Routing is automatic for accounts. Root sign-in events may therefore appear in CloudTrail in any of the three regions, rather than only one expected location. Monitoring configurations need to account for the expanded event locations.
Go to the source
Source announcement: . This is an original summary, not independent on-the-ground reporting.