Monitoring attested requests - AWS Key Management Service
Services or capabilities described in AWS documentation might vary by Region. To see the differences applicable to the AWS European Sovereign Cloud Region, see the AWS European Sovereign Cloud User Guide.

Monitoring attested requests

You can use your AWS CloudTrail logs to monitor Decrypt, DeriveSharedSecret, GenerateDataKey, GenerateDataKeyPair, and GenerateRandom operations that use attestation. In these log entries, the additionalEventData field has a recipient field with information from the attestation document in the request. These fields are included only when the Recipient parameter in the request specifies a signed attestation document.

The specific information included in the CloudTrail log depends on the attestation method used.