CloudTrail Logging Evasion: Where Policy Size Matters

Permiso Security discovered and disclosed an AWS CloudTrail logging evasion vulnerability where IAM policies expanded with excessive whitespace (roughly 102,401–131,072 characters) are successfully created but their content is omitted from CloudTrail requestParameters, producing an audit blind spot; the report includes technical reproduction steps, impact analysis, a disclosure timeline with AWS, and recommendations to monitor for 'requestParameters too large' omissions until AWS implements a fix.