View a markdown version of this page

Se admiten acciones de la API ACM en el registro CloudTrail - AWS Certificate Manager
Eventos de administraciónEventos de datos

Las traducciones son generadas a través de traducción automática. En caso de conflicto entre la traducción y la version original de inglés, prevalecerá la version en inglés.

Se admiten acciones de la API ACM en el registro CloudTrail

ACM admite el registro de las siguientes acciones como eventos en los archivos de CloudTrail registro:

Cada entrada de registro o evento contiene información sobre quién generó la solicitud. La información de identidad del usuario le ayuda a determinar lo siguiente:

  • Si la solicitud se realizó con credenciales de usuario Usuario raíz de la cuenta de AWS o AWS Identity and Access Management (IAM).

  • Si la solicitud se realizó con credenciales de seguridad temporales de un rol o fue un usuario federado.

  • Si la solicitud la realizó otro servicio AWS

Para obtener más información, consulte el Elemento userIdentity de CloudTrail.

ACM registra los eventos de administración y los eventos de datos en CloudTrail.

Eventos de administración

Eventos de datos

Eventos de administración

ACM registra las siguientes operaciones como eventos CloudTrail de administración. Los eventos de administración se registran de forma predeterminada.

Añadir etiquetas a un certificado (AddTagsToCertificate)

El siguiente CloudTrail ejemplo muestra los resultados de una llamada a la AddTagsToCertificateAPI. 

{

   "Records":[
      {
         "eventVersion":"1.04",
         "userIdentity":{
            "type":"IAMUser",
            "principalId":"AIDACKCEVSQ6C2EXAMPLE",
            "arn":"arn:aws:iam::123456789012:user/Alice",
            "accountId":"123456789012",
            "accessKeyId":"AKIAIOSFODNN7EXAMPLE",
            "userName":"Alice"
         },
         "eventTime":"2016-04-06T13:53:53Z",
         "eventSource":"acm.amazonaws.com",
         "eventName":"AddTagsToCertificate",
         "awsRegion":"us-east-1",
         "sourceIPAddress":"192.0.2.0",
         "userAgent":"aws-cli/1.10.16",
         "requestParameters":{
            "tags":[
               {
                  "value":"Alice",
                  "key":"Admin"
               }
            ],
            "certificateArn":"arn:aws:acm:us-east-1:123456789012:certificate/fedcba98-7654-3210-fedc-ba9876543210"
         },
         "responseElements":null,
         "requestID":"fedcba98-7654-3210-fedc-ba9876543210",
         "eventID":"fedcba98-7654-3210-fedc-ba9876543210",
         "eventType":"AwsApiCall",
         "recipientAccountId":"123456789012"
      }
   ]
}

Cambiar la clave de una cuenta ACME (ChangeAccountKey)

El siguiente CloudTrail ejemplo muestra una entrada de registro para la ChangeAccountKey operación.

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "Unknown",
    "principalId": "anonymous",
    "arn": "anonymous",
    "accountId": "123456789012",
    "userName": "anonymous"
  },
  "eventTime": "2026-06-10T20:29:57Z",
  "eventSource": "acm-acme.amazonaws.com",
  "eventName": "ChangeAccountKey",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "192.0.2.0",
  "userAgent": "aws-cli/2.0",
  "requestParameters": {
    "serverUuid": "a1b2c3d4-5678-90ab-cdef-EXAMPLE11111",
    "innerJws": "EXAMPLE"
  },
  "responseElements": {
    "location": "https://acm-acme-enroll.us-east-1.api.aws/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111/acct/a1b2c3d4-5678-90ab-cdef-EXAMPLE22222",
    "status": "valid",
    "orders": "https://acm-acme-enroll.us-east-1.api.aws/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111/acct/a1b2c3d4-5678-90ab-cdef-EXAMPLE22222/orders"
  },
  "requestID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE11111",
  "eventID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE22222",
  "readOnly": false,
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::CertificateManager::AcmeEndpoint",
      "ARN": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111"
    }
  ],
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "123456789012",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "acm-acme-enroll.us-east-1.api.aws"
  }
}

Crear una validación de dominio ACME (CreateAcmeDomainValidation)

El siguiente CloudTrail ejemplo muestra una entrada de registro para la CreateAcmeDomainValidation operación.

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "AssumedRole",
    "principalId": "AROAEXAMPLEID:example-session",
    "arn": "arn:aws:sts::123456789012:assumed-role/example-role/example-session",
    "accountId": "123456789012",
    "accessKeyId": "ASIAIOSFODNN7EXAMPLE",
    "sessionContext": {
      "sessionIssuer": {
        "type": "Role",
        "principalId": "AROAEXAMPLEID",
        "arn": "arn:aws:iam::123456789012:role/example-role",
        "accountId": "123456789012",
        "userName": "example-role"
      },
      "attributes": {
        "creationDate": "2026-06-10T20:28:43Z",
        "mfaAuthenticated": "false"
      }
    }
  },
  "eventTime": "2026-06-10T20:28:45Z",
  "eventSource": "acm.amazonaws.com",
  "eventName": "CreateAcmeDomainValidation",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "192.0.2.0",
  "userAgent": "aws-cli/2.0",
  "requestParameters": {
    "idempotencyToken": "a1b2c3d4-5678-90ab-cdef-EXAMPLE11111",
    "acmeEndpointArn": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111",
    "domainName": "example.com",
    "prevalidationOptions": {
      "dnsPrevalidation": {
        "domainScope": {
          "exactDomain": "ENABLED"
        },
        "hostedZoneId": "Z00443972VKAL6HT44MI"
      }
    }
  },
  "responseElements": {
    "acmeDomainValidationArn": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111/acme-domain-validation/a1b2c3d4-5678-90ab-cdef-EXAMPLE22222"
  },
  "requestID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE33333",
  "eventID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE44444",
  "readOnly": false,
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::CertificateManager::AcmeEndpoint",
      "ARN": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111"
    },
    {
      "accountId": "123456789012",
      "type": "AWS::CertificateManager::AcmeDomainValidation",
      "ARN": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111/acme-domain-validation/a1b2c3d4-5678-90ab-cdef-EXAMPLE22222"
    }
  ],
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "123456789012",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "acm-acme.us-east-1.api.aws"
  }
}

Crear un punto final ACME (CreateAcmeEndpoint)

El siguiente CloudTrail ejemplo muestra una entrada de registro para la CreateAcmeEndpoint operación.

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "AssumedRole",
    "principalId": "AROAEXAMPLEID:example-session",
    "arn": "arn:aws:sts::123456789012:assumed-role/example-role/example-session",
    "accountId": "123456789012",
    "accessKeyId": "ASIAIOSFODNN7EXAMPLE",
    "sessionContext": {
      "sessionIssuer": {
        "type": "Role",
        "principalId": "AROAEXAMPLEID",
        "arn": "arn:aws:iam::123456789012:role/example-role",
        "accountId": "123456789012",
        "userName": "example-role"
      },
      "attributes": {
        "creationDate": "2026-06-10T20:28:43Z",
        "mfaAuthenticated": "false"
      }
    }
  },
  "eventTime": "2026-06-10T20:28:45Z",
  "eventSource": "acm.amazonaws.com",
  "eventName": "CreateAcmeEndpoint",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "192.0.2.0",
  "userAgent": "aws-cli/2.0",
  "requestParameters": {
    "idempotencyToken": "a1b2c3d4-5678-90ab-cdef-EXAMPLE11111",
    "authorizationBehavior": "PRE_APPROVED",
    "certificateAuthority": {
      "publicCertificateAuthority": {
      }
    }
  },
  "responseElements": {
    "acmeEndpointArn": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111"
  },
  "requestID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE33333",
  "eventID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE44444",
  "readOnly": false,
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::CertificateManager::AcmeEndpoint",
      "ARN": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111"
    }
  ],
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "123456789012",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "acm-acme.us-east-1.api.aws"
  }
}

Crear un enlace de cuenta externo de ACME (CreateAcmeExternalAccountBinding)

El siguiente CloudTrail ejemplo muestra una entrada de registro para la CreateAcmeExternalAccountBinding operación.

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "AssumedRole",
    "principalId": "AROAEXAMPLEID:example-session",
    "arn": "arn:aws:sts::123456789012:assumed-role/example-role/example-session",
    "accountId": "123456789012",
    "accessKeyId": "ASIAIOSFODNN7EXAMPLE",
    "sessionContext": {
      "sessionIssuer": {
        "type": "Role",
        "principalId": "AROAEXAMPLEID",
        "arn": "arn:aws:iam::123456789012:role/example-role",
        "accountId": "123456789012",
        "userName": "example-role"
      },
      "attributes": {
        "creationDate": "2026-06-10T20:28:43Z",
        "mfaAuthenticated": "false"
      }
    }
  },
  "eventTime": "2026-06-10T20:28:45Z",
  "eventSource": "acm.amazonaws.com",
  "eventName": "CreateAcmeExternalAccountBinding",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "192.0.2.0",
  "userAgent": "aws-cli/2.0",
  "requestParameters": {
    "idempotencyToken": "a1b2c3d4-5678-90ab-cdef-EXAMPLE11111",
    "acmeEndpointArn": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111",
    "roleArn": "arn:aws:iam::123456789012:role/example-role",
    "expiration": {
      "value": 1,
      "type": "DAYS"
    }
  },
  "responseElements": {
    "externalAccountBinding": {
      "acmeExternalAccountBindingArn": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111/acme-external-account-binding/a1b2c3d4-5678-90ab-cdef-EXAMPLE22222",
      "acmeEndpointArn": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111",
      "roleArn": "arn:aws:iam::123456789012:role/example-role",
      "expiresAt": "2026-06-11T20:28:45Z"
    }
  },
  "requestID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE33333",
  "eventID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE44444",
  "readOnly": false,
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::CertificateManager::AcmeEndpoint",
      "ARN": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111"
    },
    {
      "accountId": "123456789012",
      "type": "AWS::CertificateManager::AcmeExternalAccountBinding",
      "ARN": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111/acme-external-account-binding/a1b2c3d4-5678-90ab-cdef-EXAMPLE22222"
    }
  ],
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "123456789012",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "acm-acme.us-east-1.api.aws"
  }
}

Eliminar una validación de dominio ACME (DeleteAcmeDomainValidation)

El siguiente CloudTrail ejemplo muestra una entrada de registro para la DeleteAcmeDomainValidation operación.

