CloudTrail record contents for management, data, and network activity events

The date and time the request was completed, in coordinated universal time (UTC). An event's time stamp comes from the local host that provides the service API endpoint on which the API call was made. For example, a CreateBucket API event that is run in the US West (Oregon) Region would get its time stamp from the time on an AWS host running the Amazon S3 endpoint, s3.us-west-2.amazonaws.com. In general, AWS services use Network Time Protocol (NTP) to synchronize their system clocks.

Since: 1.0

Optional: False

The version of the log event format. The current version is 1.11.

The eventVersion value is a major and minor version in the form major_version.minor_version. For example, you can have an eventVersion value of 1.10, where 1 is the major version, and 10 is the minor version.

CloudTrail increments the major version if a change is made to the event structure that is not backward-compatible. This includes removing a JSON field that already exists, or changing how the contents of a field are represented (for example, a date format). CloudTrail increments the minor version if a change adds new fields to the event structure. This can occur if new information is available for some or all existing events, or if new information is available only for new event types. Applications can ignore new fields to stay compatible with new minor versions of the event structure.

If CloudTrail introduces new event types, but the structure of the event is otherwise unchanged, the event version does not change.

To be sure that your applications can parse the event structure, we recommend that you perform an equal-to comparison on the major version number. To be sure that fields that are expected by your application exist, we also recommend performing a greater-than-or-equal-to comparison on the minor version. There are no leading zeroes in the minor version. You can interpret both major_version and minor_version as numbers, and perform comparison operations.

Since: 1.0

Optional: False

Information about the IAM identity that made a request. For more information, see CloudTrail userIdentity element.

Since: 1.0

Optional: False

The service that the request was made to. This name is typically a short form of the service name without spaces plus .amazonaws.com. For example:

This convention has some exceptions. For example, the eventSource for Amazon CloudWatch is monitoring.amazonaws.com.

Since: 1.0

Optional: False

The requested action, which is one of the actions in the API for that service.

Since: 1.0

Optional: False

The AWS Region that the request was made to, such as us-east-2. See CloudTrail supported Regions.

Since: 1.0

Optional: False

The IP address that the request was made from. For actions that originate from the service console, the address reported is for the underlying customer resource, not the console web server. For services in AWS, only the DNS name is displayed.

Since: 1.0

Optional: False

The agent through which the request was made, such as the AWS Management Console, an AWS service, the AWS SDKs or the AWS CLI.

This field has a maximum size of 1 KB; content exceeding that limit is truncated. For event data stores configured to have a maximum event size of 1 MB, the field content is only truncated if the event payload exceeds 1 MB and the maximum field size is exceeded.

The following are example values:

Since: 1.0

Optional: True

The AWS service error if the request returns an error. For an example that shows this field, see Error code and message log example.

This field has a maximum size of 1 KB; content exceeding that limit is truncated. For event data stores configured to have a maximum event size of 1 MB, the field content is only truncated if the event payload exceeds 1 MB and the maximum field size is exceeded.

For network activity events, when there is a VPC endpoint policy violation, the error code is VpceAccessDenied.

Since: 1.0

Optional: True

If the request returns an error, the description of the error. This message includes messages for authorization failures. CloudTrail captures the message logged by the service in its exception handling. For an example, see Error code and message log example.

This field has a maximum size of 1 KB; content exceeding that limit is truncated. For event data stores configured to have a maximum event size of 1 MB, the field content is only truncated if the event payload exceeds 1 MB and the maximum field size is exceeded.

For network activity events, when there is a VPC endpoint policy violation, the errorMessage will always be the following message: The request was denied due to a VPC endpoint policy. For more information about access denied events for VPC endpoint policy violations, see Access denied error message examples in the IAM User Guide. For an example network activity event showing a VPC endpoint policy violation, see Network activity events in this guide.

Since: 1.0

Optional: True

The parameters, if any, that were sent with the request. These parameters are documented in the API reference documentation for the appropriate AWS service. This field has a maximum size of 100 KB. When the field size exceeds 100 KB, the requestParameters content is omitted. For event data stores configured to have a maximum event size of 1 MB, the field content is only omitted if the event payload exceeds 1 MB and the maximum field size is exceeded.

Since: 1.0

Optional: False

The response elements, if any, for actions that make changes (create, update, or delete actions). For readOnly APIs, this field is null. If the action 
doesn't return response elements, this field is null. The response elements for actions are documented in the API reference
 documentation for the appropriate AWS service.

This field has a maximum size of 100 KB. When the field size exceeds 100 KB, the reponseElements content is omitted. For event data stores configured to have a maximum event size of 1 MB, the field content is only omitted if the event payload exceeds 1 MB and the maximum field size is exceeded.

The responseElements value is useful to help you trace a request
 with AWS Support. Both x-amz-request-id and x-amz-id-2
 contain information that helps you trace a request with Support. These values are
 the same as those that the service returns in the response to the request that
 initiates the events, so you can use them to match the event to the
 request.

