- Added IAM user‑identity filtering for CloudTrail VPC endpoint network activity events
- Allows selectors to log only specific events (e.g., VpceAccessDenied) for identities outside a trusted list, cutting noise and logging costs
- Configurable via Console, CLI, SDK and can be combined with existing eventName or vpcEndpointId filters