CloudTrail's New Filter Logs Only the Suspicious Access, Not Everything

Hi, it's Shiichan! Today's story should make security folks pretty happy — a precision upgrade for AWS CloudTrail logging.

AWS What's New aws.amazon.com

What was announced?

This is from AWS What's New. CloudTrail's network activity events, which capture actions made through a VPC endpoint, now support more granular event filtering. You can control which events get logged based on the IAM user identity making the API call.

The story so far

VPC endpoint activity could already be logged, but there wasn't a way to separate routine access from trusted identities out of suspicious access attempts — everything got logged together. That drove up both log volume and cost, and buried the signal you actually cared about in noise.

What changes

With the new UserIdentity filtering, you can build selectors like "only log access-denied events when the caller isn't on a known trusted list." That way routine traffic from trusted identities gets excluded from logging while unauthorized access attempts still get captured, cutting both cost and noise.

• You can configure selectors to log only VpceAccessDenied events from identities outside a trusted set of IAM roles
• UserIdentity conditions can be combined with existing fields like eventName or vpcEndpointId for fine-grained control
• Useful for teams building a data perimeter strategy who want logging focused on the scenarios that actually matter

Wrap-up

• CloudTrail network activity events now support filtering by the calling IAM user identity
• Routine traffic from trusted identities can be excluded while suspicious access attempts still get logged
• Combine UserIdentity conditions with fields like eventName and vpcEndpointId for precise selectors
• Configurable via the AWS Console, CLI, or SDKs, available in all supported Regions

If you're working on a data perimeter strategy or trying to cut down log costs and noise, this update is for you.