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "AssumedRole",
    "principalId": "AROAEXAMPLEID:example-session",
    "arn": "arn:aws:sts::123456789012:assumed-role/example-role/example-session",
    "accountId": "123456789012",
    "accessKeyId": "ASIAIOSFODNN7EXAMPLE",
    "sessionContext": {
      "sessionIssuer": {
        "type": "Role",
        "principalId": "AROAEXAMPLEID",
        "arn": "arn:aws:iam::123456789012:role/example-role",
        "accountId": "123456789012",
        "userName": "example-role"
      },
      "attributes": {
        "creationDate": "2026-06-10T20:28:43Z",
        "mfaAuthenticated": "false"
      }
    }
  },
  "eventTime": "2026-06-10T20:28:45Z",
  "eventSource": "acm.amazonaws.com",
  "eventName": "DeleteAcmeDomainValidation",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "192.0.2.0",
  "userAgent": "aws-cli/2.0",
  "requestParameters": {
    "acmeDomainValidationArn": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111/acme-domain-validation/a1b2c3d4-5678-90ab-cdef-EXAMPLE22222"
  },
  "responseElements": null,
  "requestID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE33333",
  "eventID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE44444",
  "readOnly": false,
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::CertificateManager::AcmeDomainValidation",
      "ARN": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111/acme-domain-validation/a1b2c3d4-5678-90ab-cdef-EXAMPLE22222"
    }
  ],
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "123456789012",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "acm-acme.us-east-1.api.aws"
  }
}

Eliminar un punto final de ACME (DeleteAcmeEndpoint)

El siguiente CloudTrail ejemplo muestra una entrada de registro para la DeleteAcmeEndpoint operación.

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "AssumedRole",
    "principalId": "AROAEXAMPLEID:example-session",
    "arn": "arn:aws:sts::123456789012:assumed-role/example-role/example-session",
    "accountId": "123456789012",
    "accessKeyId": "ASIAIOSFODNN7EXAMPLE",
    "sessionContext": {
      "sessionIssuer": {
        "type": "Role",
        "principalId": "AROAEXAMPLEID",
        "arn": "arn:aws:iam::123456789012:role/example-role",
        "accountId": "123456789012",
        "userName": "example-role"
      },
      "attributes": {
        "creationDate": "2026-06-10T20:28:43Z",
        "mfaAuthenticated": "false"
      }
    }
  },
  "eventTime": "2026-06-10T20:28:45Z",
  "eventSource": "acm.amazonaws.com",
  "eventName": "DeleteAcmeEndpoint",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "192.0.2.0",
  "userAgent": "aws-cli/2.0",
  "requestParameters": {
    "acmeEndpointArn": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111"
  },
  "responseElements": null,
  "requestID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE33333",
  "eventID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE44444",
  "readOnly": false,
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::CertificateManager::AcmeEndpoint",
      "ARN": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111"
    }
  ],
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "123456789012",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "acm-acme.us-east-1.api.aws"
  }
}

Eliminar un enlace de cuenta externa de ACME (DeleteAcmeExternalAccountBinding)

El siguiente CloudTrail ejemplo muestra una entrada de registro para la DeleteAcmeExternalAccountBinding operación.

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "AssumedRole",
    "principalId": "AROAEXAMPLEID:example-session",
    "arn": "arn:aws:sts::123456789012:assumed-role/example-role/example-session",
    "accountId": "123456789012",
    "accessKeyId": "ASIAIOSFODNN7EXAMPLE",
    "sessionContext": {
      "sessionIssuer": {
        "type": "Role",
        "principalId": "AROAEXAMPLEID",
        "arn": "arn:aws:iam::123456789012:role/example-role",
        "accountId": "123456789012",
        "userName": "example-role"
      },
      "attributes": {
        "creationDate": "2026-06-10T20:28:43Z",
        "mfaAuthenticated": "false"
      }
    }
  },
  "eventTime": "2026-06-10T20:28:45Z",
  "eventSource": "acm.amazonaws.com",
  "eventName": "DeleteAcmeExternalAccountBinding",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "192.0.2.0",
  "userAgent": "aws-cli/2.0",
  "requestParameters": {
    "acmeExternalAccountBindingArn": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111/acme-external-account-binding/a1b2c3d4-5678-90ab-cdef-EXAMPLE22222"
  },
  "responseElements": null,
  "requestID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE33333",
  "eventID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE44444",
  "readOnly": false,
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::CertificateManager::AcmeExternalAccountBinding",
      "ARN": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111/acme-external-account-binding/a1b2c3d4-5678-90ab-cdef-EXAMPLE22222"
    }
  ],
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "123456789012",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "acm-acme.us-east-1.api.aws"
  }
}

Eliminar un certificado (DeleteCertificate)

El siguiente CloudTrail ejemplo muestra los resultados de una llamada a la DeleteCertificateAPI. 

{

   "Records":[
      {
         "eventVersion":"1.04",
         "userIdentity":{
            "type":"IAMUser",
            "principalId":"AIDACKCEVSQ6C2EXAMPLE",
            "arn":"arn:aws:iam::123456789012:user/Alice",
            "accountId":"123456789012",
            "accessKeyId":"AKIAIOSFODNN7EXAMPLE",
            "userName":"Alice"
         },
         "eventTime":"2016-03-18T00:00:26Z",
         "eventSource":"acm.amazonaws.com",
         "eventName":"DeleteCertificate",
         "awsRegion":"us-east-1",
         "sourceIPAddress":"192.0.2.0",
         "userAgent":"aws-cli/1.9.15",
         "requestParameters":{
            "certificateArn":"arn:aws:acm:us-east-1:123456789012:certificate/fedcba98-7654-3210-fedc-ba9876543210"
         },
         "responseElements":null,
         "requestID":"01234567-89ab-cdef-0123-456789abcdef",
         "eventID":"01234567-89ab-cdef-0123-456789abcdef",
         "eventType":"AwsApiCall",
         "recipientAccountId":"123456789012"
      }
   ]
}

Describir una cuenta ACME (DescribeAcmeAccount)

El siguiente CloudTrail ejemplo muestra una entrada de registro para la DescribeAcmeAccount operación.

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "AssumedRole",
    "principalId": "AROAEXAMPLEID:example-session",
    "arn": "arn:aws:sts::123456789012:assumed-role/example-role/example-session",
    "accountId": "123456789012",
    "accessKeyId": "ASIAIOSFODNN7EXAMPLE",
    "sessionContext": {
      "sessionIssuer": {
        "type": "Role",
        "principalId": "AROAEXAMPLEID",
        "arn": "arn:aws:iam::123456789012:role/example-role",
        "accountId": "123456789012",
        "userName": "example-role"
      },
      "attributes": {
        "creationDate": "2026-06-10T20:28:43Z",
        "mfaAuthenticated": "false"
      }
    }
  },
  "eventTime": "2026-06-10T20:28:46Z",
  "eventSource": "acm.amazonaws.com",
  "eventName": "DescribeAcmeAccount",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "192.0.2.0",
  "userAgent": "aws-cli/2.0",
  "requestParameters": {
    "acmeEndpointArn": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111",
    "accountUrl": "https://acm-acme-enroll.us-east-1.api.aws/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111/acct/a1b2c3d4-5678-90ab-cdef-EXAMPLE22222"
  },
  "responseElements": null,
  "requestID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE33333",
  "eventID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE44444",
  "readOnly": true,
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::CertificateManager::AcmeEndpoint",
      "ARN": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111"
    }
  ],
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "123456789012",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "acm-acme.us-east-1.api.aws"
  }
}

Describe una validación de dominio ACME (DescribeAcmeDomainValidation)

El siguiente CloudTrail ejemplo muestra una entrada de registro para la DescribeAcmeDomainValidation operación.

