aws-vpclattice-access-log-destination
Lattice access logs can retain request paths, query strings, and identity context that may include misplaced tokens.
Where it sits
| location | CloudWatch Logs/S3/Firehose VPC Lattice access log record |
|---|
| location kind | log_field |
|---|
| data kinds | credential api_key bearer_token session_token pii sensitive_data |
|---|
| emits edge | ContainsSecret |
|---|
| service | VPC Lattice (aws:vpclattice) |
|---|
Collection recipe
| access mode | indirect_destination |
|---|
| operation | logs:FilterLogEvents or s3:GetObject |
|---|
| response path | log record |
|---|
| encoding | string |
|---|
| params | {"Destination": "\u003clog-destination\u003e", "ResourceIdentifier": "\u003cservice-network-or-service-arn\u003e"} |
|---|
Required permissions
vpc-lattice:GetAccessLogSubscription
logs:FilterLogEvents
References