Why Are CloudTrail Logs Missing When Exporting Visualizations with Mixed File-based and Database Data Sources?

Q&A
, ,
1

Hello everyone,

I’m investigating a CloudTrail logging behavior in QuickSight and would appreciate any insights from the community.

Background

I’m working on implementing a security audit capability to track and monitor data export activities in QuickSight. During my investigation, I’ve identified the following CloudTrail logging behavior:

Current Understanding:

  • File-based data source exports: No API calls are made → No CloudTrail logs generated

  • Database data source exports: API calls are made → CloudTrail logs generated (visible in CloudTrail with eventName: “QueryDatabase” and queryIntent: “EXPORT_TO_CSV” or “EXPORT_TO_EXCEL”)

Unexpected Behavior: When exporting a visualization (dashboard/analysis) that combines both file-based and database data sources, I expected API calls to be made for the database data source portion, which should generate CloudTrail logs. However, no CloudTrail logs are generated at all in this scenario.

Questions

  1. What is the underlying mechanism that prevents CloudTrail log generation when exporting visualizations that combine both file-based and database data sources? Why doesn’t the database portion trigger API calls as it would in a standalone database export?

  2. Can anyone explain the behavior for both scenarios:

    • Direct Query datasets: When file-based data sources are combined with database data sources

    • SPICE datasets: When file-based data sources are combined with database data sources

    Understanding both cases would help establish complete guidelines for security audit capabilities.

  3. Is there any workaround available to accurately track and monitor data export activities for information security purposes in this situation?

Any guidance or insights would be greatly appreciated. Thank you!

2

Hi @suny,

Welcome to the Quick Community! That is definitely some interesting behavior, and am curious as well if this is intended behavior or some error when it comes to combining the two. I would definitely recommend creating a support ticket with AWS Support, as they will be able to better confirm this behavior and potentially help you find a solution for your use case.

Thank you!

3

Hi @suny,

Just checking back in since we haven’t heard from you in a bit. I wanted to see if the guidance shared earlier helped resolve your question, or if you found a solution in the meantime.

If you still have any additional questions related to your initial post, feel free to share them. Otherwise, any update you’re able to provide within the next 3 business days would be helpful for the community.

Thank you

4

Hi @suny ,

Since I haven’t received any further updates from you, I’ll treat this inquiry as complete for now. If you have any additional questions, feel free to create a new post in the community and link this discussion for context.

Thank you