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "AssumedRole",
    "principalId": "AROAEXAMPLEID:example-session",
    "arn": "arn:aws:sts::123456789012:assumed-role/example-role/example-session",
    "accountId": "123456789012",
    "accessKeyId": "ASIAIOSFODNN7EXAMPLE",
    "sessionContext": {
      "sessionIssuer": {
        "type": "Role",
        "principalId": "AROAEXAMPLEID",
        "arn": "arn:aws:iam::123456789012:role/example-role",
        "accountId": "123456789012",
        "userName": "example-role"
      },
      "attributes": {
        "creationDate": "2026-06-10T20:28:43Z",
        "mfaAuthenticated": "false"
      }
    }
  },
  "eventTime": "2026-06-10T20:29:37Z",
  "eventSource": "acm.amazonaws.com",
  "eventName": "DescribeAcmeDomainValidation",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "192.0.2.0",
  "userAgent": "aws-cli/2.0",
  "requestParameters": {
    "acmeDomainValidationArn": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111/acme-domain-validation/a1b2c3d4-5678-90ab-cdef-EXAMPLE22222"
  },
  "responseElements": null,
  "requestID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE33333",
  "eventID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE44444",
  "readOnly": true,
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::CertificateManager::AcmeDomainValidation",
      "ARN": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111/acme-domain-validation/a1b2c3d4-5678-90ab-cdef-EXAMPLE22222"
    }
  ],
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "123456789012",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "acm-acme.us-east-1.api.aws"
  }
}

Describir un punto final de ACME (DescribeAcmeEndpoint)

El siguiente CloudTrail ejemplo muestra una entrada de registro para la DescribeAcmeEndpoint operación.

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "AssumedRole",
    "principalId": "AROAEXAMPLEID:example-session",
    "arn": "arn:aws:sts::123456789012:assumed-role/example-role/example-session",
    "accountId": "123456789012",
    "accessKeyId": "ASIAIOSFODNN7EXAMPLE",
    "sessionContext": {
      "sessionIssuer": {
        "type": "Role",
        "principalId": "AROAEXAMPLEID",
        "arn": "arn:aws:iam::123456789012:role/example-role",
        "accountId": "123456789012",
        "userName": "example-role"
      },
      "attributes": {
        "creationDate": "2026-06-10T20:28:43Z",
        "mfaAuthenticated": "false"
      }
    }
  },
  "eventTime": "2026-06-10T20:28:45Z",
  "eventSource": "acm.amazonaws.com",
  "eventName": "DescribeAcmeEndpoint",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "192.0.2.0",
  "userAgent": "aws-cli/2.0",
  "requestParameters": {
    "acmeEndpointArn": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111"
  },
  "responseElements": null,
  "requestID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE33333",
  "eventID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE44444",
  "readOnly": true,
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::CertificateManager::AcmeEndpoint",
      "ARN": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111"
    }
  ],
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "123456789012",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "acm-acme.us-east-1.api.aws"
  }
}

Describe un enlace de cuenta externa de ACME (DescribeAcmeExternalAccountBinding)

El siguiente CloudTrail ejemplo muestra una entrada de registro para la DescribeAcmeExternalAccountBinding operación.

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "AssumedRole",
    "principalId": "AROAEXAMPLEID:example-session",
    "arn": "arn:aws:sts::123456789012:assumed-role/example-role/example-session",
    "accountId": "123456789012",
    "accessKeyId": "ASIAIOSFODNN7EXAMPLE",
    "sessionContext": {
      "sessionIssuer": {
        "type": "Role",
        "principalId": "AROAEXAMPLEID",
        "arn": "arn:aws:iam::123456789012:role/example-role",
        "accountId": "123456789012",
        "userName": "example-role"
      },
      "attributes": {
        "creationDate": "2026-06-10T20:28:43Z",
        "mfaAuthenticated": "false"
      }
    }
  },
  "eventTime": "2026-06-10T20:29:06Z",
  "eventSource": "acm.amazonaws.com",
  "eventName": "DescribeAcmeExternalAccountBinding",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "192.0.2.0",
  "userAgent": "aws-cli/2.0",
  "requestParameters": {
    "acmeExternalAccountBindingArn": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111/acme-external-account-binding/a1b2c3d4-5678-90ab-cdef-EXAMPLE22222"
  },
  "responseElements": null,
  "requestID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE33333",
  "eventID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE44444",
  "readOnly": true,
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::CertificateManager::AcmeExternalAccountBinding",
      "ARN": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111/acme-external-account-binding/a1b2c3d4-5678-90ab-cdef-EXAMPLE22222"
    }
  ],
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "123456789012",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "acm-acme.us-east-1.api.aws"
  }
}

Describir un certificado (DescribeCertificate)

El siguiente CloudTrail ejemplo muestra los resultados de una llamada a la DescribeCertificateAPI.

nota

El CloudTrail registro de la DescribeCertificate operación no muestra información sobre el certificado ACM que especifique. Puede ver la información sobre el certificado mediante la consola AWS Command Line Interface, la o la DescribeCertificateAPI. 

{
   "Records":[
      {
         "eventVersion":"1.04",
         "userIdentity":{
            "type":"IAMUser",
            "principalId":"AIDACKCEVSQ6C2EXAMPLE",
            "arn":"arn:aws:iam::123456789012:user/Alice",
            "accountId":"123456789012",
            "accessKeyId":"AKIAIOSFODNN7EXAMPLE",
            "userName":"Alice"
         },
         "eventTime":"2016-03-18T00:00:42Z",
         "eventSource":"acm.amazonaws.com",
         "eventName":"DescribeCertificate",
         "awsRegion":"us-east-1",
         "sourceIPAddress":"192.0.2.0",
         "userAgent":"aws-cli/1.9.15",
         "requestParameters":{
            "certificateArn":"arn:aws:acm:us-east-1:123456789012:certificate/fedcba98-7654-3210-fedc-ba9876543210"
         },
         "responseElements":null,
         "requestID":"fedcba98-7654-3210-fedc-ba9876543210",
         "eventID":"fedcba98-7654-3210-fedc-ba9876543210",
         "eventType":"AwsApiCall",
         "recipientAccountId":"123456789012"
      }
   ]
}

Exportación de un certificado (ExportCertificate)

El siguiente CloudTrail ejemplo muestra los resultados de una llamada a la ExportCertificateAPI. 

{
   "Records":[
      {
         "version":"0",
         "id":"01234567-89ab-cdef-0123-456789abcdef",
         "detail-type":"AWS API Call via CloudTrail",
         "source":"aws.acm",
         "account":"123456789012",
         "time":"2018-05-24T15:28:11Z",
         "region":"us-east-1",
         "resources":[

         ],
         "detail":{
            "eventVersion":"1.04",
            "userIdentity":{
               "type":"Root",
               "principalId":"123456789012",
               "arn":"arn:aws:iam::123456789012:user/Alice",
               "accountId":"123456789012",
               "accessKeyId":"AKIAIOSFODNN7EXAMPLE",
               "userName":"Alice"
            },
            "eventTime":"2018-05-24T15:28:11Z",
            "eventSource":"acm.amazonaws.com",
            "eventName":"ExportCertificate",
            "awsRegion":"us-east-1",
            "sourceIPAddress":"192.0.2.0",
            "userAgent":"aws-cli/1.15.4 Python/2.7.9 Windows/8 botocore/1.10.4",
            "requestParameters":{
              "certificateArn":"arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012",
               "passphrase": "HIDDEN_DUE_TO_SECURITY_REASONS"
            },
            "responseElements":{
                "certificateChain":
                "-----BEGIN CERTIFICATE----- 
                base64 certificate 
                -----END CERTIFICATE-----               
                -----BEGIN CERTIFICATE----- 
                base64 certificate 
                -----END CERTIFICATE-----",
                "privateKey":"**********",
                "certificate": 
                "-----BEGIN CERTIFICATE----- 
                base64 certificate 
                -----END CERTIFICATE-----",
                "privateKey": "HIDDEN_DUE_TO_SECURITY_REASONS"
            },
            "requestID":"01234567-89ab-cdef-0123-456789abcdef",
            "eventID":"fedcba98-7654-3210-fedc-ba9876543210",
            "readOnly": false,
            "eventType":"AwsApiCall"
                "managementEvent": true,
                "recipientAccountId": "123456789012",
                "eventCategory": "Management",
                "tlsDetails": {
                     "tlsVersion": "TLSv1.3",
                     "cipherSuite": "TLS_AES_128_GCM_SHA256",
                     "clientProvidedHostHeader": "acm.us-east-1.amazonaws.com"
                 },
                 "sessionCredentialFromConsole": "true"
}

Recuperación de credenciales de enlace de cuentas externas (GetAcmeExternalAccountBindingCredentials)

El siguiente CloudTrail ejemplo muestra una entrada de registro para la GetAcmeExternalAccountBindingCredentials operación.

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "AssumedRole",
    "principalId": "AROAEXAMPLEID:example-session",
    "arn": "arn:aws:sts::123456789012:assumed-role/example-role/example-session",
    "accountId": "123456789012",
    "accessKeyId": "ASIAIOSFODNN7EXAMPLE",
    "sessionContext": {
      "sessionIssuer": {
        "type": "Role",
        "principalId": "AROAEXAMPLEID",
        "arn": "arn:aws:iam::123456789012:role/example-role",
        "accountId": "123456789012",
        "userName": "example-role"
      },
      "attributes": {
        "creationDate": "2026-06-10T20:28:43Z",
        "mfaAuthenticated": "false"
      }
    }
  },
  "eventTime": "2026-06-10T20:29:26Z",
  "eventSource": "acm.amazonaws.com",
  "eventName": "GetAcmeExternalAccountBindingCredentials",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "192.0.2.0",
  "userAgent": "aws-cli/2.0",
  "requestParameters": {
    "acmeExternalAccountBindingArn": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111/acme-external-account-binding/a1b2c3d4-5678-90ab-cdef-EXAMPLE22222"
  },
  "responseElements": null,
  "requestID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE33333",
  "eventID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE44444",
  "readOnly": true,
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::CertificateManager::AcmeExternalAccountBinding",
      "ARN": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111/acme-external-account-binding/a1b2c3d4-5678-90ab-cdef-EXAMPLE22222"
    }
  ],
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "123456789012",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "acm-acme.us-east-1.api.aws"
  }
}

Recuperación de un certificado (GetCertificate)

El siguiente CloudTrail ejemplo muestra los resultados de una llamada a la GetCertificateAPI. 

