Email from AWS
"""
Beginning November 22, 2021, AWS CloudTrail will change the behavior of global service events[1] in CloudTrail's Lookup service. If you are using CloudTrail's Lookup service, you may no longer receive global service events outside of us-east-1.
Currently, for most services, events are recorded in the region where the action occurred with the exception of four services that are considered to be global services in CloudTrail: Amazon CloudFront, AWS Identity and Access Management (IAM), AWS Management Console SignIn, and AWS Security Token Service (STS). After the change, CloudTrail's Lookup service within each region will only show global service events in us-east-1, as CloudFront, IAM, SignIn, and STS events occur in that region.
In the Commercial partition, customers can continue to view all global service events by directing their Lookup API calls to us-east-1 or changing their selection of region in the Console to us-east-1. This change will keep events created by CloudFront, IAM, SignIn, and STS in the region in which they were created, making CloudTrail's treatment of these services consistent with that of other AWS global services. Keep reading for more information about how to use CloudTrail Lookup after the change. Please reach out to AWS Support[2] if you have any questions.
FAQs
-
How do I change my CloudTrail Lookup API call to view global service events?
Customers will have to reference us-east-1 in their API calls as shown in the example below.
• Run the lookup-events command: “aws cloudtrail lookup-events --region us-east-1 --lookup-attributes AttributeKey=EventName, AttributeValue=ConsoleLogin EventSource=gseService". This command returns CloudTrail events for CloudFront, IAM, SignIn, and STS by calling the us-east-1 region where the events were processed.
-
How do I use CloudTrail Lookup in the Console to view global service events?
For CloudTrail Lookup in Console, customers will have to change the selection of region to us-east-1 to view CloudFront, IAM, SignIn, and STS events.
[1] https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-concepts.html#cloudtrail-concepts-global-service-events
[2] https://aws.amazon.com/support
"""
Email from AWS
"""
Beginning November 22, 2021, AWS CloudTrail will change the behavior of global service events[1] in CloudTrail's Lookup service. If you are using CloudTrail's Lookup service, you may no longer receive global service events outside of us-east-1.
Currently, for most services, events are recorded in the region where the action occurred with the exception of four services that are considered to be global services in CloudTrail: Amazon CloudFront, AWS Identity and Access Management (IAM), AWS Management Console SignIn, and AWS Security Token Service (STS). After the change, CloudTrail's Lookup service within each region will only show global service events in us-east-1, as CloudFront, IAM, SignIn, and STS events occur in that region.
In the Commercial partition, customers can continue to view all global service events by directing their Lookup API calls to us-east-1 or changing their selection of region in the Console to us-east-1. This change will keep events created by CloudFront, IAM, SignIn, and STS in the region in which they were created, making CloudTrail's treatment of these services consistent with that of other AWS global services. Keep reading for more information about how to use CloudTrail Lookup after the change. Please reach out to AWS Support[2] if you have any questions.
FAQs
How do I change my CloudTrail Lookup API call to view global service events?
Customers will have to reference us-east-1 in their API calls as shown in the example below.
• Run the lookup-events command: “aws cloudtrail lookup-events --region us-east-1 --lookup-attributes AttributeKey=EventName, AttributeValue=ConsoleLogin EventSource=gseService". This command returns CloudTrail events for CloudFront, IAM, SignIn, and STS by calling the us-east-1 region where the events were processed.
How do I use CloudTrail Lookup in the Console to view global service events?
For CloudTrail Lookup in Console, customers will have to change the selection of region to us-east-1 to view CloudFront, IAM, SignIn, and STS events.
[1] https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-concepts.html#cloudtrail-concepts-global-service-events
[2] https://aws.amazon.com/support
"""