Update CloudTrail validate-logs for full key query range (#10072)

IanLeeYT · Ian Lee · web-flow · commit 084f934efcea · 2026-02-20T13:26:25.000-05:00
Co-authored-by: Ian Lee &lt;ianleeyt@amazon.com&gt;
diff --git a/.changes/next-release/bugfix-cloudtrail-2781.json b/.changes/next-release/bugfix-cloudtrail-2781.json
@@ -0,0 +1,5 @@
+{
+  "type": "bugfix",
+  "category": "cloudtrail",
+  "description": "Fixed edge case in validate-logs where digest validation could fail with \"public key not found\" when the end time lands near a key rotation boundary"
+}
diff --git a/awscli/customizations/cloudtrail/validation.py b/awscli/customizations/cloudtrail/validation.py
@@ -585,7 +585,11 @@ def traverse_digests(self, start_date, end_date=None, is_backfill=False):
 
         # For regular digests, pre-load public keys. For backfill, start with empty dict
         public_keys = (
-            {} if is_backfill else self._load_public_keys(start_date, end_date)
+            {}
+            if is_backfill
+            else self._load_public_keys(
+                start_date, end_date + timedelta(hours=2)
+            )
         )
 
         yield from self._traverse_digest_chain(
diff --git a/tests/unit/customizations/cloudtrail/test_validation.py b/tests/unit/customizations/cloudtrail/test_validation.py
@@ -994,7 +994,9 @@ def test_ensures_public_keys_are_loaded(self):
         digest_iter = traverser.traverse_digests(start_date, end_date)
         with self.assertRaises(RuntimeError):
             next(digest_iter)
-        key_provider.get_public_keys.assert_called_with(start_date, end_date)
+        key_provider.get_public_keys.assert_called_with(
+            start_date, end_date + timedelta(hours=2)
+        )
 
     def test_ensures_public_key_is_found(self):
         start_date = START_DATE
