AWS CloudTrail events for investigators
CloudTrail writes one JSON record per call to the AWS API, and per console sign-in. The record names the call in
eventName and the service in eventSource; who made it is in userIdentity, from where in
sourceIPAddress and userAgent, and whether it worked in errorCode. These pages read one
event at a time the way an investigator does: what the call does, when it matters, which fields carry the signal, and
the KQL that finds it in Microsoft Sentinel's AWSCloudTrail table.
Each page shows AWS's own description of the call and, where AWS publishes one, AWS's example record for it. Field names are checked on every build against AWS's record documentation and those examples, and every column a query uses is checked against Microsoft's table reference.
Examples: Matched in your browser — nothing is sent anywhere.
Events explained
| Event | Service | What it means for you |
|---|---|---|
| ConsoleLogin | AWS Sign-In | One attempt to sign in to the AWS Management Console, by the root user, an IAM user or a federated user; responseElements.ConsoleLogin says whether it worked and additionalEventData.MFAUsed whether MFA was used. |
| AssumeRole | AWS STS | A request to AWS STS for temporary credentials for an IAM role; the record names the caller, the role and the temporary access key it returned, which ties the role session to every call made with it. |
| GetCallerIdentity | AWS STS | A caller asking AWS STS which identity its credentials belong to; it needs no permissions, so it is often the first call made with a newly found access key. |
| CreateAccessKey | IAM | A new long-term access key for an IAM user, or for the root user; the record shows who created it, for whom, and the new key's ID, which every later call made with the key carries. |
| StopLogging | CloudTrail | A request to stop a trail recording and delivering logs; CloudTrail records the call itself, and the trail then records nothing until someone calls StartLogging. |
| AttachUserPolicy | IAM | A managed IAM policy attached to an IAM user; the record names who attached it, the user who received it and the policy's ARN, which together decide whether this was an escalation. |
Every event in the catalog
The events these pages cover, most investigated first, with the first sentence of AWS's description of each. Events without a link get a page in a later weekly batch.
| Event | Service | AWS's description |
|---|---|---|
| ConsoleLogin | AWS Sign-In | CloudTrail logs attempts to sign in to the AWS Management Console, the AWS Discussion Forums, and the AWS Support Center. |
| AssumeRole | AWS STS | Returns a set of temporary security credentials that you can use to access AWS resources. |
| GetCallerIdentity | AWS STS | Returns details about the IAM user or role whose credentials are used to call the operation. |
| CreateAccessKey | IAM | Creates a new AWS secret access key and corresponding AWS access key ID for the specified user. |
| StopLogging | CloudTrail | Suspends the recording of AWS API calls and log file delivery for the specified trail. |
| AttachUserPolicy | IAM | Attaches the specified managed policy to the specified user. |
| CreateUser | IAM | Creates a new IAM user for your AWS account. |
| DeleteTrail | CloudTrail | Deletes a trail. |
| CreateLoginProfile | IAM | Creates a password for the specified IAM user. |
| GetSecretValue | Secrets Manager | Retrieves the contents of the encrypted fields SecretString or SecretBinary from the specified version of a secret, whichever contains content. |
| PutBucketPolicy | S3 | Applies an Amazon S3 bucket policy to an Amazon S3 bucket. |
| AttachRolePolicy | IAM | Attaches the specified managed policy to the specified IAM role. |
| UpdateAssumeRolePolicy | IAM | Updates the policy that grants an IAM entity permission to assume a role. |
| PutUserPolicy | IAM | Adds or updates an inline policy document that is embedded in the specified IAM user. |
| AssumeRoleWithSAML | AWS STS | Returns a set of temporary security credentials for users who have been authenticated via a SAML authentication response. |
| AssumeRoleWithWebIdentity | AWS STS | Returns a set of temporary security credentials for users who have been authenticated in a mobile or web application with a web identity provider. |
| GetSessionToken | AWS STS | Returns a set of temporary credentials for an AWS account or IAM user. |
| PutEventSelectors | CloudTrail | Configures event selectors (also referred to as basic event selectors) or advanced event selectors for your trail. |
