Uncover blind spots in AWS data plane operations with CloudTrail Event Coverage

AWS CloudTrail has launched Event Coverage, a console feature that provides visibility into which AWS services and resource types have data event logging enabled. The tool highlights gaps in logging coverage at both account and organization levels, eliminating the need for manual audits. Users can access the feature directly from the AWS CloudTrail console, streamlining oversight of logging posture. This capability is now available in all commercial AWS Regions where CloudTrail is supported.

Event Coverage addresses a longstanding challenge for customers managing multi-account environments by centralizing logging oversight. Previously, identifying missing data event logs required time-consuming manual checks across individual accounts. The new feature automates this process, presenting a clear view of logging status for all supported services and resource types. This reduces operational overhead while improving compliance and security monitoring.

The feature specifically targets data events, which record API calls that modify resources such as object-level S3 operations or Lambda function invocations. By surfacing which data events are logged—and which are not—customers can prioritize enabling logging for critical services. This granular visibility helps organizations align their logging strategies with risk management and audit requirements.

AWS CloudTrail documentation provides guidance on configuring data event logging for supported services. Customers can use Event Coverage to validate their logging posture and address gaps proactively. The feature is designed to integrate seamlessly with existing CloudTrail workflows, offering a unified approach to monitoring data plane operations.