Correction: Review Mode Set 1 – Question #12

[Roamer2025]

AWS KMS actions such as Encrypt, Decrypt, and GenerateDataKey typically generate a large volume (more than 99%) of events. These actions are logged as Read events, like low-volume AWS KMS actions such as Disable, Delete, and ScheduleKey (which typically account for less than 0.5% of AWS KMS event volume).

->

AWS KMS actions such as Encrypt, Decrypt, and GenerateDataKey typically generate a large volume (more than 99%) of events. These actions are now logged as Read events. Low-volume, relevant AWS KMS actions such as Disable, Delete, and ScheduleKey (which typically account for less than 0.5% of AWS KMS event volume) are logged as Write events.

References:

https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-management-events-with-cloudtrail.html#read-write-events-mgmt

[Carlo-TutorialsDojo]

Hello Roamer2025,

We appreciate your effort in pointing this out.

We will update our explanation to reflect this update.

Please let us know if you need further clarification.

Thank you and regards,

Carlo @ Tutorials Dojo