTrail Supported Services and Integrations.

January 19, 2019

Added service support

This release supports Amazon Comprehend. See Amazon CloudTrail Supported Services and Integrations.

January 18, 2019

Added service support

This release supports AWS Elemental MediaPackage. See Amazon CloudTrail Supported Services and Integrations.

December 21, 2018

Added Region support

This release supports an additional Region: EU (Stockholm). See Amazon CloudTrail Supported Regions.

December 11, 2018

Documentation update

The documentation has been updated with information about supported and unsupported services. See Amazon CloudTrail Supported Services and Integrations.

December 3, 2018

Added service support

This release supports Amazon Resource Access Manager (Amazon RAM). See Amazon CloudTrail Supported Services and Integrations.

November 20, 2018

Updated functionality

This release supports creating a trail in CloudTrail that logs events for all Amazon accounts in an organization in Amazon Organizations. See Creating a Trail for an Organization.

November 19, 2018

Added service support

This release supports Amazon Pinpoint SMS and Voice API. See Amazon CloudTrail Supported Services and Integrations.

November 16, 2018

Added service support

This release supports Amazon IoT Greengrass. See Amazon CloudTrail Supported Services and Integrations.

October 29, 2018

Updated documentation

This update supports the following patch release for the CloudTrail Processing Library: Update the .jar file references in the user guide to use the latest version, aws-cloudtrail-processing-library-1.1.3.jar. For more information, see Using the CloudTrail Processing Library and the CloudTrail Processing Library on GitHub.

October 18, 2018

Added functionality

This release supports using additional filters in Event history. See Viewing CloudTrail Events in the CloudTrail Console.

October 18, 2018

Added functionality

This release supports using Amazon Virtual Private Cloud (Amazon VPC) to establish a private connection between your VPC and Amazon CloudTrail. See Using Amazon CloudTrail with Interface VPC Endpoints.

August 9, 2018

Added service support

This release supports Amazon Data Lifecycle Manager. See Amazon CloudTrail Supported Services and Integrations.

July 24, 2018

Added service support

This release supports Amazon MQ. See Amazon CloudTrail Supported Services and Integrations.

July 19, 2018

Added service support

This release supports Amazon Mobile CLI. See Amazon CloudTrail Supported Services and Integrations.

June 29, 2018

Amazon CloudTrail documentation history notification available through RSS feed

You can now receive notification about updates to the Amazon CloudTrail documentation by subscribing to an RSS feed.

June 29, 2018

This update supports the following patch release for the CloudTrail Processing Library:

For more information, see Using the CloudTrail Processing Library and the CloudTrail Processing Library on GitHub.

This update supports the following patch release for the CloudTrail Processing Library:

For more information, see Using the CloudTrail Processing Library and the CloudTrail Processing Library on GitHub.

Added Region support

This release supports an additional Region: Asia Pacific (Osaka) (ap-northeast-3). See CloudTrail supported Regions.

February 12, 2018

This release supports logging data events for Amazon Lambda functions.

For more information, see Logging data events.

This release supports logging data events for Amazon Lambda functions.

For more information, see Logging data events.

This release supports the following updates to the CloudTrail Processing Library:

For more information, see Using the CloudTrail Processing Library and the CloudTrail Processing Library on GitHub.

Updated documentation

This release updates the documentation of APIs supported in CloudTrail event history for Amazon Athena, Amazon CodeBuild, Amazon Elastic Container Registry, and Amazon Migration Hub.

This release supports configuring data event logging in the China (Beijing) Region for all Amazon S3 buckets in your Amazon account. See Logging data events.

Added service support

Added functionality and documentation

This release supports CloudTrail being enabled by default for all Amazon accounts. The past seven days of account activity are available in CloudTrail event history, and the most recent events appear on the console dashboard. The feature formerly known as API activity history has been replaced by Event history.

Added functionality and documentation

This release supports downloading events from the CloudTrail console on the API activity history page. You can download events in JSON or CSV format.

For more information, see Downloading events.

This release supports logging Amazon S3 object level API operations in two additional Regions, Europe (London) and Canada (Central).

For more information, see Working with CloudTrail log files.

Added service support

Added functionality and documentation

This release supports additional APIs in the CloudTrail API activity history feature for the following services:

This release supports the following updates to the CloudTrail Processing Library:

For more information, see Using the CloudTrail Processing Library and the CloudTrail Processing Library on GitHub.

Added service support

This release supports Amazon Athena. See CloudTrail supported services and integrations.

This release supports sending data events to Amazon CloudWatch Logs.

For more information about configuring your trail to log data events, see Data events.

