CloudTrail Record Contents - AWS CloudTrail
AWS services or capabilities described in AWS documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with AWS services in China.

CloudTrail Record Contents

The body of the record contains fields that help you determine the requested action as well as when and where the request was made. When the value of Optional is True, the field is only present when it applies to the service, API, or event type.

eventTime

The date and time the request was made, in coordinated universal time (UTC).

Since: 1.0

Optional: False

eventVersion

The version of the log event format. The current version is 1.05.

Since: 1.0

Optional: False

userIdentity

Information about the user that made a request. For more information, see CloudTrail userIdentity Element.

Since: 1.0

Optional: False

eventSource

The service that the request was made to. This name is typically a short form of the service name without spaces plus .amazonaws.com. For example:

  • AWS CloudFormation is cloudformation.amazonaws.com.

  • Amazon EC2 is ec2.amazonaws.com.

  • Amazon Simple Workflow Service is swf.amazonaws.com.

This convention has some exceptions. For example, the eventSource for Amazon CloudWatch is monitoring.amazonaws.com.

Since: 1.0

Optional: False

eventName

The requested action, which is one of the actions in the API for that service.

Since: 1.0

Optional: False

awsRegion

The AWS region that the request was made to, such as us-east-2. See CloudTrail Supported Regions.

Since: 1.0

Optional: False

sourceIPAddress

The IP address that the request was made from. For actions that originate from the service console, the address reported is for the underlying customer resource, not the console web server. For services in AWS, only the DNS name is displayed.

Since: 1.0

Optional: False

userAgent

The agent through which the request was made, such as the AWS Management Console, an AWS service, the AWS SDKs or the AWS CLI. The following are example values:

  • signin.amazonaws.com – The request was made by an IAM user with the AWS Management Console.

  • console.amazonaws.com – The request was made by a root user with the AWS Management Console.

  • lambda.amazonaws.com – The request was made with AWS Lambda.

  • aws-sdk-java – The request was made with the AWS SDK for Java.

  • aws-sdk-ruby – The request was made with the AWS SDK for Ruby.

  • aws-cli/1.3.23 Python/2.7.6 Linux/2.6.18-164.el5 – The request was made with the AWS CLI installed on Linux.

Note

For events originated by AWS, this field is usually AWS Internal/#, where # is a number used for internal purposes.

Since: 1.0

Optional: False

errorCode

The AWS service error if the request returns an error.

Since: 1.0

Optional: True

errorMessage

If the request returns an error, the description of the error. This message includes messages for authorization failures. CloudTrail captures the message logged by the service in its exception handling. For an example, see Error Code and Message Log Example.

Note

Some AWS services provide the errorCode and errorMessage as top-level fields in the event. Other AWS services provide error information as part of responseElements.

Since: 1.0

Optional: True

requestParameters

The parameters, if any, that were sent with the request. These parameters are documented in the API reference documentation for the appropriate AWS service.

Since: 1.0

Optional: False

responseElements

The response element for actions that make changes (create, update, or delete actions). If an action does not change state (for example, a request to get or list objects), this element is omitted. These actions are documented in the API reference documentation for the appropriate AWS service.

Since: 1.0

Optional: False

additionalEventData

Additional data about the event that was not part of the request or response.

Support for this field begins with eventVersion 1.00.

Since: 1.0

Optional: True

requestID

The value that identifies the request. The service being called generates this value.

Support for this field begins with eventVersion 1.01.

Since: 1.01

Optional: False

eventID

GUID generated by CloudTrail to uniquely identify each event. You can use this value to identify a single event. For example, you can use the ID as a primary key to retrieve log data from a searchable database.

Since: 1.01

Optional: False

eventType

Identifies the type of event that generated the event record. This can be the one of the following values:

  • AwsApiCall – An API was called.

  • AwsServiceEvent – The service generated an event related to your trail. For example, this can occur when another account made a call with a resource that you own.

  • AwsConsoleSignin – A user in your account (root, IAM, federated, SAML, or SwitchRole) signed in to the AWS Management Console.

Since: 1.02

Optional: False

apiVersion

Identifies the API version associated with the AwsApiCall eventType value.

Since: 1.01

Optional: True

managementEvent

A Boolean value that identifies whether the event is a management event. managementEvent is shown in an event record if eventVersion is 1.06 or higher, and the event type is one of the following:

  • AwsApiCall

  • AwsConsoleAction

  • AwsConsoleSignIn

  • AwsServiceEvent

Since: 1.06

Optional: True

readOnly

Identifies whether this operation is a read-only operation. This can be one of the following values:

  • true – The operation is read-only (for example, DescribeTrails).

  • false – The operation is write-only (for example, DeleteTrail).

Since: 1.01

Optional: True

resources

A list of resources accessed in the event. The field can contain the following information:

  • Resource ARNs

  • Account ID of the resource owner

  • Resource type identifier in the format: AWS::aws-service-name::data-type-name

For example, when an AssumeRole event is logged, the resources field can appear like the following:

  • ARN: arn:aws:iam::123456789012:role/myRole

  • Account ID: 123456789012

  • Resource type identifier: AWS::IAM::Role

For example logs with the resources field, see AWS STS API Event in CloudTrail Log File in the IAM User Guide or Logging AWS KMS API Calls in the AWS Key Management Service Developer Guide.

Since: 1.01

Optional: True

recipientAccountId

Represents the account ID that received this event. The recipientAccountID may be different from the CloudTrail userIdentity Element accountId. This can occur in cross-account resource access. For example, if a KMS key, also known as a customer master key (CMK), was used by a separate account to call the Encrypt API, the accountId and recipientAccountID values will be the same for the event delivered to the account that made the call, but the values will be different for the event that is delivered to the account that owns the CMK.

Since: 1.02

Optional: True

serviceEventDetails

Identifies the service event, including what triggered the event and the result. For more information, see AWS Service Events.

Since: 1.05

Optional: True

sharedEventID

GUID generated by CloudTrail to uniquely identify CloudTrail events from the same AWS action that is sent to different AWS accounts.

For example, when an account uses a KMS key, also known as a customer master key (CMK), that belongs to another account, the account that used the CMK and the account that owns the CMK receive separate CloudTrail events for the same action. Each CloudTrail event delivered for this AWS action shares the same sharedEventID, but also has a unique eventID and recipientAccountID.

For more information, see sharedEventID Example.

Note

The sharedEventID field is present only when CloudTrail events are delivered to multiple accounts. If the caller and owner are the same AWS account, CloudTrail sends only one event, and the sharedEventID field is not present.

Since: 1.03

Optional: True

vpcEndpointId

Identifies the VPC endpoint in which requests were made from a VPC to another AWS service, such as Amazon S3.

Since: 1.04

Optional: True

Insights Event Record Fields

The following are attributes shown in the JSON structure of an Insights event that differ from those in a management or data event.

eventCategory

Shows the event category that is used in LookupEvents calls. In Insights events, the value is insight.

Since: 1.07

Optional: False

sharedEventId

A sharedEventID for CloudTrail Insights events differs from the sharedEventID for the management and data types of CloudTrail events. In Insights events, a sharedEventID is a GUID that is generated by CloudTrail Insights to uniquely identify an Insights event. sharedEventID is common between the start and the end Insights events, and helps to connect both events to uniquely identify unusual activity. You can think of the sharedEventID as the overall Insights event ID.

Since: 1.07

Optional: False

insightDetails

Insights events only. Shows information about the underlying triggers of an Insights event, such as event source, statistics, API name, and whether the event is the start or end of the Insights event.

Since: 1.07

Optional: False

state

Insights events only. Shows whether the event represents the start or end of the insight (the start or end of unusual activity). Values are Start or End.

Since: 1.07

Optional: False

eventName

The AWS API for which unusual activity was detected.

Since: 1.07

Optional: False

insightType

The type of Insights event. Value is ApiCallRateInsight.

Since: 1.07

Optional: False

insightContext

Data about the rate of calls that triggered the Insights event compared to the normal rate of calls to the subject API per minute.

Since: 1.07

Optional: True

statistics

A container for data about the typical average rate of calls to the subject API by an account, the rate of calls that triggered the Insights event, and the duration, in minutes, of the Insights event.

Since: 1.07

Optional: True

baseline

Shows the typical average rate of calls to the subject API per minute, as measured within the preceding week, by an account within a specific AWS Region.

Since: 1.07

Optional: True

insight

Shows the unusual rate of calls to the subject API that triggers the logging of an Insights event. The CloudTrail Insights average for the start event is the rate of calls per minute to the API that triggered the Insights event. Typically, this is the first minute of unusual activity. The Insights average for the end event is the rate of API calls per minute for the duration of the unusual activity, between the start Insights event and the end Insights event.

Since: 1.07

Optional: True

insightDuration

The duration, in minutes, of an Insights event (the time period from the start to the end of unusual activity on the subject API). insightDuration only occurs in end Insights events.

Since: 1.07

Optional: True