AWS CloudTrail Enhances Network Activity Logging with Identity-Based Event Filtering

This update allows customers to selectively log network activity events by filtering API calls to VPC endpoints according to the calling user’s IAM identity. For instance, logging can be configured to capture only access denied events from users outside a trusted list, aiding targeted security monitoring.

This selective approach helps organizations implement data perimeter strategies more efficiently by focusing on potentially malicious or unauthorized network accesses while lowering logging costs and minimizing irrelevant logs. The feature integrates with existing event filters and is available across supported AWS Regions.