Monitoring Amazon Quick using CloudTrail

Amazon Quick is integrated with AWS CloudTrail. This service provides a record of actions taken by a user, role, or an AWS service in Amazon Quick. CloudTrail captures API calls for Amazon Quick as events. The calls captured include some calls from the console and all code calls to API operations. If you create a trail, you can enable continuous delivery of CloudTrail events to an Amazon S3 bucket, including events for Amazon Quick. If you don't configure a trail, you can still view the most recent events in the CloudTrail console in Event history. Using the information collected by CloudTrail, you can determine who made a request to Amazon Quick and when. You can also identify the source IP address, the specific request, and other details.

Amazon Quick publishes operational metrics to CloudWatch, and you can create CloudWatch alarms on those metrics. For more information, see Creating alarms with the Amazon CloudWatch console. To alert on individual CloudTrail events, you can develop a custom solution that processes CloudTrail logs.

Amazon Quick service status can be viewed on the Service Health Dashboard.

By default, CloudTrail encrypts the log files it delivers to your bucket using Amazon S3-managed encryption keys (SSE-S3). For a directly manageable security layer, you can instead use AWS KMS–managed keys (SSE-KMS) for your CloudTrail log files. SSE-KMS encrypts the log files but not the digest files. Digest files are encrypted with Amazon S3-managed encryption keys (SSE-S3).

To learn more about CloudTrail, including how to configure and enable it, see the AWS CloudTrail User Guide.

Logging Amazon Quick operations with AWS CloudTrail

CloudTrail is enabled on your AWS account when you create the account. When supported event activity occurs in Amazon Quick, that activity is recorded in a CloudTrail event along with other AWS service events in Event history. You can view, search, and download recent events in your AWS account. For more information, see Viewing Events with CloudTrail Event History.

For an ongoing record of events in your AWS account, including events for Amazon Quick, create a trail. A trail enables CloudTrail to deliver log files to an Amazon S3 bucket. By default, when you create a trail in the console, the trail applies to all . The trail logs events from all Regions in the AWS partition and delivers the log files to the Amazon S3 bucket that you specify. Additionally, you can configure other AWS services to further analyze and act upon the event data collected in CloudTrail logs. For more information, see the following:

Amazon Quick supports logging the following actions as events in CloudTrail log files:

For more information on user identity, see the CloudTrail userIdentity Element.

By default, each Amazon Quick log entry contains the following information:

Some events include a userIdentity.invokedBy field set to quicksight.amazonaws.com. This indicates that the event was triggered by the Amazon Quick service on behalf of the account rather than by a direct user action. You can use this field to distinguish user-initiated operations from service-internal calls when analyzing your trail.

Discovering Amazon Quick events in your trail

Amazon Quick adds new event names as features launch and evolve. The non-API events listed below represent a subset of what your trail captures. To discover all Amazon Quick events in your account, query your trail for eventSource: quicksight.amazonaws.com and inspect the eventName values. Event names follow a consistent pattern: the operation name (such as CreateFlow or UpdateAgent) matches the feature it relates to.

Example: Amazon Quick log file entries

A trail is a configuration that enables delivery of events as log files to an Amazon S3 bucket that you specify. CloudTrail log files contain one or more log entries. An event represents a single request from any source and includes information about the requested action, the date and time of the action, request parameters, and so on. CloudTrail log files aren't an ordered stack trace of the public API calls, so they don't appear in any specific order.

The following example shows a CloudTrail log entry that demonstrates the BatchCreateUser action.