{

   "Records":[
      {
         "eventVersion":"1.04",
         "userIdentity":{
            "type":"IAMUser",
            "principalId":"AIDACKCEVSQ6C2EXAMPLE",
            "arn":"arn:aws:iam::123456789012:user/Alice",
            "accountId":"123456789012",
            "accessKeyId":"AKIAIOSFODNN7EXAMPLE",
            "userName":"Alice"
         },
         "eventTime":"2016-03-18T00:00:41Z",
         "eventSource":"acm.amazonaws.com",
         "eventName":"GetCertificate",
         "awsRegion":"us-east-1",
         "sourceIPAddress":"192.0.2.0",
         "userAgent":"aws-cli/1.9.15",
         "requestParameters":{
            "certificateArn":"arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012"
         },
         "responseElements":{
            "certificateChain":

            "-----BEGIN CERTIFICATE-----
            Base64-encoded certificate chain
            -----END CERTIFICATE-----",
            "certificate":
            "-----BEGIN CERTIFICATE-----
            Base64-encoded certificate
            -----END CERTIFICATE-----"

         },
         "requestID":"744dd891-ec9c-11e5-ac34-d1e4dfe1a11b",
         "eventID":"7aa4f909-00dd-478a-9a00-b2709bcad2bb",
         "eventType":"AwsApiCall",
         "recipientAccountId":"123456789012"
      }
   ]
}

Importar un certificado (ImportCertificate)

El siguiente ejemplo muestra la entrada de CloudTrail registro que registra una llamada a la operación de la ImportCertificateAPI de ACM. 

{
   "eventVersion":"1.04",
   "userIdentity":{
      "type":"IAMUser",
      "principalId":"AIDACKCEVSQ6C2EXAMPLE",
      "arn":"arn:aws:iam::111122223333:user/Alice",
      "accountId":"111122223333",
      "accessKeyId":"AKIAIOSFODNN7EXAMPLE",
      "userName":"Alice"
   },
   "eventTime":"2016-10-04T16:01:30Z",
   "eventSource":"acm.amazonaws.com",
   "eventName":"ImportCertificate",
   "awsRegion":"ap-southeast-2",
   "sourceIPAddress":"54.240.193.129",
   "userAgent":"Coral/Netty",
   "requestParameters":{
      "privateKey":{
         "hb":[
            "byte",
            "byte",
            "byte",
            "..."
         ],
         "offset":0,
         "isReadOnly":false,
         "bigEndian":true,
         "nativeByteOrder":false,
         "mark":-1,
         "position":0,
         "limit":1674,
         "capacity":1674,
         "address":0
      },
      "certificateChain":{
         "hb":[
            "byte",
            "byte",
            "byte",
            "..."
         ],
         "offset":0,
         "isReadOnly":false,
         "bigEndian":true,
         "nativeByteOrder":false,
         "mark":-1,
         "position":0,
         "limit":2105,
         "capacity":2105,
         "address":0
      },
      "certificate":{
         "hb":[
            "byte",
            "byte",
            "byte",
            "..."
         ],
         "offset":0,
         "isReadOnly":false,
         "bigEndian":true,
         "nativeByteOrder":false,
         "mark":-1,
         "position":0,
         "limit":2503,
         "capacity":2503,
         "address":0
      }
   },
   "responseElements":{
      "certificateArn":"arn:aws:acm:ap-southeast-2:111122223333:certificate/01234567-89ab-cdef-0123-456789abcdef"
   },
   "requestID":"01234567-89ab-cdef-0123-456789abcdef",
   "eventID":"01234567-89ab-cdef-0123-456789abcdef",
   "eventType":"AwsApiCall",
   "recipientAccountId":"111122223333"
}

Listado de cuentas ACME (ListAcmeAccounts)

El siguiente CloudTrail ejemplo muestra una entrada de registro para la ListAcmeAccounts operación.

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "AssumedRole",
    "principalId": "AROAEXAMPLEID:example-session",
    "arn": "arn:aws:sts::123456789012:assumed-role/example-role/example-session",
    "accountId": "123456789012",
    "accessKeyId": "ASIAIOSFODNN7EXAMPLE",
    "sessionContext": {
      "sessionIssuer": {
        "type": "Role",
        "principalId": "AROAEXAMPLEID",
        "arn": "arn:aws:iam::123456789012:role/example-role",
        "accountId": "123456789012",
        "userName": "example-role"
      },
      "attributes": {
        "creationDate": "2026-06-10T20:28:43Z",
        "mfaAuthenticated": "false"
      }
    }
  },
  "eventTime": "2026-06-10T20:29:37Z",
  "eventSource": "acm.amazonaws.com",
  "eventName": "ListAcmeAccounts",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "192.0.2.0",
  "userAgent": "aws-cli/2.0",
  "requestParameters": {
    "acmeEndpointArn": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111"
  },
  "responseElements": null,
  "requestID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE33333",
  "eventID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE44444",
  "readOnly": true,
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::CertificateManager::AcmeEndpoint",
      "ARN": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111"
    }
  ],
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "123456789012",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "acm-acme.us-east-1.api.aws"
  }
}

Lista de las validaciones de dominio ACME (ListAcmeDomainValidations)

El siguiente CloudTrail ejemplo muestra una entrada de registro para la operación. ListAcmeDomainValidations

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "AssumedRole",
    "principalId": "AROAEXAMPLEID:example-session",
    "arn": "arn:aws:sts::123456789012:assumed-role/example-role/example-session",
    "accountId": "123456789012",
    "accessKeyId": "ASIAIOSFODNN7EXAMPLE",
    "sessionContext": {
      "sessionIssuer": {
        "type": "Role",
        "principalId": "AROAEXAMPLEID",
        "arn": "arn:aws:iam::123456789012:role/example-role",
        "accountId": "123456789012",
        "userName": "example-role"
      },
      "attributes": {
        "creationDate": "2026-06-10T20:28:43Z",
        "mfaAuthenticated": "false"
      }
    }
  },
  "eventTime": "2026-06-10T20:29:57Z",
  "eventSource": "acm.amazonaws.com",
  "eventName": "ListAcmeDomainValidations",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "192.0.2.0",
  "userAgent": "aws-cli/2.0",
  "requestParameters": {
    "acmeEndpointArn": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111"
  },
  "responseElements": null,
  "requestID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE33333",
  "eventID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE44444",
  "readOnly": true,
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::CertificateManager::AcmeEndpoint",
      "ARN": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111"
    }
  ],
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "123456789012",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "acm-acme.us-east-1.api.aws"
  }
}

Listar los puntos finales de ACME (ListAcmeEndpoints)

El siguiente CloudTrail ejemplo muestra una entrada de registro para la ListAcmeEndpoints operación.

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "AssumedRole",
    "principalId": "AROAEXAMPLEID:example-session",
    "arn": "arn:aws:sts::123456789012:assumed-role/example-role/example-session",
    "accountId": "123456789012",
    "accessKeyId": "ASIAIOSFODNN7EXAMPLE",
    "sessionContext": {
      "sessionIssuer": {
        "type": "Role",
        "principalId": "AROAEXAMPLEID",
        "arn": "arn:aws:iam::123456789012:role/example-role",
        "accountId": "123456789012",
        "userName": "example-role"
      },
      "attributes": {
        "creationDate": "2026-06-10T20:28:43Z",
        "mfaAuthenticated": "false"
      }
    }
  },
  "eventTime": "2026-06-10T20:28:56Z",
  "eventSource": "acm.amazonaws.com",
  "eventName": "ListAcmeEndpoints",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "192.0.2.0",
  "userAgent": "aws-cli/2.0",
  "requestParameters": null,
  "responseElements": null,
  "requestID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE33333",
  "eventID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE44444",
  "readOnly": true,
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "123456789012",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "acm-acme.us-east-1.api.aws"
  }
}

Lista de los enlaces de cuentas externas de ACME (ListAcmeExternalAccountBindings)

El siguiente CloudTrail ejemplo muestra una entrada de registro para la ListAcmeExternalAccountBindings operación.

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "AssumedRole",
    "principalId": "AROAEXAMPLEID:example-session",
    "arn": "arn:aws:sts::123456789012:assumed-role/example-role/example-session",
    "accountId": "123456789012",
    "accessKeyId": "ASIAIOSFODNN7EXAMPLE",
    "sessionContext": {
      "sessionIssuer": {
        "type": "Role",
        "principalId": "AROAEXAMPLEID",
        "arn": "arn:aws:iam::123456789012:role/example-role",
        "accountId": "123456789012",
        "userName": "example-role"
      },
      "attributes": {
        "creationDate": "2026-06-10T20:28:43Z",
        "mfaAuthenticated": "false"
      }
    }
  },
  "eventTime": "2026-06-10T20:29:15Z",
  "eventSource": "acm.amazonaws.com",
  "eventName": "ListAcmeExternalAccountBindings",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "192.0.2.0",
  "userAgent": "aws-cli/2.0",
  "requestParameters": {
    "acmeEndpointArn": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111"
  },
  "responseElements": null,
  "requestID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE33333",
  "eventID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE44444",
  "readOnly": true,
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::CertificateManager::AcmeEndpoint",
      "ARN": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111"
    }
  ],
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "123456789012",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "acm-acme.us-east-1.api.aws"
  }
}

Listado de certificados (ListCertificates)

El siguiente CloudTrail ejemplo muestra los resultados de una llamada a la ListCertificatesAPI.

nota

El CloudTrail registro de la ListCertificates operación no muestra los certificados de ACM. Puede ver la lista de certificados mediante la consola AWS Command Line Interface, la o la ListCertificatesAPI. 

