AWS is streamlining CloudTrail events for IAM Identity Center to retain only the essential fields needed for audit and incident response workflows. These changes improve user identification and integration with directories like Okta and Microsoft Active Directory, and do not impact CloudTrail events from other AWS services.
- To support this AWS update, Sumo Logic has revised several AWS apps and Cloud SIEM parsers. You are requested to reinstall the affected apps.
- If you use CloudTrail data in the saved searches, dashboards, or detection rules, you are required to update your custom content before AWS enforces the changes on July 14, 2025.
To learn more, see Important changes to CloudTrail events for AWS IAM Identity Center.
Impact following the AWS CloudTrail updates
AWS is updating CloudTrail events for IAM Identity Center, affecting how user identity data is structured. So, if you are using the updated fields in your Cloud SIEM content or across the Sumo Logic platform, you need to update any saved queries, dashboards, or detection rules to reflect these changes and ensure continued functionality.
Key actions required while updating the AWS CloudTrail include:
- Sumo Logic provided apps must be manually reinstalled to incorporate the updated event field mappings.
- Cloud SIEM parsers have auto-updated and require no customer intervention.
Action plan for Sumo Logic users
Step 1: Reinstall the relevant Sumo Logic apps
If you're using any of the following apps that consume CloudTrail data, you must reinstall them:
To reinstall any of the above apps, follow the steps below:
- Navigate to the App Catalog.
- Search for the relevant app.
- Install to deploy updated content under a new folder.
These are Classic apps (V1), and reinstalling them will create a new folder in your Content Library with updated dashboards.
Step 2: Update the custom saved searches and dashboards
If you’ve created custom content based on CloudTrail fields, manual field updates as given below will be required to accommodate the new schema:
- Move the
userName field from the userIdentity element to the additionalEventData element.
- Remove the
principalId field from the schema.
- Move the
userId, identityStoreArn, and credentialId fields to the userIdentity element.
For more information on field changes, see AWS Security Blog.
AWS plans to implement these enhancements on July 14, 2025.
Sumo Logic apps are backward-compatible, allowing you to update the apps ahead of time. For any custom content outside of Sumo Logic’s apps or parsers, ensure your changes are backward compatible and deploy updates before July 14, 2025.
FAQ
What happens if I don’t update my applications or searches?
Failure to update your apps, saved searches, or dashboards will result in user-related fields not being parsed correctly. Consequently, visualizations and panels relying on those fields will appear empty or display inaccurate data.
