Selectively log network activity events by identity in AWS CloudTrail
AWS CloudTrail now allows selective logging of network activity events for VPC endpoints based on the IAM user identity making the API call, enabling customers to capture unauthorized access attempts while excluding routine traffic from trusted identities.
AWS has launched enhanced event filtering for network activity events for VPC endpoints, a CloudTrail event type that captures actions transmitted through a Virtual Private Cloud Endpoint. Customers can now control which network activity events are logged based on the IAM user identity making the API call. For example, you can configure selectors to log only access denied events when the calling user identity is not on a known safe list. This allows you to capture unauthorized access attempts while excluding routine traffic from trusted identities, reducing both logging costs and noise. With UserIdentity filtering, customers building a data perimeter strategy can focus on network activity event logging for scenarios that matter most in security. You can configure selectors to log only VpceAccessDenied events from identities outside a trusted set of IAM roles. This enables detection of potential data exfiltration attempts through VPC endpoints without the cost of logging every successful API call from approved principals. You can combine UserIdentity conditions with existing fields like eventName or vpcEndpointId for fine-grained control over what gets recorded. You can use this feature via the AWS Management Console, AWS Command Line Interface, and AWS SDKs. This feature is available in all AWS Regions where CloudTrail network activity events are supported.