Logging management events

Example: Logging read and write events for separate trails

The following example shows how you can configure trails to split log activity for an account into separate S3 buckets: one bucket receives read-only events and a second bucket receives write-only events.

1. You create a trail and choose an S3 bucket named amzn-s3-demo-bucket1 to receive log files. You then update the trail to specify that you want Read management events.

2. You create a second trail and choose an S3 bucket named amzn-s3-demo-bucket2 to receive log files. You then update the trail to specify that you want Write management events.

3. The Amazon EC2 DescribeInstances and TerminateInstances API operations occur in your account.

4. The DescribeInstances API operation is a read-only event and it matches the settings for the first trail. The trail logs and delivers the event to amzn-s3-demo-bucket1.

5. The TerminateInstances API operation is a write-only event and it matches the settings for the second trail. The trail logs and delivers the event to amzn-s3-demo-bucket2.

1. Sign in to the Amazon Web Services Management Console and open the CloudTrail console at https://console.amazonaws.cn/cloudtrail/.

2. Open the Trails page of the CloudTrail console and choose the trail name.

3. For Management events, choose Edit.

   • Choose if you want to log Read events, Write events, or both.

   • Choose Exclude Amazon KMS events to filter Amazon Key Management Service (Amazon KMS) events out of your traiL. The default setting is to include all Amazon KMS events.

     The option to log or exclude Amazon KMS events is available only if you log management events on your trail. If you choose not to log management events, Amazon KMS events are not logged, and you cannot change Amazon KMS event logging settings.

     Amazon KMS actions such as Encrypt, Decrypt, and GenerateDataKey typically generate a large volume (more than 99%) of events. These actions are now logged as Read events. Low-volume, relevant Amazon KMS actions such as Disable, Delete, and ScheduleKey (which typically account for less than 0.5% of Amazon KMS event volume) are logged as Write events.

     To exclude high-volume events like Encrypt, Decrypt, and GenerateDataKey, but still log relevant events such as Disable, Delete and ScheduleKey, choose to log Write management events, and clear the check box for Exclude Amazon KMS events.

4. Choose Save changes when you are finished.

1. Sign in to the Amazon Web Services Management Console and open the CloudTrail console at https://console.amazonaws.cn/cloudtrail/.

2. Open the Event data stores page of the CloudTrail console and choose the event data store name.

3. For Management events, choose Edit and then configure the following settings:

   1. Choose between Simple event collection or Advanced event collection:

      • Choose Simple event collection if you want to log all events, log only read events, or log only write events. You can choose also to exclude Amazon Key Management Service and Amazon RDS Data API management events.

      • Choose Advanced event collection if you want to include or exclude management events based on the values of advanced event selector fields, including the eventName, eventType, eventSource, and userIdentity.arn fields.

   2. If you selected Simple event collection, choose whether you want to log all events, log only read events, or log only write events. You can also choose to exclude Amazon KMS and Amazon RDS management events.

   3. If you selected Advanced event collection, make the following selections:

      1. In Log selector template, choose a predefined template, or Custom to build a custom configuration based on advanced event selector field values.

         You can choose from the following predefined templates:

         • Log all events – Choose this template to log all events.

         • Log only read events – Choose this template to log only read events. Read-only events are events that do not change the state of a resource, such as Get* or Describe* events.

         • Log only write events – Choose this template to log only write events. Write events add, change, or delete resources, attributes, or artifacts, such as Put*, Delete*, or Write* events.

         • Log only Amazon Web Services Management Console events – Choose this template to log only events originating from the Amazon Web Services Management Console.

         • Exclude Amazon Web Services service initiated events – Choose this template to exclude Amazon Web Services service events, which have an eventType of AwsServiceEvent, and events initiated with Amazon Web Services service-linked roles (SLRs).

      2. (Optional) In Selector name, enter a name to identify your selector. The selector name is a descriptive name for an advanced event selector, such as "Log management events from Amazon Web Services Management Console sessions". The selector name is listed as Name in the advanced event selector and is viewable if you expand the JSON view.

      3. If you chose Custom, in Advanced event selectors build an expression based on advanced event selector field values.

         Note

         Selectors don't support the use of wildcards like * . To match multiple values with a single condition, you may use StartsWith, EndsWith, NotStartsWith, or NotEndsWith to explicitly match the beginning or end of the event field.

         1. Choose from the following fields.

            • readOnly – readOnly can be set to equals a value of true or false. When it is set to false, the event data store logs Write-only management events. Read-only management events are events that do not change the state of a resource, such as Get* or Describe* events. Write events add, change, or delete resources, attributes, or artifacts, such as Put*, Delete*, or Write* events. To log both Read and Write events, don't add a readOnly selector.

            • eventName – eventName can use any operator. You can use it to include or exclude any management event, such as CreateAccessPoint or GetAccessPoint.

            • userIdentity.arn – Include or exclude events for actions taken by specific IAM identities. For more information, see CloudTrail userIdentity element.

            • sessionCredentialFromConsole – Include or exclude events originating from an Amazon Web Services Management Console session. This field can be set to equals or not equals with a value of true.

            • eventSource – You can use it to include or exclude specific event sources. The eventSource is typically a short form of the service name without spaces plus .amazonaws.com. For example, you could set eventSource equals to ec2.amazonaws.com to log only Amazon EC2 management events.

            • eventType – The eventType to include or exclude. For example, you can set this field to not equals AwsServiceEvent to exclude Amazon Web Services service events.

         2. For each field, choose + Condition to add as many conditions as you need, up to a maximum of 500 specified values for all conditions.

            For information about how CloudTrail evaluates multiple conditions, see How CloudTrail evaluates multiple conditions for a field.

            Note

            You can have a maximum of 500 values for all selectors on an event data store. This includes arrays of multiple values for a selector such as eventName. If you have single values for all selectors, you can have a maximum of 500 conditions added to a selector.

         3. Choose + Field to add additional fields as required. To avoid errors, do not set conflicting or duplicate values for fields.

      4. Optionally, expand JSON view to see your advanced event selectors as a JSON block.

   4. Choose Enable Insights events capture to enable Insights. To enable Insights, you need to set up a destination event data store to collect Insights events based upon the management event activity in this event data store.

      If you choose to enable Insights, do the following.

      1. Choose the destination event store that will log Insights events. The destination event data store will collect Insights events based upon the management event activity in this event data store. For information about how to create the destination event data store, see To create a destination event data store that logs Insights events.

      2. Choose the Insights types. You can choose API call rate, API error rate, or both. You must be logging Write management events to log Insights events for API call rate. You must be logging Read or Write management events to log Insights events for API error rate.

4. Choose Save changes when you are finished.