For more information about sending events to CloudWatch Logs, see Monitoring CloudTrail Log Files with Amazon CloudWatch Logs.

Added service support

This release supports Amazon QuickSight. See CloudTrail supported services and integrations.

If CloudTrail is not delivering logs to your S3 bucket or sending SNS notifications from some Regions in your account, you may need to update the policies.

To learn more about updating your S3 bucket policy, see Common Amazon S3 policy configuration errors.

To learn more about updating your SNS topic policy, see CloudTrail is not sending notifications for a Region.

Added service support

This release supports Amazon Cloud Directory. See CloudTrail supported services and integrations.

Added functionality and documentation

This release supports looking up APIs for Amazon CodeCommit, Amazon GameLift, and Amazon Managed Services in the CloudTrail API activity history.

Added functionality

This release supports integration with the Amazon Health Dashboard.

For more information, see the Amazon Health User Guide.

Added functionality and documentation

This release supports filtering by event source in the CloudTrail console. Event source shows the Amazon service to which the request was made.

For more information, see Viewing recent CloudTrail management events with the CloudTrail console.

Added service support

This release supports Amazon CodeBuild See CloudTrail supported services and integrations.

This release supports Amazon Health. See CloudTrail supported services and integrations.

This release supports Amazon Step Functions. See CloudTrail supported services and integrations.

December 1, 2016

Added functionality and documentation

This release supports configuring your trail to log read-only, write-only, or all events.

CloudTrail supports logging Amazon S3 object level API operations such as GetObject, PutObject, and DeleteObject. You can configure your trails to log object level API operations.

For more information, see Working with CloudTrail log files.

This release supports CloudWatch Logs in the China (Beijing) Region. For more information about CloudTrail support for CloudWatch Logs monitoring, see Monitoring CloudTrail Log Files with Amazon CloudWatch Logs.

Added service support

This release supports Amazon Elastic File System (Amazon EFS). See CloudTrail supported services and integrations.

June 28, 2016

Added service support

This release supports CloudWatch Logs in the South America (São Paulo) Region. For more information, see Monitoring CloudTrail Log Files with Amazon CloudWatch Logs.

Added service support

This release supports Amazon CloudWatch Logs. See CloudTrail supported services and integrations.

March 10, 2016

This release supports turning on CloudTrail across all Regions and support for multiple trails per Region.

For more information, see Receiving CloudTrail log files from multiple Regions and Create multiple trails.

Added service support

This release supports Amazon GameLift (Amazon GameLift). See CloudTrail supported services and integrations.

January 27, 2016

Added service support

This release supports Amazon CloudWatch Events. See CloudTrail supported services and integrations.

January 16, 2016

Added service support

This release supports Amazon Elastic Container Registry (Amazon ECR). See CloudTrail supported services and integrations.

December 21, 2015

Added service support

This release supports Amazon Device Farm. See CloudTrail supported services and integrations.

July 13, 2015

Added service support

This release supports Amazon API Gateway. See CloudTrail supported services and integrations.

July 9, 2015

Added service support

This release supports CodePipeline. See CloudTrail supported services and integrations.

July 9, 2015

Added service support

This release supports Amazon DynamoDB. See CloudTrail supported services and integrations.

May 28, 2015

Added service support

This release supports CloudWatch Logs in the US West (N. California) Region. See the CloudTrail release notes. For more information about CloudTrail support for CloudWatch Logs monitoring, see Monitoring CloudTrail Log Files with Amazon CloudWatch Logs.

May 19, 2015

Added service support

This release supports Amazon Directory Service. See CloudTrail supported services and integrations.

May 14, 2015

Added service support

This release supports Amazon Simple Email Service (Amazon SES). See CloudTrail supported services and integrations.

May 7, 2015

Added service support

This release supports Amazon Elastic Container Service See CloudTrail supported services and integrations.

April 9, 2015

Added service support

This release supports Amazon Lambda. See CloudTrail supported services and integrations.

April 9, 2015

Added service support

This release supports Amazon WorkSpaces. See CloudTrail supported services and integrations.

April 9, 2015

This release supports the lookup of Amazon activity captured by CloudTrail (CloudTrail events). You can look up and filter events in your account related to creation, modification, or deletion. To look up these events, you can use the CloudTrail console, the Amazon Command Line Interface (Amazon CLI), or the Amazon SDK. For more information, see Working with CloudTrail Event history.

March 12, 2015

Added service support and new documentation

This release supports Amazon CloudWatch Logs in the Asia Pacific (Singapore), Asia Pacific (Sydney), Asia Pacific (Tokyo), and Europe (Frankfurt) Regions. For more information, see Sending events to CloudWatch Logs.

