How do I use AWS CloudTrail to identify configuration changes made to my Transit Gateway?

Short description

To identify changes made to your transit gateway, filter AWS CloudTrail events by the ec2.amazonaws.com event source and transit gateway-specific event names. You can search CloudTrail Event History in the console, query events using the AWS CLI, or set up CloudWatch alarms for real-time notification of transit gateway changes.

Resolution

Identify the relevant CloudTrail event names

Transit gateway API calls are logged under the event source ec2.amazonaws.com. Filter on the following event names based on the type of change you're investigating:

Route changes:

• CreateTransitGatewayRoute
• DeleteTransitGatewayRoute
• ReplaceTransitGatewayRoute

Route table associations:

• AssociateTransitGatewayRouteTable
• DisassociateTransitGatewayRouteTable

Route propagation:

• EnableTransitGatewayRouteTablePropagation
• DisableTransitGatewayRouteTablePropagation

Attachment changes:

• CreateTransitGatewayVpcAttachment
• DeleteTransitGatewayVpcAttachment
• ModifyTransitGatewayVpcAttachment

Transit gateway modifications:

• ModifyTransitGateway
• DeleteTransitGateway

Search CloudTrail Event History in the console

1. Open the CloudTrail console.
2. In the navigation pane, choose Event history.
3. For the lookup filter, choose Event name.
4. Enter the event name you want to investigate (for example, DeleteTransitGatewayRoute).
5. Adjust the time range to cover the period when the issue started.
6. Expand an event to view:
   • userIdentity - the IAM principal that made the change
   • requestParameters - the transit gateway route table ID, destination CIDR, and attachment ID that were modified
   • eventTime - the exact timestamp of the change

Search CloudTrail events using the AWS CLI

To find route deletions in the last 24 hours, run the following command:

aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=DeleteTransitGatewayRoute \
  --start-time 2026-07-27T00:00:00Z \
  --end-time 2026-07-28T23:59:59Z \
  --query 'Events[*].{Time:EventTime,User:Username}' \
  --output table

Note: Replace the --start-time and --end-time values with your investigation window.

To find VPC attachment modifications, run:

aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=ModifyTransitGatewayVpcAttachment \
  --start-time 2026-07-21T00:00:00Z \
  --output json

Query historical events with Amazon Athena

CloudTrail Event History retains events for 90 days. For older events, query your CloudTrail trail's S3 bucket using Amazon Athena:

SELECT eventtime, useridentity.arn, eventname,
       json_extract_scalar(requestparameters, '$.transitGatewayRouteTableId') AS route_table,
       json_extract_scalar(requestparameters, '$.destinationCidrBlock') AS cidr,
       json_extract_scalar(requestparameters, '$.transitGatewayAttachmentId') AS attachment
FROM cloudtrail_logs
WHERE eventsource = 'ec2.amazonaws.com'
  AND eventname LIKE '%TransitGateway%'
  AND eventtime > '2026-07-01'
ORDER BY eventtime DESC;

Note: Replace cloudtrail_logs with the name of your Athena table and adjust the date filter.

Set up a CloudWatch alarm for transit gateway changes

To receive real-time alerts when transit gateway routes are modified, create a CloudWatch metric filter on your CloudTrail log group.

Note: This requires an existing CloudTrail trail configured to deliver management events to a CloudWatch Logs log group.

1. Run the following command to create the metric filter:

aws logs put-metric-filter \
  --log-group-name CloudTrail/ManagementEvents \
  --filter-name TGWRouteChanges \
  --filter-pattern '{ ($.eventSource = "ec2.amazonaws.com") && (($.eventName = "DeleteTransitGatewayRoute") || ($.eventName = "CreateTransitGatewayRoute") || ($.eventName = "DisableTransitGatewayRouteTablePropagation") || ($.eventName = "DisassociateTransitGatewayRouteTable")) }' \
  --metric-transformations metricName=TGWRouteChange,metricNamespace=NetworkAudit,metricValue=1

Note: Replace CloudTrail/ManagementEvents with the name of your CloudTrail log group.

2. Run the following command to create a CloudWatch alarm:

aws cloudwatch put-metric-alarm \
  --alarm-name TGW-Route-Change-Alert \
  --metric-name TGWRouteChange \
  --namespace NetworkAudit \
  --statistic Sum \
  --period 300 \
  --threshold 1 \
  --comparison-operator GreaterThanOrEqualToThreshold \
  --evaluation-periods 1 \
  --alarm-actions arn:aws:sns:us-east-1:123456789012:NetworkAlerts

Note: Replace the --alarm-actions value with your SNS topic ARN.

Correlate CloudTrail events with CloudWatch metrics

If you observe PacketDropCountNoRoute on a transit gateway attachment, correlate the timestamp of the first packet drop with CloudTrail events in the same time window. A more specific route added to the route table can take precedence over a less specific route and cause connectivity loss without any route being deleted.

Important: In the transit gateway route evaluation order, the most specific route (longest prefix match) is always preferred.

Related information

• Log Transit Gateway API calls using CloudTrail
• Transit Gateway CloudWatch metrics
• Creating CloudWatch alarms for CloudTrail events