Customers can define enablement rules to automatically collect and send telemetry from existing and new resources, scoped by organization, account, or resource tags. This ensures consistent log ingestion for CloudFront standard logs, Security Hub CSPM findings, and Amazon Bedrock AgentCore telemetry.
The new auto-enablement applies across all AWS commercial regions and supports organization-wide rules for CloudFront and Security Hub logs. Log ingestion incurs standard CloudWatch pricing. This feature simplifies centralized monitoring and security compliance efforts for large, dynamic AWS environments.
Source & further reading
Amazon CloudWatch expands auto-enablement to Amazon CloudFront logs and 3 additional resource types ↗Source published 2026-04-02. This report was prepared with AI assistance from the linked primary-source material. Claims and limitations should be checked against the original announcement or research.