March 5, 2015

New documentation

A new section that describes CloudTrail support for Amazon Security Token Service (Amazon STS) regional endpoints has been added to the CloudTrail Concepts page.

February 17, 2015

Added service support

This release supports Amazon Route 53. See CloudTrail supported services and integrations.

February 11, 2015

Added service support

This release supports Amazon Config. See CloudTrail supported services and integrations.

February 10, 2015

Added service support

This release supports Amazon CloudHSM. See CloudTrail supported services and integrations.

January 8, 2015

Added service support

This release supports Amazon CodeDeploy. See CloudTrail supported services and integrations.

December 17, 2014

Added service support

This release supports Amazon Storage Gateway. See CloudTrail supported services and integrations.

December 16, 2014

Added Region support

This release supports one additional Region: us-gov-west-1 (Amazon GovCloud (US-West)). See CloudTrail supported Regions.

December 16, 2014

Added service support

This release supports Amazon S3 Glacier. See CloudTrail supported services and integrations.

December 11, 2014

Added service support

This release supports Amazon Data Pipeline. See CloudTrail supported services and integrations.

December 2, 2014

Added service support

This release supports Amazon Key Management Service. See CloudTrail supported services and integrations.

November 12, 2014

New documentation

A new section, Monitoring CloudTrail Log Files with Amazon CloudWatch Logs, has been added to the guide. It describes how to use Amazon CloudWatch Logs to monitor CloudTrail log events.

November 10, 2014

New documentation

A new section, Using the CloudTrail Processing Library, has been added to the guide. It provides information about how to write a CloudTrail log processor in Java using the Amazon CloudTrail Processing Library.

November 5, 2014

Added service support

This release supports Amazon Elastic Transcoder. See CloudTrail supported services and integrations.

October 27, 2014

Added Region support

This release supports one additional region: eu-central-1 (Europe (Frankfurt)). See CloudTrail supported Regions.

October 23, 2014

Added service support

This release supports Amazon CloudSearch. See CloudTrail supported services and integrations.

October 16, 2014

Added service support

This release supports Amazon Simple Notification Service. See CloudTrail supported services and integrations.

October 09, 2014

Added service support

This release supports Amazon ElastiCache. See CloudTrail supported services and integrations.

September 15, 2014

Added service support

This release supports Amazon WorkDocs. See CloudTrail supported services and integrations.

August 27, 2014

Added new content

This release includes a topic that discusses logging sign-in events. See Amazon Web Services Management Console sign-in events.

July 24, 2014

Added new content

The eventVersion element for this release has been upgraded to version 1.02 and three new fields have been added. See CloudTrail record contents.

July 18, 2014

Added service support

This release supports Auto Scaling (see CloudTrail supported services and integrations).

July 17, 2014

Added Region support

This release supports three additional Regions: ap-southeast-1 (Asia Pacific (Singapore)), ap-northeast-1 (Asia Pacific (Tokyo)), sa-east-1 (South America (São Paulo)). See CloudTrail supported Regions.

June 30, 2014

Additional service support

This release supports Amazon Redshift. See CloudTrail supported services and integrations.

June 10, 2014

Added service support

This release supports Amazon OpsWorks. See CloudTrail supported services and integrations.

June 5, 2014

Added service support

This release supports Amazon CloudFront. See CloudTrail supported services and integrations.

May 28, 2014

Added Region support

This release supports three additional Regions: us-west-1 (US West (N. California)), eu-west-1 (Europe (Ireland)), ap-southeast-2 (Asia Pacific (Sydney)). See CloudTrail supported Regions.

May 13, 2014

Added service support

This release supports Amazon Simple Workflow Service. See CloudTrail supported services and integrations.

May 9, 2014

Added new content

This release includes topics that discuss sharing log files between accounts. See Sharing CloudTrail log files between Amazon accounts.

May 2, 2014

Added service support

This release supports Amazon CloudWatch. See CloudTrail supported services and integrations.

April 28, 2014

Added service support

This release supports Amazon Kinesis. See CloudTrail supported services and integrations.

April 22, 2014

Added service support

This release supports Amazon Direct Connect. See CloudTrail supported services and integrations.

April 11, 2014

Added service support

This release supports Amazon EMR. See CloudTrail supported services and integrations.

April 4, 2014

Added service support

This release supports Elastic Beanstalk. See CloudTrail supported services and integrations.

April 2, 2014

Additional service support

This release supports Amazon CloudFormation. See CloudTrail supported services and integrations.

March 7, 2014

New guide

This release introduces Amazon CloudTrail.

November 13, 2013