Network activity events record AWS API actions made using VPC endpoints from a private VPC to the AWS service and help you meet your network security investigations use cases. This includes AWS API calls that have successfully passed the VPC endpoint policy and those that were denied access. Unlike management and data events that are delivered to both the API caller and the owner of the resource, network activity events are only delivered to the owner of the VPC endpoint. To record network activity events, you must explicitly enable them when configuring your trail or event data store and choose event source(s) of the AWS service(s) you want to collect activity on. You may also add additional filters such as filtering by VPC endpoint ID or logging only the Access Denied errors. Network activity events incur additional charges. For more information, see CloudTrail pricing.