{
   "Records":[
      {
         "eventVersion":"1.04",
         "userIdentity":{
            "type":"IAMUser",
            "principalId":"AIDACKCEVSQ6C2EXAMPLE",
            "arn":"arn:aws:iam::123456789012:user/Alice",
            "accountId":"123456789012",
            "accessKeyId":"AKIAIOSFODNN7EXAMPLE",
            "userName":"Alice"
         },
         "eventTime":"2016-03-18T00:00:43Z",
         "eventSource":"acm.amazonaws.com",
         "eventName":"ListCertificates",
         "awsRegion":"us-east-1",
         "sourceIPAddress":"192.0.2.0",
         "userAgent":"aws-cli/1.9.15",
         "requestParameters":{
            "maxItems":1000,
            "certificateStatuses":[
               "ISSUED"
            ]
         },
         "responseElements":null,
         "requestID":"74c99844-ec9c-11e5-ac34-d1e4dfe1a11b",
         "eventID":"cdfe1051-88aa-4aa3-8c33-a325270bff21",
         "eventType":"AwsApiCall",
         "recipientAccountId":"123456789012"
      }
   ]
}

Listar las etiquetas de un certificado (ListTagsForCertificate)

El siguiente CloudTrail ejemplo muestra los resultados de una llamada a la ListTagsForCertificateAPI.

nota

El CloudTrail registro de la ListTagsForCertificate operación no muestra tus etiquetas. Puede ver la lista de etiquetas mediante la consola AWS Command Line Interface, la o la ListTagsForCertificateAPI. 

{
   "Records":[
      {
         "eventVersion":"1.04",
         "userIdentity":{
            "type":"IAMUser",
            "principalId":"AIDACKCEVSQ6C2EXAMPLE",
            "arn":"arn:aws:iam::123456789012:user/Alice",
            "accountId":"123456789012",
            "accessKeyId":"AKIAIOSFODNN7EXAMPLE",
            "userName":"Alice"
         },
         "eventTime":"2016-04-06T13:30:11Z",
         "eventSource":"acm.amazonaws.com",
         "eventName":"ListTagsForCertificate",
         "awsRegion":"us-east-1",
         "sourceIPAddress":"192.0.2.0",
         "userAgent":"aws-cli/1.10.16",
         "requestParameters":{
            "certificateArn":"arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012"
         },
         "responseElements":null,
         "requestID":"b010767f-fbfb-11e5-b596-79e9a97a2544",
         "eventID":"32181be6-a4a0-48d3-8014-c0d972b5163b",
         "eventType":"AwsApiCall",
         "recipientAccountId":"123456789012"
      }
   ]
}

Listar las etiquetas de un recurso (ListTagsForResource)

En el siguiente ejemplo, se muestra una entrada de CloudTrail registro para la ListTagsForResourceAPI.

El CloudTrail registro de la ListTagsForResource operación no muestra etiquetas en los elementos de respuesta.

{
         "eventVersion":"1.04",
         "userIdentity":{
            "type":"IAMUser",
            "principalId":"AIDACKCEVSQ6C2EXAMPLE",
            "arn":"arn:aws:iam::123456789012:user/Alice",
            "accountId":"123456789012",
            "accessKeyId":"AKIAIOSFODNN7EXAMPLE",
            "userName":"Alice"
         },
         "eventTime":"2026-01-15T20:43:00Z",
         "eventSource":"acm.amazonaws.com",
         "eventName":"ListTagsForResource",
         "awsRegion":"us-east-1",
         "sourceIPAddress":"192.0.2.0",
         "userAgent":"aws-cli/2.0",
         "requestParameters":{
            "resourceArn":"arn:aws:acm:us-east-1:123456789012:acme-endpoint/ep-abc123"
         },
         "responseElements":null,
         "requestID":"fedcba98-7654-3210-fedc-ba9876543212",
         "eventID":"12345678-1234-1234-1234-123456789014",
         "eventType":"AwsApiCall",
         "recipientAccountId":"123456789012"
}

Administrar una cuenta ACME (ManageAccount)

El siguiente CloudTrail ejemplo muestra una entrada de registro para la ManageAccount operación.

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "Unknown",
    "principalId": "anonymous",
    "arn": "anonymous",
    "accountId": "123456789012",
    "userName": "anonymous"
  },
  "eventTime": "2026-06-10T20:30:40Z",
  "eventSource": "acm-acme.amazonaws.com",
  "eventName": "ManageAccount",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "192.0.2.0",
  "userAgent": "aws-cli/2.0",
  "requestParameters": {
    "serverUuid": "a1b2c3d4-5678-90ab-cdef-EXAMPLE11111",
    "accountId": "a1b2c3d4-5678-90ab-cdef-EXAMPLE22222"
  },
  "responseElements": {
    "location": "https://acm-acme-enroll.us-east-1.api.aws/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111/acct/a1b2c3d4-5678-90ab-cdef-EXAMPLE22222",
    "status": "valid",
    "contact": "HIDDEN_DUE_TO_SECURITY_REASONS",
    "orders": "https://acm-acme-enroll.us-east-1.api.aws/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111/acct/a1b2c3d4-5678-90ab-cdef-EXAMPLE22222/orders"
  },
  "requestID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE33333",
  "eventID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE44444",
  "readOnly": false,
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::CertificateManager::AcmeEndpoint",
      "ARN": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111"
    }
  ],
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "123456789012",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "acm-acme-enroll.us-east-1.api.aws"
  }
}

Registrar una cuenta ACME (NewAccount)

El siguiente CloudTrail ejemplo muestra una entrada de registro para la NewAccount operación.

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "Unknown",
    "principalId": "anonymous",
    "arn": "anonymous",
    "accountId": "123456789012",
    "userName": "anonymous"
  },
  "eventTime": "2026-06-10T20:30:39Z",
  "eventSource": "acm-acme.amazonaws.com",
  "eventName": "NewAccount",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "192.0.2.0",
  "userAgent": "aws-cli/2.0",
  "requestParameters": {
    "serverUuid": "a1b2c3d4-5678-90ab-cdef-EXAMPLE11111",
    "contact": "HIDDEN_DUE_TO_SECURITY_REASONS",
    "externalAccountBinding": {
      "jwsProtected": "EXAMPLE",
      "payload": "EXAMPLE",
      "signature": "EXAMPLE"
    }
  },
  "responseElements": {
    "location": "https://acm-acme-enroll.us-east-1.api.aws/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111/acct/a1b2c3d4-5678-90ab-cdef-EXAMPLE22222",
    "status": "valid",
    "contact": "HIDDEN_DUE_TO_SECURITY_REASONS",
    "orders": "https://acm-acme-enroll.us-east-1.api.aws/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111/acct/a1b2c3d4-5678-90ab-cdef-EXAMPLE22222/orders",
    "externalAccountBinding": {
      "jwsProtected": "EXAMPLE",
      "payload": "EXAMPLE",
      "signature": "EXAMPLE"
    },
    "statusCode": 201
  },
  "requestID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE33333",
  "eventID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE44444",
  "readOnly": false,
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::CertificateManager::AcmeEndpoint",
      "ARN": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111"
    }
  ],
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "123456789012",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "acm-acme-enroll.us-east-1.api.aws"
  }
}

Eliminar etiquetas de un certificado (RemoveTagsFromCertificate)

El siguiente CloudTrail ejemplo muestra los resultados de una llamada a la RemoveTagsFromCertificateAPI. 

{
   "Records":[
      {
         "eventVersion":"1.04",
         "userIdentity":{
            "type":"IAMUser",
            "principalId":"AIDACKCEVSQ6C2EXAMPLE",
            "arn":"arn:aws:iam::123456789012:user/Alice",
            "accountId":"123456789012",
            "accessKeyId":"AKIAIOSFODNN7EXAMPLE",
            "userName":"Alice"
         },
         "eventTime":"2016-04-06T14:10:01Z",
         "eventSource":"acm.amazonaws.com",
         "eventName":"RemoveTagsFromCertificate",
         "awsRegion":"us-east-1",
         "sourceIPAddress":"192.0.2.0",
         "userAgent":"aws-cli/1.10.16",
         "requestParameters":{
            "certificateArn":"arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012",
            "tags":[
               {
                  "value":"Bob",
                  "key":"Admin"
               }
            ]
         },
         "responseElements":null,
         "requestID":"40ded461-fc01-11e5-a747-85804766d6c9",
         "eventID":"0cfa142e-ef74-4b21-9515-47197780c424",
         "eventType":"AwsApiCall",
         "recipientAccountId":"123456789012"
      }
   ]
}

Solicitar un certificado (RequestCertificate)

El siguiente CloudTrail ejemplo muestra los resultados de una llamada a la RequestCertificateAPI. 

