Skip to main content

Network Activity Events

Network activity events provide visibility into VPC endpoint network activity in your AWS accounts. These events capture network-level actions that flow through VPC endpoints, letting you monitor which AWS services are being accessed from within your VPCs.

What Are Network Activity Events?​

Network activity events record API activity that passes through VPC endpoints (AWS PrivateLink). While management events and data events capture API calls at the service level, network activity events capture the network-level perspective of those calls as they traverse your VPC endpoints.

This is particularly useful for:

  • Network security monitoring -- Identify which AWS services are being accessed from your VPCs
  • VPC endpoint auditing -- Verify that VPC endpoints are being used as intended
  • Compliance -- Demonstrate that traffic to AWS services stays within your private network
  • Anomaly detection -- Identify unexpected service access patterns through VPC endpoints

Configuring Network Activity Selectors​

Network activity events are configured through selectors, where each selector specifies an AWS service event source to monitor.

Adding a Selector​

In the Event Configuration step or Edit Trail page:

  1. Click Add Network Activity Selector
  2. Enter or select an Event Source from the autocomplete dropdown
  3. Repeat to add additional selectors for other AWS services

Event Source Field​

PropertyValue
TypeAutocomplete with custom input
RequiredYes
FormatAWS service endpoint (e.g., ec2.amazonaws.com)

The event source identifies the AWS service whose VPC endpoint network activity you want to capture.

Suggested Event Sources​

The autocomplete provides suggestions for the following AWS service endpoints:

Event SourceAWS Service
aco-automation.amazonaws.comAWS ACO Automation
appconfig.amazonaws.comAWS AppConfig
application-signals.amazonaws.comAmazon CloudWatch Application Signals
appmesh.amazonaws.comAWS App Mesh
athena.amazonaws.comAmazon Athena
b2bi.amazonaws.comAWS B2B Data Interchange
backup-gateway.amazonaws.comAWS Backup Gateway
bcm-data-exports.amazonaws.comAWS Billing and Cost Management Data Exports
bcm-pricing-calculator.amazonaws.comAWS Pricing Calculator
bedrock.amazonaws.comAmazon Bedrock
billing.amazonaws.comAWS Billing
cassandra.amazonaws.comAmazon Keyspaces (for Apache Cassandra)
ce.amazonaws.comAWS Cost Explorer
cloudcontrolapi.amazonaws.comAWS Cloud Control API
cloudformation.amazonaws.comAWS CloudFormation
cloudhsm.amazonaws.comAWS CloudHSM
cloudtrail.amazonaws.comAWS CloudTrail
codedeploy.amazonaws.comAWS CodeDeploy
comprehend.amazonaws.comAmazon Comprehend
comprehendmedical.amazonaws.comAmazon Comprehend Medical
config.amazonaws.comAWS Config
ds.amazonaws.comAWS Directory Service
dynamodb.amazonaws.comAmazon DynamoDB
ec2.amazonaws.comAmazon EC2
ecs.amazonaws.comAmazon ECS
elasticfilesystem.amazonaws.comAmazon EFS
elasticloadbalancing.amazonaws.comElastic Load Balancing
events.amazonaws.comAmazon EventBridge
firehose.amazonaws.comAmazon Data Firehose
frauddetector.amazonaws.comAmazon Fraud Detector
freetier.amazonaws.comAWS Free Tier
fsx.amazonaws.comAmazon FSx
glue.amazonaws.comAWS Glue
healthlake.amazonaws.comAmazon HealthLake
invoicing.amazonaws.comAWS Invoicing
iot.amazonaws.comAWS IoT Core
iotfleetwise.amazonaws.comAWS IoT FleetWise
iotsecuredtunneling.amazonaws.comAWS IoT Secure Tunneling
kms.amazonaws.comAWS Key Management Service
lakeformation.amazonaws.comAWS Lake Formation
lambda.amazonaws.comAWS Lambda
license-manager.amazonaws.comAWS License Manager
lookoutequipment.amazonaws.comAmazon Lookout for Equipment
lookoutvision.amazonaws.comAmazon Lookout for Vision
monitoring.amazonaws.comAmazon CloudWatch
personalize.amazonaws.comAmazon Personalize
qbusiness.amazonaws.comAmazon Q Business
rds.amazonaws.comAmazon RDS
rekognition.amazonaws.comAmazon Rekognition
rolesanywhere.amazonaws.comAWS IAM Roles Anywhere
s3.amazonaws.comAmazon S3
sagemaker.amazonaws.comAmazon SageMaker
scheduler.amazonaws.comAmazon EventBridge Scheduler
secretsmanager.amazonaws.comAWS Secrets Manager
servicediscovery.amazonaws.comAWS Cloud Map
sns.amazonaws.comAmazon SNS
sqs.amazonaws.comAmazon SQS
ssm-contacts.amazonaws.comAWS Systems Manager Incident Manager Contacts
ssm.amazonaws.comAWS Systems Manager
storagegateway.amazonaws.comAWS Storage Gateway
swf.amazonaws.comAmazon SWF
textract.amazonaws.comAmazon Textract
transcribe.amazonaws.comAmazon Transcribe
transcribestreaming.amazonaws.comAmazon Transcribe Streaming
transform.amazonaws.comAWS Glue DataBrew
translate.amazonaws.comAmazon Translate
user-subscriptions.amazonaws.comAWS User Subscriptions
verifiedpermissions.amazonaws.comAmazon Verified Permissions
voiceid.amazonaws.comAmazon Connect Voice ID
workmail.amazonaws.comAmazon WorkMail
workmailmessageflow.amazonaws.comAmazon WorkMail Message Flow

Multiple Selectors​

You can add multiple network activity selectors to monitor different AWS services simultaneously. Each selector operates independently.

To remove a selector, click the remove button on the selector.

Use Cases​

Security Monitoring​

Monitor critical services for unauthorized access patterns:

  • sts.amazonaws.com -- Track credential-related activity
  • secretsmanager.amazonaws.com -- Monitor secrets access
  • kms.amazonaws.com -- Track encryption key usage

Application Auditing​

Monitor services used by your applications to verify expected access patterns:

  • s3.amazonaws.com -- S3 data access through VPC endpoints
  • dynamodb.amazonaws.com -- Database operations
  • lambda.amazonaws.com -- Function invocations
  • sqs.amazonaws.com -- Message queue access

Compliance​

Demonstrate that specific services are accessed only through private network paths:

  • rds.amazonaws.com -- Database connections stay within VPC
  • ecr.amazonaws.com -- Container image pulls are private
  • elasticfilesystem.amazonaws.com -- File system access is private

Configuration in Prism​

You configure network activity events in two places:

Best Practices​

  1. Start with critical services -- Focus on services that handle sensitive data or are critical to your security posture
  2. Monitor identity services -- sts.amazonaws.com and secretsmanager.amazonaws.com are high-value targets for security monitoring
  3. Align with VPC endpoint usage -- Only monitor event sources for which you have VPC endpoints configured
  4. Review periodically -- As your VPC endpoint usage evolves, update your network activity selectors to match
  5. Combine with management events -- Network activity events complement management events for a complete view of API activity