ReleaseBytes
aws AWS What's New ·

AWS Organizations adds CloudTrail events for account membership changes

securitygovernanceinfraawsengineer
feature

AWS Organizations now automatically emits CloudTrail events for accounts joining or leaving the organization. These new events, AccountJoinedOrganization and AccountDepartedOrganization, enhance visibility for security teams and administrators, aiding in the detection of unauthorized activities. The events provide details on how accounts joined or departed, along with timestamps, enabling real-time notifications and supporting use cases like fraud detection and security monitoring.

  • →CloudTrail events for account membership changes in AWS Organizations
  • →Detailed event information for account joining and departure
  • →Enable real-time notifications and automated responses
Features (1) ›
  • CloudTrail events for account membership changes in AWS Organizations

    AWS Organizations now emits CloudTrail events for accounts joining or leaving the organization. These events, AccountJoinedOrganization and AccountDepartedOrganization, provide enhanced visibility into membership changes.

Enhancements (2) ›
  • Detailed event information for account joining and departure

    The AccountJoinedOrganization event captures how an account joined (Created or Invited) and the join timestamp. The AccountDepartedOrganization event records how an account departed (Left, Removed, or Cleaned) and the departure timestamp.

  • Enable real-time notifications and automated responses

    Users can leverage these events to create CloudWatch alarms or EventBridge rules for real-time notifications. This enables rapid response to suspicious organizational changes, supporting security monitoring and incident investigation.

Read the original announcement →

https://aws.amazon.com/about-aws/whats-new/2026/05/aws-organizations-cloudtrail/

Related releases