View a markdown version of this page

Monitor your project - Amazon Account Management
Monitor your project using Amazon CloudTrailUse CloudTrail to see who modified your project
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Monitor your project

Warning

We're currently releasing our new experience to a limited number of customers. You might not be able to access this experience yet.

Monitor your project using Amazon CloudTrail

Your project is integrated with Amazon CloudTrail, a service that provides a record of actions taken by a team member or Amazon service. CloudTrail captures all API calls for your project as events. The calls captured include calls from the console and API operations for all supported Amazon services. Using the information collected by CloudTrail, you can determine the request that was made to your project, the person who made the request, when it was made, and additional details.

Use CloudTrail to see who modified your project

This tutorial is for users that are comfortable with the Amazon CLI. If you share your project with multiple team members, you can use CloudTrail to view who modified any resources in your project. Every action taken by you or team members when they use Amazon Settings or the Amazon Web Services Management Console to access your project is logged by the onBehalfOf parameter. This parameter shows a user ID and an identity store ID. Together, these values define a builder ID that you've invited to access your project.

To find the onBehalfOf parameter and connect it to a team member, you'll need access to the Amazon CLI and the Amazon Web Services Management Console. If you don't have the Amazon CLI configured, you can use Amazon CloudShell to access a browser-based, pre-authenticated shell that you can launch directly from the Amazon Web Services Management Console and run Amazon CLI commands.

Step 1. To find an Amazon CloudTrail Event

  1. Sign in to the Amazon Web Services Management Console and open the CloudTrail console at https://console.aws.amazon.com/cloudtrail/.

  2. In the navigation pane, choose Event history. You see a filtered list of events, with the most recent events showing first. Choose an event.

  3. In the event record, you'll see the following content:

    "onBehalfOf": {
            "userId": "00000-e00f-000-000-0000000",
            "identityStoreArn": "arn:aws:identitystore::111122223333:identitystore/000000-0000-0000-0000-60000007"
}

    This is the identity that defines the team member who created the CloudTrail event.

Step 2. To connect the onBehalfOf parameter to a team member

To connect the onBehalfOf parameter to a team member using the Amazon CLI:

To use the Amazon CLI in your terminal

  1. Run the following command to sign in to the Amazon CLI. You can find your Region using Amazon Web Services Regions for your projects.

    aws login --region project-region

  2. Run the following command to get the ID for your identity store. The CloudTrail event shows the identity store ARN, but does not indicate the identity store ID. You always use the Amazon Web Services Region us-east-1 when finding the ID for your identity store.

    aws sso-admin list-instances --region us-east-1

    The output will look like the following:

    {
    "Instances": [
        {
            "InstanceArn": "arn:aws:sso:::instance/ssoins-0000000000",
            "IdentityStoreId": "d-000000",
            "OwnerAccountId": "111122223333",
            "CreatedDate": "2025-10-26T23:10:58.529000+00:00",
            "Status": "ACTIVE",
            "PrimaryRegion": "us-east-1",
            "Regions": [
                {
                    "RegionName": "us-east-1",
                    "Status": "ACTIVE",
                    "AddedDate": "2025-10-26T23:10:58.529000+00:00",
                    "IsPrimaryRegion": true
                }
            ]
        }
    ]
}

    You want to copy the identity store ID. In this case, the identity store ID is d-000000.

  3. Run the following command to describe the team member who corresponds to the onBehalfOf parameter.

    aws identitystore describe-user --user-id 00000-e00f-000-000-0000000 --region us-east-1 --identity-store-id d-000000

    The output will look like the following:

    {
    "IdentityStoreId": "d-000000",
    "UserId": "00000-e00f-000-000-0000000",
    "UserName": "carlos_salazar",
    "Name": {
        "FamilyName": "Salazar",
        "GivenName": "Carlos"
    },
    "DisplayName": "Carlos",
    "Emails": [
        {
            "Value": "carlos_salazar@example.com",
            "Type": "work",
            "Primary": true
        }
    ],
    "UserStatus": "ENABLED",
    "CreatedAt": "2025-10-26T23:15:27.213000+00:00",
    "CreatedBy": "00000000000",
    "UpdatedAt": "2025-10-26T23:18:55.432000+00:00",
    "UpdatedBy": "0000000000"
}

    Your team member's display name and emails are provided in this output.

To connect the onBehalfOf parameter to a team member using Amazon CloudShell, log into the Amazon Web Services Management Console and access CloudShell. For more information, see Getting started with Amazon CloudShell. You will automatically have the correct IAM permissions to access CloudShell.