CloudTrail Event Coverage Shows Your Data Event Logging Gaps at a Glance!

Hi, it's Shii-chan!

AWS What's New aws.amazon.com

This makes blind spots in security monitoring easier to find!

What was announced?

According to AWS What's New, AWS CloudTrail introduces Event Coverage, a new console experience.

It gives you visibility into your data plane operations coverage at the account and organization level.

Why it matters

Data events track data plane operations in AWS services. For example, logging Amazon S3 object-level operations like GetObject and PutObject helps detect unauthorized data access or exfiltration attempts.

Without comprehensive data events coverage, these activities can go unnoticed, leaving blind spots in your security monitoring.

What changes

• You can see which AWS services and resource types have data event logging enabled and which don't
• You can quickly identify gaps in your logging posture without manually scanning accounts in your organization
• You can view coverage across all supported data event sources in one place

Dive Deep

• You can subscribe to data events directly from the dashboard, which makes it easier to close coverage gaps in a few clicks, especially across multiple accounts
• You access Event Coverage from the AWS CloudTrail console
• Available in all commercial AWS Regions where CloudTrail is supported

See the CloudTrail documentation for more on logging data events.

Wrap-up

• CloudTrail adds Event Coverage
• See data event logging coverage at the account and organization level
• Subscribe directly from the dashboard to close gaps

This is for security teams managing logging settings across many accounts!