Partial CloudTrail logging in AWS Control Tower

AWS Control Tower was not properly logging to CloudTrail when API calls
failed due to a lack of permissions. This could have helped an adversary
with existing access to a victim AWS environment avoid detection while
enumerating privileges, since any unsuccessful API calls would not
generate "access denied" log entries.

access access denied adversary api aws cloudtrail control detection environment log logging logging in partial permissions privileges victim