Unable to Decode CloudTrail Encoded Authorization Message – Ends with “...” Is This the Complete Message?

When you see an encoded authorization message ending with "..." in CloudTrail logs, it typically means the message has been truncated. This is a common issue because CloudTrail has a maximum event size limit.

Here's how to handle this:

Don't use CloudTrail for retrieving encoded authorization messages. Instead, catch these messages in real-time when the API call fails.

errorMessage: This field has a maximum size of 1 KB; content exceeding that limit is truncated. For event data stores configured to have a maximum event size of 1 MB, the field content is only truncated if the event payload exceeds 1 MB and the maximum field size is exceeded.

Reference: https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-record-contents.html

Best practices:

1. Always capture and decode authorization messages at the time of the API failure.
2. Don't rely on CloudTrail logs for this purpose
3. Implement proper error handling for the STS decode operation

If you absolutely must analyze past events:

1. Look for the original API calls in your application logs
2. Consider implementing custom logging that captures the full encoded messages
3. Set up CloudWatch Logs to capture the complete error messages

Remember that authorization failure messages are most useful when handled in real-time as part of your application's error handling flow.