AWS CloudTrail Updates (Apps)

AWS is streamlining CloudTrail events for IAM Identity Center to retain only the essential fields needed for audit and incident response workflows. These changes improve user identification and integration with directories like Okta and Microsoft Active Directory, and do not impact CloudTrail events from other AWS services.

To support this update, Sumo Logic has revised several AWS apps and Cloud SIEM parsers. If you use CloudTrail data in saved searches, dashboards, or detection rules, you may need to reinstall affected apps or update custom content before AWS enforces the changes on July 14, 2025.

To learn more, see Important changes to CloudTrail events for AWS IAM Identity Center.

Impact following the AWS CloudTrail updates

AWS is updating CloudTrail events for IAM Identity Center, affecting how user identity data is structured. So, if you are using the updated fields in your Cloud SIEM content or across the Sumo Logic platform, you need to update any saved queries, dashboards, or detection rules to reflect these changes and ensure continued functionality.

Key actions required while updating the AWS CloudTrail include:

• Sumo Logic provided apps must be manually reinstalled to incorporate the updated event field mappings.
• Cloud SIEM parsers have auto-updated and require no customer intervention.

Action plan for Sumo Logic users

Step 1: Reinstall the relevant Sumo Logic apps

If you're using any of the following apps that consume CloudTrail data, you must reinstall them:

• Amazon CloudTrail – Cloud Security Monitoring and Analytics
• AWS CloudTrail
• CIS AWS Foundations Benchmark
• PCI Compliance for AWS CloudTrail
• Threat Intel for AWS
• Cloud Infrastructure Security for AWS

To reinstall any of the above apps, follow the steps below:

1. Navigate to the App Catalog.
2. Search for the relevant app.
3. Install to deploy updated content under a new folder.

info

These are Classic apps (V1), and reinstalling them will create a new folder in your Content Library with updated dashboards.

Step 2: Update the custom saved searches and dashboards

If you’ve created custom content based on CloudTrail fields, manual field updates as given below will be required to accommodate the new schema:

• Move the userName field from the userIdentity element to the additionalEventData element.
• Remove the principalId field from the schema.
• Move the userId, identityStoreArn, and credentialId fields to the userIdentity element.

For more information on field changes, see AWS Security Blog.

note

AWS plans to implement these enhancements on July 14, 2025.

Sumo Logic apps are backward-compatible, allowing you to update the apps ahead of time. For any custom content outside of Sumo Logic’s apps or parsers, ensure your changes are backward compatible and deploy updates before July 14, 2025.

FAQ

What happens if I don’t update my applications or searches?

Failure to update your apps, saved searches, or dashboards will result in user-related fields not being parsed correctly. Consequently, visualizations and panels relying on those fields will appear empty or display inaccurate data.