| UpdateTrail | CloudTrail | Updates trail settings that control what events you are logging, and how to handle log files. |
| DeleteDetector | GuardDuty | Deletes an Amazon GuardDuty detector that is specified by the detector ID. |
| CreatePolicyVersion | IAM | Creates a new version of the specified managed policy. |
| UpdateLoginProfile | IAM | Changes the password for the specified IAM user. |
| DeactivateMFADevice | IAM | Deactivates the specified MFA device and removes it from association with the user name for which it was originally enabled. |
| AuthorizeSecurityGroupIngress | EC2 | Adds the specified inbound (ingress) rules to a security group. |
| RunInstances | EC2 | Launches the specified number of instances using an AMI for which you have permissions. |
| CreateKeyPair | EC2 | Creates an ED25519 or 2048-bit RSA key pair with the specified name and in the specified format. |
| ScheduleKeyDeletion | KMS | Schedules the deletion of a KMS key. |
| PutBucketAcl | S3 | Sets the permissions on an existing bucket using access control lists (ACL). |
| ModifySnapshotAttribute | EC2 | Adds or removes permission settings for the specified snapshot. |
| SendCommand | Systems Manager | Runs commands on one or more managed nodes. |
| StartSession | Systems Manager | Initiates a connection to a target (for example, a managed node) for a Session Manager session. |
| GetPasswordData | EC2 | Retrieves the encrypted administrator password for a running Windows instance. |
| DisableKey | KMS | Sets the state of a KMS key to disabled. |
| PutKeyPolicy | KMS | Attaches a key policy to the specified KMS key. |
| CreateRole | IAM | Creates a new role for your AWS account. |
| AddUserToGroup | IAM | Adds the specified user to the specified group. |
| DeleteBucketPolicy | S3 | Deletes the policy of a specified bucket. |
| LeaveOrganization | Organizations | Removes a member account from its parent organization. |
| DeleteLogGroup | CloudWatch Logs | Deletes the specified log group and permanently deletes all the archived log events associated with the log group. |
| DeleteFlowLogs | EC2 | Deletes one or more flow logs. |
| GetFederationToken | AWS STS | Returns a set of temporary security credentials (consisting of an access key ID, a secret access key, and a security token) for a user. |
| PutRolePolicy | IAM | Adds or updates an inline policy document that is embedded in the specified IAM role. |
| SetDefaultPolicyVersion | IAM | Sets the specified version of the specified policy as the policy's default (operative) version. |
| CreatePolicy | IAM | Creates a new managed policy for your AWS account. |
| DeleteAccountPasswordPolicy | IAM | Deletes the password policy for the AWS account. |
| ListBuckets | S3 | Returns a list of all buckets owned by the authenticated sender of the request. |
| GetParameters | Systems Manager | Get information about one or more parameters by specifying multiple parameter names. |
| Decrypt | KMS | Decrypts ciphertext that was encrypted by a KMS key using any of the following operations: |
| CreateKey | KMS | Creates a unique customer managed KMS key in your AWS account and Region. |
| StartLogging | CloudTrail | Starts the recording of AWS API calls and log file delivery for a trail. |
| UpdateDetector | GuardDuty | Updates the GuardDuty detector specified by the detector ID. |
| ModifyInstanceAttribute | EC2 | Modifies the specified attribute of the specified instance. |
| CreateGrant | KMS | Adds a grant to a KMS key. |
| CreateAccount | Organizations | Creates an AWS account that is automatically a member of the organization whose credentials made the request. |
| DeleteBucket | S3 | Deletes the S3 bucket. |
| GetBucketPolicy | S3 | Returns the policy of a specified bucket. |
| AttachGroupPolicy | IAM | Attaches the specified managed policy to the specified IAM group. |
| UpdateAccessKey | IAM | Changes the status of the specified access key from Active to Inactive, or vice versa. |
| DeleteVirtualMFADevice | IAM | Deletes a virtual MFA device. |
Descriptions are copied from AWS's API references and the CloudTrail User Guide, refreshed weekly. The format itself: CloudTrail log fields.
Have a whole CloudTrail export to read?
The free browser analyzer reads CloudTrail Records files and lookup-events output and flags logging changes, new access keys, administrator grants, root activity, failed console sign-ins and bursts of AccessDenied, with each event name linked to its page here. Nothing is uploaded.