Suppressing recursive events with recursive logging

What is recursive logging?

When CloudTrail delivers log files to a trail's destination, those delivery operations can themselves be logged as events. Destinations include an Amazon S3 bucket or a CloudWatch Logs log group. For example, when CloudTrail delivers a log file to your Amazon S3 bucket, it performs a PutObject API call. If your trail is configured to log Amazon S3 data events, this delivery operation is recorded as an event, which is then delivered to your bucket, generating another event, and so on. These are called recursive events.

You can use the RecursiveLogging setting to suppress these events.

How recursive logging suppression works

When you set RecursiveLogging to false on a trail, CloudTrail suppresses recursive delivery events. CloudTrail filters out events where userIdentity.invokedBy is cloudtrail.amazonaws.com and the eventSource and eventName match one of the following:

• eventSource is s3.amazonaws.com and eventName is PutObject

• eventSource is logs.amazonaws.com and eventName is PutLogEvents

This setting only suppresses events where CloudTrail is the invoking service. All other events are delivered as expected.

Configuring recursive logging

You can configure the RecursiveLogging setting when you create or update a trail.

Disabling recursive logging (suppressing recursive events)

To suppress recursive events when creating a trail, use the --no-recursive-logging option:

aws cloudtrail create-trail \
    --name my-trail \
    --s3-bucket-name my-bucket \
    --no-recursive-logging

To suppress recursive events on an existing trail:

aws cloudtrail update-trail \
    --name my-trail \
    --no-recursive-logging

Re-enabling recursive logging

To re-enable recursive logging (deliver recursive events):

aws cloudtrail update-trail \
    --name my-trail \
    --recursive-logging

Default behavior

By default, RecursiveLogging is set to true on all trails. This means recursive delivery events are logged. If you do not explicitly set RecursiveLogging to false, your trail continues to receive all events, including those generated by CloudTrail delivery operations.