{
   "Records":[
      {
         "eventVersion":"1.04",
         "userIdentity":{
            "type":"IAMUser",
            "principalId":"AIDACKCEVSQ6C2EXAMPLE",
            "arn":"arn:aws:iam::123456789012:user/Alice",
            "accountId":"123456789012",
            "accessKeyId":"AKIAIOSFODNN7EXAMPLE",
            "userName":"Alice"
         },
         "eventTime":"2016-03-18T00:00:49Z",
         "eventSource":"acm.amazonaws.com",
         "eventName":"RequestCertificate",
         "awsRegion":"us-east-1",
         "sourceIPAddress":"192.0.2.0",
         "userAgent":"aws-cli/1.9.15",
         "requestParameters":{
            "domainName":"example.com",
            "validationMethod": "DNS",
            "idempotencyToken":"8186023d89681c3ad5",
            "options": {
            "export": "ENABLED"
        },
        "keyAlgorithm": "RSA_2048"
         },
         "responseElements":{
            "certificateArn":"arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012"
         },
         "requestID":"77dacef3-ec9c-11e5-ac34-d1e4dfe1a11b",
         "eventID":"a4954cdb-8f38-44c7-8927-a38ad4be3ac8",
         "eventType":"AwsApiCall",
         "tlsDetails": {
           "tlsVersion": "TLSv1.3",
           "cipherSuite": "TLS_AES_128_GCM_SHA256",
           "clientProvidedHostHeader": "acm.us-east-1.amazonaws.com"
          },
         "recipientAccountId":"123456789012"
      }
   ]
}

Reenviar el correo electrónico de validación (ResendValidationEmail)

El siguiente CloudTrail ejemplo muestra los resultados de una llamada a la ResendValidationEmailAPI. 

{
   "Records":[
      {
         "eventVersion":"1.04",
         "userIdentity":{
            "type":"IAMUser",
            "principalId":"AIDACKCEVSQ6C2EXAMPLE",
            "arn":"arn:aws:iam::123456789012:user/Alice",
            "accountId":"123456789012",
            "accessKeyId":"AKIAIOSFODNN7EXAMPLE",
            "userName":"Alice"
         },
         "eventTime":"2016-03-17T23:58:25Z",
         "eventSource":"acm.amazonaws.com",
         "eventName":"ResendValidationEmail",
         "awsRegion":"us-east-1",
         "sourceIPAddress":"192.0.2.0",
         "userAgent":"aws-cli/1.9.15",
         "requestParameters":{
            "domain":"example.com",
            "certificateArn":"arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012",
            "validationDomain":"example.com"
         },
         "responseElements":null,
         "requestID":"23760b88-ec9c-11e5-b6f4-cb861a6f0a28",
         "eventID":"41c11b06-ca91-4c1c-8c61-af349ea8bab8",
         "eventType":"AwsApiCall",
         "recipientAccountId":"123456789012"
      }
   ]
}

Revocar una cuenta ACME (RevokeAcmeAccount)

El siguiente CloudTrail ejemplo muestra una entrada de registro para la RevokeAcmeAccount operación.

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "AssumedRole",
    "principalId": "AROAEXAMPLEID:example-session",
    "arn": "arn:aws:sts::123456789012:assumed-role/example-role/example-session",
    "accountId": "123456789012",
    "accessKeyId": "ASIAIOSFODNN7EXAMPLE",
    "sessionContext": {
      "sessionIssuer": {
        "type": "Role",
        "principalId": "AROAEXAMPLEID",
        "arn": "arn:aws:iam::123456789012:role/example-role",
        "accountId": "123456789012",
        "userName": "example-role"
      },
      "attributes": {
        "creationDate": "2026-06-10T20:28:43Z",
        "mfaAuthenticated": "false"
      }
    }
  },
  "eventTime": "2026-06-10T20:28:46Z",
  "eventSource": "acm.amazonaws.com",
  "eventName": "RevokeAcmeAccount",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "192.0.2.0",
  "userAgent": "aws-cli/2.0",
  "requestParameters": {
    "acmeEndpointArn": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111",
    "accountUrl": "https://acm-acme-enroll.us-east-1.api.aws/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111/acct/a1b2c3d4-5678-90ab-cdef-EXAMPLE22222"
  },
  "responseElements": null,
  "requestID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE33333",
  "eventID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE44444",
  "readOnly": false,
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::CertificateManager::AcmeEndpoint",
      "ARN": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111"
    }
  ],
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "123456789012",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "acm-acme.us-east-1.api.aws"
  }
}

Revocar un enlace de cuenta externa de ACME (RevokeAcmeExternalAccountBinding)

El siguiente CloudTrail ejemplo muestra una entrada de registro para la RevokeAcmeExternalAccountBinding operación.

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "AssumedRole",
    "principalId": "AROAEXAMPLEID:example-session",
    "arn": "arn:aws:sts::123456789012:assumed-role/example-role/example-session",
    "accountId": "123456789012",
    "accessKeyId": "ASIAIOSFODNN7EXAMPLE",
    "sessionContext": {
      "sessionIssuer": {
        "type": "Role",
        "principalId": "AROAEXAMPLEID",
        "arn": "arn:aws:iam::123456789012:role/example-role",
        "accountId": "123456789012",
        "userName": "example-role"
      },
      "attributes": {
        "creationDate": "2026-06-10T20:28:43Z",
        "mfaAuthenticated": "false"
      }
    }
  },
  "eventTime": "2026-06-10T20:28:56Z",
  "eventSource": "acm.amazonaws.com",
  "eventName": "RevokeAcmeExternalAccountBinding",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "192.0.2.0",
  "userAgent": "aws-cli/2.0",
  "requestParameters": {
    "acmeExternalAccountBindingArn": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111/acme-external-account-binding/a1b2c3d4-5678-90ab-cdef-EXAMPLE22222"
  },
  "responseElements": null,
  "requestID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE33333",
  "eventID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE44444",
  "readOnly": false,
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::CertificateManager::AcmeExternalAccountBinding",
      "ARN": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111/acme-external-account-binding/a1b2c3d4-5678-90ab-cdef-EXAMPLE22222"
    }
  ],
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "123456789012",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "acm-acme.us-east-1.api.aws"
  }
}

Revocar un certificado (RevokeCertificate)

El siguiente CloudTrail ejemplo muestra los resultados de una llamada a la RevokeCertificateAPI. 

{
    "eventVersion": "1.11",
    "userIdentity": {
        "type": "AssumedRole",
        "principalId": "AIDACKCEVSQ6C2EXAMPLE:Role-Session-Name",
        "arn": arn:aws:sts::111122223333:assumed-role/Role-Name/Role-Session-Name",
        "accountId": "123456789012",
        "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
        "sessionContext": {
            "sessionIssuer": {
                "type": "Role",
                "principalId": "AIDACKCEVSQ6C2EXAMPLE",
                "arn": "arn:aws:iam::123456789012:role/Admin",
                "accountId": "123456789012",
                "userName": "Admin"
            },
            "attributes": {
                "creationDate": "2016-01-01T19:35:52Z",
                "mfaAuthenticated": "false"
            }
        }
    },
    "eventTime":"2016-01-01T21:11:45Z",
    "eventSource": "acm.amazonaws.com",
    "eventName": "RevokeCertificate",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "192.0.2.0",
    "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0",
    "requestParameters": {
        "certificateArn": "arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012",
        "revocationReason": "UNSPECIFIED"
    },
    "responseElements": {
        "certificateArn": "arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012"
    },
    "requestID": "01234567-89ab-cdef-0123-456789abcdef",
    "eventID": "01234567-89ab-cdef-0123-456789abcdef",
    "readOnly": false,
    "eventType": "AwsApiCall",
    "managementEvent": true,
    "recipientAccountId": "123456789012",
    "eventCategory": "Management",
    "tlsDetails": {
        "tlsVersion": "TLSv1.3",
        "cipherSuite": "TLS_AES_128_GCM_SHA256",
        "clientProvidedHostHeader": "acm.us-east-1.amazonaws.com"
    },
    "sessionCredentialFromConsole": "true"
}

El siguiente CloudTrail ejemplo muestra los resultados de una llamada a la SearchCertificatesAPI. 

{

   "Records":[
      {
         "eventVersion":"1.04",
         "userIdentity":{
            "type":"IAMUser",
            "principalId":"AIDACKCEVSQ6C2EXAMPLE",
            "arn":"arn:aws:iam::123456789012:user/Alice",
            "accountId":"123456789012",
            "accessKeyId":"AKIAIOSFODNN7EXAMPLE",
            "userName":"Alice"
         },
         "eventTime":"2016-04-06T13:53:53Z",
         "eventSource":"acm.amazonaws.com",
         "eventName":"SearchCertificates",
         "awsRegion":"us-east-1",
         "sourceIPAddress":"192.0.2.0",
         "userAgent":"aws-cli/1.10.16",
         "readOnly":true,
         "requestParameters":{
            "maxResults":10,
            "sortBy":"CREATED_AT",
            "sortOrder":"DESCENDING"
         },
         "responseElements":null,
         "requestID":"01234567-89ab-cdef-0123-456789abcdef",
         "eventID":"01234567-89ab-cdef-0123-456789abcdef",
         "eventType":"AwsApiCall",
         "recipientAccountId":"123456789012"
      }
   ]
}

Etiquetar un recurso (TagResource)

En el siguiente ejemplo, se muestra una entrada de CloudTrail registro para la TagResourceAPI. 

