AWS CloudTrail adds UserIdentity filtering for VPC endpoint events

Tue, 21 Jul 2026 12:20:39 +0000

Platform/SRE — Plan: This GA feature lets you reduce CloudTrail network activity event volume and cost by scoping logging to untrusted or access-denied identities on VPC endpoints — a concrete improvement for data perimeter monitoring. Update your CloudTrail advanced event selectors this quarter to filter trusted IAM roles and cut noise on VpceAccessDenied events.
CI/CD — Skip
Leader — Learn: This feature enables selective CloudTrail logging that can meaningfully reduce ingestion costs for high-volume VPC endpoint environments, relevant for FinOps conversations around AWS audit logging spend — no strategic decision required now.

Aws-Cloudtrail on CuraDevOps