AWS – AWS CloudTrail Adds Logging of Data Events for Amazon DynamoDB

AWS CloudTrail now supports logging of data events for Amazon DynamoDB. With this new feature, you can now use CloudTrail to log item-level DynamoDB activity from all your DynamoDB tables or specific tables with read-only and write-only filters. You can also use CloudTrail
advanced event selectors for more granular control of which data events you want to log from DynamoDB. All DynamoDB data events are delivered to an Amazon S3 bucket and Amazon CloudWatch Events, which creates an audit log of data access and allows you to respond to events recorded by CloudTrail. Details on when and who made DynamoDB API calls enhances data visibility for security and operations engineering teams. For example, you can quickly determine which DynamoDB items were created, read, updated or deleted and identify the source of the API calls. If you detect unauthorized DynamoDB activity, you can also take immediate action to restrict access.

Read More for the details.