{
         "eventVersion":"1.04",
         "userIdentity":{
            "type":"IAMUser",
            "principalId":"AIDACKCEVSQ6C2EXAMPLE",
            "arn":"arn:aws:iam::123456789012:user/Alice",
            "accountId":"123456789012",
            "accessKeyId":"AKIAIOSFODNN7EXAMPLE",
            "userName":"Alice"
         },
         "eventTime":"2026-01-15T20:41:00Z",
         "eventSource":"acm.amazonaws.com",
         "eventName":"TagResource",
         "awsRegion":"us-east-1",
         "sourceIPAddress":"192.0.2.0",
         "userAgent":"aws-cli/2.0",
         "requestParameters":{
            "resourceArn":"arn:aws:acm:us-east-1:123456789012:acme-endpoint/ep-abc123",
            "tags":[
               {
                  "key":"Environment",
                  "value":"Production"
               }
            ]
         },
         "responseElements":null,
         "requestID":"fedcba98-7654-3210-fedc-ba9876543210",
         "eventID":"12345678-1234-1234-1234-123456789012",
         "eventType":"AwsApiCall",
         "recipientAccountId":"123456789012"
}

Eliminar etiquetas de un recurso (UntagResource)

En el siguiente ejemplo, se muestra una entrada de CloudTrail registro para la UntagResourceAPI. 

{
         "eventVersion":"1.04",
         "userIdentity":{
            "type":"IAMUser",
            "principalId":"AIDACKCEVSQ6C2EXAMPLE",
            "arn":"arn:aws:iam::123456789012:user/Alice",
            "accountId":"123456789012",
            "accessKeyId":"AKIAIOSFODNN7EXAMPLE",
            "userName":"Alice"
         },
         "eventTime":"2026-01-15T20:42:00Z",
         "eventSource":"acm.amazonaws.com",
         "eventName":"UntagResource",
         "awsRegion":"us-east-1",
         "sourceIPAddress":"192.0.2.0",
         "userAgent":"aws-cli/2.0",
         "requestParameters":{
            "resourceArn":"arn:aws:acm:us-east-1:123456789012:acme-endpoint/ep-abc123",
            "tagKeys":["Environment"]
         },
         "responseElements":null,
         "requestID":"fedcba98-7654-3210-fedc-ba9876543211",
         "eventID":"12345678-1234-1234-1234-123456789013",
         "eventType":"AwsApiCall",
         "recipientAccountId":"123456789012"
}

Actualización de una validación de dominio ACME (UpdateAcmeDomainValidation)

El siguiente CloudTrail ejemplo muestra una entrada de registro para la UpdateAcmeDomainValidation operación.

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "AssumedRole",
    "principalId": "AROAEXAMPLEID:example-session",
    "arn": "arn:aws:sts::123456789012:assumed-role/example-role/example-session",
    "accountId": "123456789012",
    "accessKeyId": "ASIAIOSFODNN7EXAMPLE",
    "sessionContext": {
      "sessionIssuer": {
        "type": "Role",
        "principalId": "AROAEXAMPLEID",
        "arn": "arn:aws:iam::123456789012:role/example-role",
        "accountId": "123456789012",
        "userName": "example-role"
      },
      "attributes": {
        "creationDate": "2026-06-10T20:28:43Z",
        "mfaAuthenticated": "false"
      }
    }
  },
  "eventTime": "2026-06-10T20:29:46Z",
  "eventSource": "acm.amazonaws.com",
  "eventName": "UpdateAcmeDomainValidation",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "192.0.2.0",
  "userAgent": "aws-cli/2.0",
  "requestParameters": {
    "acmeDomainValidationArn": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111/acme-domain-validation/a1b2c3d4-5678-90ab-cdef-EXAMPLE22222"
  },
  "responseElements": null,
  "requestID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE33333",
  "eventID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE44444",
  "readOnly": false,
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::CertificateManager::AcmeDomainValidation",
      "ARN": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111/acme-domain-validation/a1b2c3d4-5678-90ab-cdef-EXAMPLE22222"
    }
  ],
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "123456789012",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "acm-acme.us-east-1.api.aws"
  }
}

Actualización de un punto final ACME (UpdateAcmeEndpoint)

El siguiente CloudTrail ejemplo muestra una entrada de registro para la UpdateAcmeEndpoint operación.

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "AssumedRole",
    "principalId": "AROAEXAMPLEID:example-session",
    "arn": "arn:aws:sts::123456789012:assumed-role/example-role/example-session",
    "accountId": "123456789012",
    "accessKeyId": "ASIAIOSFODNN7EXAMPLE",
    "sessionContext": {
      "sessionIssuer": {
        "type": "Role",
        "principalId": "AROAEXAMPLEID",
        "arn": "arn:aws:iam::123456789012:role/example-role",
        "accountId": "123456789012",
        "userName": "example-role"
      },
      "attributes": {
        "creationDate": "2026-06-10T20:28:43Z",
        "mfaAuthenticated": "false"
      }
    }
  },
  "eventTime": "2026-06-10T20:28:56Z",
  "eventSource": "acm.amazonaws.com",
  "eventName": "UpdateAcmeEndpoint",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "192.0.2.0",
  "userAgent": "aws-cli/2.0",
  "requestParameters": {
    "acmeEndpointArn": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111"
  },
  "responseElements": null,
  "requestID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE33333",
  "eventID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE44444",
  "readOnly": false,
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::CertificateManager::AcmeEndpoint",
      "ARN": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111"
    }
  ],
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "123456789012",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "acm-acme.us-east-1.api.aws"
  }
}

Eventos de datos

ACM registra las siguientes operaciones del protocolo ACME como eventos de CloudTrail datos. A diferencia de los eventos de administración, los eventos de datos no se registran de forma predeterminada. Para registrarlos, configure el registro de eventos de datos en su CloudTrail almacén de datos de rutas o eventos.

Finalizar un pedido () FinalizeOrder

El siguiente CloudTrail ejemplo muestra una entrada de registro de eventos de datos para la FinalizeOrder operación.

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "AssumedRole",
    "principalId": "AROAEXAMPLEID:example-session",
    "arn": "arn:aws:sts::123456789012:assumed-role/example-role/example-session",
    "accountId": "123456789012",
    "accessKeyId": "ASIAIOSFODNN7EXAMPLE",
    "sessionContext": {
      "sessionIssuer": {
        "type": "Role",
        "principalId": "AROAEXAMPLEID",
        "arn": "arn:aws:iam::123456789012:role/example-role",
        "accountId": "123456789012",
        "userName": "example-role"
      },
      "attributes": {
        "creationDate": "2026-06-10T20:29:27Z",
        "mfaAuthenticated": "false"
      },
      "sourceIdentity": "acm-acme-a1b2c3d4-5678-90ab-cdef-EXAMPLE11111"
    },
    "invokedBy": "acm-acme.amazonaws.com"
  },
  "eventTime": "2026-06-10T20:29:27Z",
  "eventSource": "acm-acme.amazonaws.com",
  "eventName": "FinalizeOrder",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "acm-acme.amazonaws.com",
  "userAgent": "acm-acme.amazonaws.com",
  "requestParameters": {
    "serverUuid": "a1b2c3d4-5678-90ab-cdef-EXAMPLE11111",
    "orderId": "a1b2c3d4-5678-90ab-cdef-EXAMPLE22222",
    "csr": "EXAMPLE"
  },
  "responseElements": {
    "status": "processing",
    "expires": "2026-06-17T20:29:27Z",
    "identifiers": [
      {
        "type": "dns",
        "value": "example.example.com"
      }
    ],
    "authorizations": [
      "https://acm-acme-enroll.us-east-1.api.aws/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111/authz/a1b2c3d4-5678-90ab-cdef-EXAMPLE33333"
    ],
    "finalize": "https://acm-acme-enroll.us-east-1.api.aws/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111/order/a1b2c3d4-5678-90ab-cdef-EXAMPLE22222/finalize",
    "location": "https://acm-acme-enroll.us-east-1.api.aws/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111/order/a1b2c3d4-5678-90ab-cdef-EXAMPLE22222",
    "statusCode": 200
  },
  "requestID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE44444",
  "eventID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE55555",
  "readOnly": false,
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::CertificateManager::AcmeEndpoint",
      "ARN": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE66666"
    }
  ],
  "eventType": "AwsApiCall",
  "managementEvent": false,
  "recipientAccountId": "123456789012",
  "eventCategory": "Data"
}

Descargar un certificado (GetCertificate)

El siguiente CloudTrail ejemplo muestra una entrada de registro de eventos de datos para la GetCertificate operación.

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "Unknown",
    "principalId": "anonymous",
    "arn": "anonymous",
    "accountId": "123456789012",
    "userName": "anonymous"
  },
  "eventTime": "2026-06-10T20:29:56Z",
  "eventSource": "acm-acme.amazonaws.com",
  "eventName": "GetCertificate",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "192.0.2.0",
  "userAgent": "aws-cli/2.0",
  "requestParameters": {
    "serverUuid": "a1b2c3d4-5678-90ab-cdef-EXAMPLE11111",
    "certId": "a1b2c3d4-5678-90ab-cdef-EXAMPLE77777"
  },
  "responseElements": null,
  "requestID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE44444",
  "eventID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE55555",
  "readOnly": true,
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::CertificateManager::AcmeEndpoint",
      "ARN": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE66666"
    }
  ],
  "eventType": "AwsApiCall",
  "managementEvent": false,
  "recipientAccountId": "123456789012",
  "eventCategory": "Data",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "acm-acme-enroll.us-east-1.api.aws"
  }
}

Recuperando el directorio () GetDirectory

El siguiente CloudTrail ejemplo muestra una entrada de registro de eventos de datos para la GetDirectory operación.

