IMPORTANT CHANGES TO CLOUDTRAIL EVENTS FOR IAM IDENTITY CENTER

Summary from the TLDR InfoSec newsletter

AWS IAM Identity Center is streamlining its CloudTrail events to simplify user identification in CloudTrail and enhance the correlation between IAM Identity Center users and external directory services like Okta or Microsoft Active Directory. Specifically, IAM Identity Center will replace userName and principalID fields under the user identity element in CloudTrail events with the user ID and Identity Store ARN when a user signs into the console or accesses the AWS CLI. IAM Identity Center will also be omitting the value of a group's display name in CloudTrail events when a group is created or updated. Specific examples and transition guidance are provided in the blog post.