Since: 1.0

Optional: False

Additional data about the event that was not part of the request or response. This field has a maximum size of 28 KB. When the field size exceeds 28 KB, the additionalEventData content is omitted. For event data stores configured to have a maximum event size of 1 MB, the field content is only omitted if the event payload exceeds 1 MB and the maximum field size is exceeded.

The content of additionalEventData is variable. For example, for AWS Management Console sign-in events, additionalEventData could include the MFAUsed field with a value of Yes if the request was made by a root or IAM user using multi-factor authentication (MFA).

Since: 1.0

Optional: True

The value that identifies the request. The service being called generates this value. This field has a maximum size of 1 KB; content exceeding that limit is truncated. For event data stores configured to have a maximum event size of 1 MB, the field content is only truncated if the event payload exceeds 1 MB and the maximum field size is exceeded.

Since: 1.01

Optional: True

GUID generated by CloudTrail to uniquely identify each event. You can use this value to identify a single event. For example, you can use the ID as a primary key to retrieve log data from a searchable database.

Since: 1.01

Optional: False

Identifies the type of event that generated the event record. This can be the one of the following values:

Since: 1.02

Optional: False

Identifies the API version associated with the AwsApiCall eventType value.

Since: 1.01

Optional: True

A Boolean value that identifies whether the event is a management event. managementEvent is shown in an event record if eventVersion is 1.06 or higher, and the event type is one of the following:

Since: 1.06

Optional: True

Identifies whether this operation is a read-only operation. This can be one of the following values:

Since: 1.01

Optional: True

A list of resources accessed in the event. The field can contain the following information:

For example, when an AssumeRole event is logged, the resources field can appear like the following:

For example logs with the resources field, see AWS STS API Event in CloudTrail Log File in the IAM User Guide or Logging AWS KMS API Calls in the AWS Key Management Service Developer Guide.

Since: 1.01

Optional: True

Represents the account ID that received this event. The recipientAccountID may be different from the CloudTrail userIdentity element accountId. This can occur in cross-account resource access. For example, if a KMS key, also known as an AWS KMS key, was used by a separate account to call the Encrypt API, the accountId and recipientAccountID values will be the same for the event delivered to the account that made the call, but the values will be different for the event that is delivered to the account that owns the KMS key.

Since: 1.02

Optional: True

Identifies the service event, including what triggered the event and the result. For more information, see AWS service events. This field has a maximum size of 100 KB. When the field size exceeds 100 KB, the serviceEventDetails content is omitted. For event data stores configured to have a maximum event size of 1 MB, the field content is only omitted if the event payload exceeds 1 MB and the maximum field size is exceeded.

Since: 1.05

Optional: True

GUID generated by CloudTrail to uniquely identify CloudTrail events from the same AWS action that is sent to different AWS accounts.

For example, when an account uses an AWS KMS key that belongs to another account, the account that used the KMS key and the account that owns the KMS key receive separate CloudTrail events for the same action. Each CloudTrail event delivered for this AWS action shares the same sharedEventID, but also has a unique eventID and recipientAccountID.

For more information, see Example sharedEventID.

Since: 1.03

Optional: True

Identifies the VPC endpoint in which requests were made from a VPC to another AWS service, such as Amazon EC2.

Since: 1.04

Optional: True

Identifies the AWS account ID of the VPC endpoint owner for the corresponding endpoint for which a request has traversed.

Since: 1.09

Optional: True

Shows the event category. The event category is used in LookupEvents calls to filter on management events.

Since: 1.07

Optional: False

If an event delivery was delayed, or additional information about an existing event becomes available after the event is logged, an addendum field shows information about why the event was delayed. If information was missing from an existing event, the addendum field includes the missing information and a reason for why it was missing. Contents include the following.

Since: 1.08

Optional: True

String with a value of true or false that shows whether or not an event originated from an AWS Management Console session. This field is not shown unless the value is true, meaning that the client that was used to make the API call was either a proxy or an external client. If a proxy client was used, thetlsDetails event field is not shown.

Since: 1.08

Optional: True

This field is present in enriched events recorded for event data stores that were configured to include resource tag keys or IAM global condition keys. For more information, see Enrich CloudTrail events by adding resource tag keys and IAM global condition keys.

Contents include the following:

Since: 1.11

Optional: True

Shows information about edge devices that are targets of a request. Currently, S3 Outposts device events include this field. This field has a maximum size of 28 KB; content exceeding that limit is truncated. For event data stores configured to have a maximum event size of 1 MB, the field content is only truncated if the event payload exceeds 1 MB and the maximum field size is exceeded.

Since: 1.08

Optional: True

Shows information about the Transport Layer Security (TLS) version, cipher suites, and the fully qualified domain name (FQDN) of the client-provided host name used in the service API call, which is typically the FQDN of the service endpoint. CloudTrail still logs partial TLS details if expected information is missing or empty. For example, if the TLS version and cipher suite are present, but the HOST header is empty, available TLS details are still logged in the CloudTrail event.

Since: 1.08

Optional: True