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "Unknown",
    "principalId": "anonymous",
    "arn": "anonymous",
    "accountId": "123456789012",
    "userName": "anonymous"
  },
  "eventTime": "2026-06-10T20:30:39Z",
  "eventSource": "acm-acme.amazonaws.com",
  "eventName": "GetDirectory",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "192.0.2.0",
  "userAgent": "aws-cli/2.0",
  "requestParameters": {
    "serverUuid": "a1b2c3d4-5678-90ab-cdef-EXAMPLE11111"
  },
  "responseElements": null,
  "requestID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE44444",
  "eventID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE55555",
  "readOnly": true,
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::CertificateManager::AcmeEndpoint",
      "ARN": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE66666"
    }
  ],
  "eventType": "AwsApiCall",
  "managementEvent": false,
  "recipientAccountId": "123456789012",
  "eventCategory": "Data",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "acm-acme-enroll.us-east-1.api.aws"
  }
}

Recuperación de un pedido () GetOrder

El siguiente CloudTrail ejemplo muestra una entrada del registro de eventos de datos para la GetOrder operación.

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "Unknown",
    "principalId": "anonymous",
    "arn": "anonymous",
    "accountId": "123456789012",
    "userName": "anonymous"
  },
  "eventTime": "2026-06-10T20:30:38Z",
  "eventSource": "acm-acme.amazonaws.com",
  "eventName": "GetOrder",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "192.0.2.0",
  "userAgent": "aws-cli/2.0",
  "requestParameters": {
    "serverUuid": "a1b2c3d4-5678-90ab-cdef-EXAMPLE11111",
    "orderId": "a1b2c3d4-5678-90ab-cdef-EXAMPLE22222"
  },
  "responseElements": null,
  "requestID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE44444",
  "eventID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE55555",
  "readOnly": true,
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::CertificateManager::AcmeEndpoint",
      "ARN": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE66666"
    }
  ],
  "eventType": "AwsApiCall",
  "managementEvent": false,
  "recipientAccountId": "123456789012",
  "eventCategory": "Data",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "acm-acme-enroll.us-east-1.api.aws"
  }
}

Listar pedidos (ListOrders)

El siguiente CloudTrail ejemplo muestra una entrada de registro de eventos de datos para la ListOrders operación.

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "Unknown",
    "principalId": "anonymous",
    "arn": "anonymous",
    "accountId": "123456789012",
    "userName": "anonymous"
  },
  "eventTime": "2026-06-10T20:29:57Z",
  "eventSource": "acm-acme.amazonaws.com",
  "eventName": "ListOrders",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "192.0.2.0",
  "userAgent": "aws-cli/2.0",
  "requestParameters": {
    "serverUuid": "a1b2c3d4-5678-90ab-cdef-EXAMPLE11111",
    "accountId": "a1b2c3d4-5678-90ab-cdef-EXAMPLE88888"
  },
  "responseElements": null,
  "requestID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE44444",
  "eventID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE55555",
  "readOnly": true,
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::CertificateManager::AcmeEndpoint",
      "ARN": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE66666"
    }
  ],
  "eventType": "AwsApiCall",
  "managementEvent": false,
  "recipientAccountId": "123456789012",
  "eventCategory": "Data",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "acm-acme-enroll.us-east-1.api.aws"
  }
}

Administrar una autorización (ManageAuthorization)

El siguiente CloudTrail ejemplo muestra una entrada de registro de eventos de datos para la ManageAuthorization operación.

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "Unknown",
    "principalId": "anonymous",
    "arn": "anonymous",
    "accountId": "123456789012",
    "userName": "anonymous"
  },
  "eventTime": "2026-06-10T20:30:40Z",
  "eventSource": "acm-acme.amazonaws.com",
  "eventName": "ManageAuthorization",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "192.0.2.0",
  "userAgent": "aws-cli/2.0",
  "requestParameters": {
    "serverUuid": "a1b2c3d4-5678-90ab-cdef-EXAMPLE11111",
    "authorizationId": "a1b2c3d4-5678-90ab-cdef-EXAMPLE99999"
  },
  "responseElements": {
    "location": "https://acm-acme-enroll.us-east-1.api.aws/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111/authz/a1b2c3d4-5678-90ab-cdef-EXAMPLE99999",
    "status": "valid",
    "expires": "2026-06-17T20:30:40Z",
    "identifier": {
      "type": "dns",
      "value": "example.example.com"
    },
    "challenges": []
  },
  "requestID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE44444",
  "eventID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE55555",
  "readOnly": false,
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::CertificateManager::AcmeEndpoint",
      "ARN": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE66666"
    }
  ],
  "eventType": "AwsApiCall",
  "managementEvent": false,
  "recipientAccountId": "123456789012",
  "eventCategory": "Data",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "acm-acme-enroll.us-east-1.api.aws"
  }
}

Solicitar un nonce () NewNonce

El siguiente CloudTrail ejemplo muestra una entrada de registro de eventos de datos para la NewNonce operación.

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "Unknown",
    "principalId": "anonymous",
    "arn": "anonymous",
    "accountId": "123456789012",
    "userName": "anonymous"
  },
  "eventTime": "2026-06-10T20:30:39Z",
  "eventSource": "acm-acme.amazonaws.com",
  "eventName": "NewNonce",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "192.0.2.0",
  "userAgent": "aws-cli/2.0",
  "requestParameters": {
    "serverUuid": "a1b2c3d4-5678-90ab-cdef-EXAMPLE11111"
  },
  "responseElements": null,
  "requestID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE44444",
  "eventID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE55555",
  "readOnly": false,
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::CertificateManager::AcmeEndpoint",
      "ARN": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE66666"
    }
  ],
  "eventType": "AwsApiCall",
  "managementEvent": false,
  "recipientAccountId": "123456789012",
  "eventCategory": "Data",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "acm-acme-enroll.us-east-1.api.aws"
  }
}

Crear un pedido (NewOrder)

El siguiente CloudTrail ejemplo muestra una entrada de registro de eventos de datos para la NewOrder operación.

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "Unknown",
    "principalId": "anonymous",
    "arn": "anonymous",
    "accountId": "123456789012",
    "userName": "anonymous"
  },
  "eventTime": "2026-06-10T20:29:26Z",
  "eventSource": "acm-acme.amazonaws.com",
  "eventName": "NewOrder",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "192.0.2.0",
  "userAgent": "aws-cli/2.0",
  "requestParameters": {
    "serverUuid": "a1b2c3d4-5678-90ab-cdef-EXAMPLE11111",
    "identifiers": [
      {
        "type": "dns",
        "value": "example.example.com"
      }
    ]
  },
  "responseElements": {
    "status": "ready",
    "expires": "2026-06-17T20:29:26Z",
    "identifiers": [
      {
        "type": "dns",
        "value": "example.example.com"
      }
    ],
    "authorizations": [
      "https://acm-acme-enroll.us-east-1.api.aws/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111/authz/a1b2c3d4-5678-90ab-cdef-EXAMPLE33333"
    ],
    "finalize": "https://acm-acme-enroll.us-east-1.api.aws/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111/order/a1b2c3d4-5678-90ab-cdef-EXAMPLE22222/finalize",
    "location": "https://acm-acme-enroll.us-east-1.api.aws/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111/order/a1b2c3d4-5678-90ab-cdef-EXAMPLE22222",
    "statusCode": 201
  },
  "requestID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE44444",
  "eventID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE55555",
  "readOnly": false,
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::CertificateManager::AcmeEndpoint",
      "ARN": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE66666"
    }
  ],
  "eventType": "AwsApiCall",
  "managementEvent": false,
  "recipientAccountId": "123456789012",
  "eventCategory": "Data",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "acm-acme-enroll.us-east-1.api.aws"
  }
}

Revocar un certificado () RevokeCertificate

El siguiente CloudTrail ejemplo muestra una entrada de registro de eventos de datos para la RevokeCertificate operación.

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "AssumedRole",
    "principalId": "AROAEXAMPLEID:example-session",
    "arn": "arn:aws:sts::123456789012:assumed-role/example-role/example-session",
    "accountId": "123456789012",
    "accessKeyId": "ASIAIOSFODNN7EXAMPLE",
    "sessionContext": {
      "sessionIssuer": {
        "type": "Role",
        "principalId": "AROAEXAMPLEID",
        "arn": "arn:aws:iam::123456789012:role/example-role",
        "accountId": "123456789012",
        "userName": "example-role"
      },
      "attributes": {
        "creationDate": "2026-06-10T20:30:37Z",
        "mfaAuthenticated": "false"
      },
      "sourceIdentity": "acm-acme-a1b2c3d4-5678-90ab-cdef-EXAMPLE11111"
    },
    "invokedBy": "acm-acme.amazonaws.com"
  },
  "eventTime": "2026-06-10T20:30:37Z",
  "eventSource": "acm-acme.amazonaws.com",
  "eventName": "RevokeCertificate",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "acm-acme.amazonaws.com",
  "userAgent": "acm-acme.amazonaws.com",
  "requestParameters": {
    "serverUuid": "a1b2c3d4-5678-90ab-cdef-EXAMPLE11111",
    "certificate": "EXAMPLE"
  },
  "responseElements": null,
  "requestID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE44444",
  "eventID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE55555",
  "readOnly": false,
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::CertificateManager::AcmeEndpoint",
      "ARN": "arn:aws:acm:us-east-1:123456789012:acme-endpoint/a1b2c3d4-5678-90ab-cdef-EXAMPLE66666"
    }
  ],
  "eventType": "AwsApiCall",
  "managementEvent": false,
  "recipientAccountId": "123456789012",
  "eventCategory": "Data"
}