{ 
   "eventVersion":"1.11",
   "userIdentity":
	{ 
	   "type":"Root",
	   "principalId":"123456789012",
	   "arn":"arn:aws:iam::123456789012:root",
	   "accountId":"123456789012",
	   "userName":"test-username"
	},
	   "eventTime":"2017-04-19T03:16:13Z",
	   "eventSource":"quicksight.amazonaws.com",
	   "eventName":"BatchCreateUser",
	   "awsRegion":"us-west-2",
	   "requestParameters":null,
	   "responseElements":null,
	   "eventID":"e7d2382e-70a0-3fb7-9d41-a7a913422240",
	   "readOnly":false,
	   "eventType":"AwsServiceEvent",
	   "recipientAccountId":"123456789012",
	   "serviceEventDetails":
	   { 
		   "eventRequestDetails":
		   { 
				"users":
				{ 
					"test-user-11":
					{ 
						"role":"USER"
					},
					"test-user-22":
					{ 
						"role":"ADMIN"
					}
				}
			},
			"eventResponseDetails":
			{ 
			"validUsers":[ 
				],
			"InvalidUsers":[ 
				"test-user-11",
				"test-user-22"
				]
			}
	   }
   }
        

Logging Amazon Quick data events in CloudTrail

In addition to management events, Amazon Quick supports CloudTrail data events for selected resource types. Data events are off by default. Enable them through advanced event selectors on your trail.

The following Amazon Quick resource types support data events:

Enabling data events

Use advanced event selectors to enable data events. Include a management-events selector to retain management event logging:

aws cloudtrail put-event-selectors \
  --trail-name your-trail-name \
  --region us-east-1 \
  --advanced-event-selectors '[
    { "Name": "All management events",
      "FieldSelectors": [ { "Field": "eventCategory", "Equals": ["Management"] } ] },
    { "Name": "Quick action connector data events",
      "FieldSelectors": [
        { "Field": "eventCategory", "Equals": ["Data"] },
        { "Field": "resources.type", "Equals": ["AWS::Quicksight::ActionConnector"] } ] },
    { "Name": "Quick flow data events",
      "FieldSelectors": [
        { "Field": "eventCategory", "Equals": ["Data"] },
        { "Field": "resources.type", "Equals": ["AWS::QuickSight::Flow"] } ] },
    { "Name": "Quick flow session data events",
      "FieldSelectors": [
        { "Field": "eventCategory", "Equals": ["Data"] },
        { "Field": "resources.type", "Equals": ["AWS::QuickSight::FlowSession"] } ] }
  ]'

Add selectors for AWS::Quicksight::Companion, AWS::Quicksight::CompanionAccess, and AWS::QuickSight::Namespace if supported in your Region.

InvokeAction data event

When a user or flow invokes an action connector, CloudTrail records an InvokeAction data event. This event captures the following information:

The following example shows an InvokeAction data event for a successful email action:

{
    "eventVersion": "1.11",
    "userIdentity": {
        "type": "IdentityCenterUser",
        "accountId": "111122223333",
        "onBehalfOf": {
            "userId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
            "identityStoreArn": "arn:aws:identitystore::111122223333:identitystore/d-1234567890"
        }
    },
    "eventTime": "2026-08-19T20:26:36Z",
    "eventSource": "quicksight.amazonaws.com",
    "eventName": "InvokeAction",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "203.0.113.1",
    "requestParameters": {
        "awsAccountId": "111122223333",
        "actionConnectorId": "52bde8f0-3de5-4e3d-9283-222f81a9fc4f",
        "actionId": "SendUserEmail",
        "endUserArn": "arn:aws:quicksight:us-east-1:111122223333:user/default/johndoe"
    },
    "responseElements": {
        "invokeActionStatus": "SUCCESS",
        "invokeActionOutput": {
            "httpInvokeActionOutput": {
                "httpStatusCode": "200"
            }
        }
    },
    "readOnly": false,
    "resources": [
        {
            "accountId": "111122223333",
            "type": "AWS::Quicksight::ActionConnector",
            "ARN": "arn:aws:quicksight:us-east-1:111122223333:action-connector/52bde8f0-3de5-4e3d-9283-222f81a9fc4f"
        }
    ],
    "eventType": "AwsApiCall",
    "managementEvent": false,
    "eventCategory": "Data"
}

Tracking non-API events by using CloudTrail logs

The following non-API events are captured in your CloudTrail trail: