Selectively log network activity events by identity in AWS CloudTrail

AWS launches enhanced event filtering for CloudTrail network activity events, allowing customers to control logging based on IAM user identity making API calls.

• Filter network activity events by IAM user identity to log only relevant security scenarios
• Configure selectors to capture unauthorized access attempts while excluding routine traffic from trusted identities
• Combine UserIdentity conditions with eventName or vpcEndpointId for fine-grained control
• Reduce logging costs and noise by focusing on VpceAccessDenied events from untrusted identities
• Available via AWS Management Console, CLI, and SDKs in all supported regions

This feature enables data perimeter strategies by selectively logging VPC endpoint access based on user identity, helping detect potential data exfiltration attempts without logging every successful API call.