Use CloudTrail network activity events for supported VPC-endpoint API evidence

Investigate endpoint-mediated API activity using the event category designed for it.

Source facts

CloudTrail network activity events let VPC endpoint owners record supported AWS API calls through their endpoints. AWS publishes the supported services and advanced event-selector fields. This category describes endpoint API activity rather than a packet capture or a general record of all IP flows through the VPC.

Source: AWS Documentation.

Applicability

This applies to supported VPC endpoint services and CloudTrail network activity event selection.

DSE recommendation

DSE recommends identifying the endpoint owner, service and investigation goal before enabling collection. Check current support for the particular service and select the relevant endpoint and operation criteria. Coordinate with the security and network teams so endpoint-policy failures can be correlated with the application request. Keep packet-flow evidence separate where that is also needed. Document event retention, access and cost review before broadening selectors to additional endpoints or accounts. Start with one endpoint and a concrete API investigation question. Name the evidence owner for a request originating in another account, and require a separate explanation when the relevant service or operation is outside the supported collection scope.

Verification

Proposed verification: perform an authorized test API request through the selected endpoint and inspect its resulting event fields. Compare the selected service and endpoint with the current support reference. Record any unmatched case explicitly rather than interpreting the absence of this event type as proof that no network traffic occurred.

Official reference

AWS Documentation. Reviewed October 20, 2026.