CloudTrail events Event history Trails Organization trails CloudTrail Lake and event data stores CloudTrail Insights Tags AWS Security Token Service and CloudTrail Global service events

CloudTrail concepts

This section summarizes basic concepts related to CloudTrail.

Concepts:

CloudTrail events
Event history
Trails
Organization trails
CloudTrail Lake and event data stores
CloudTrail Insights
Tags
AWS Security Token Service and CloudTrail
Global service events

CloudTrail events

An event in CloudTrail is the record of an activity in an AWS account. This activity can be an action taken by an IAM identity, or service that is monitorable by CloudTrail. CloudTrail events provide a history of both API and non-API account activity made through the AWS Management Console, AWS SDKs, command line tools, and other AWS services.

CloudTrail log files aren't an ordered stack trace of the public API calls, so events don't appear in any specific order.

CloudTrail logs four types of events:

Management events
Data events
Network activity events
Insights events

All event types use a CloudTrail JSON log format.

By default, trails and event data stores log management events, but not data or Insights events.

For information about how AWS services integrate with CloudTrail, see AWS service topics for CloudTrail.

Management events

Management events provide information about management operations that are performed on resources in your AWS account. These are also known as control plane operations.

Example management events include:

Configuring security (for example, AWS Identity and Access Management AttachRolePolicy API operations).
Registering devices (for example, Amazon EC2 CreateDefaultVpc API operations).
Configuring rules for routing data (for example, Amazon EC2 CreateSubnet API operations).
Setting up logging (for example, AWS CloudTrail CreateTrail API operations).

Management events can also include non-API events that occur in your account. For example, when a user signs in to your account, CloudTrail logs the ConsoleLogin event. For more information, see Non-API events captured by CloudTrail.

By default, CloudTrail trails and CloudTrail Lake event data stores log management events. For more information about logging management events, see Logging management events.

Data events

Data events provide information about the resource operations performed on or in a resource. These are also known as data plane operations. Data events are often high-volume activities.

Example data events include:

Amazon S3 object-level API activity (for example, GetObject, DeleteObject, and PutObject API operations) on objects in S3 buckets.
AWS Lambda function execution activity (the Invoke API).
CloudTrail PutAuditEvents activity on a CloudTrail Lake channel that is used to log events from outside AWS.
Amazon SNS Publish and PublishBatch API operations on topics.

The following table shows the resource types available for trails and event data stores. The Resource type (console) column shows the appropriate selection in the console. The resources.type value column shows the resources.type value that you would specify to include data events of that type in your trail or event data store using the AWS CLI or CloudTrail APIs.

For trails, you can use basic or advanced event selectors to log data events for Amazon S3 objects in general purpose buckets, Lambda functions, and DynamoDB tables (shown in the first three rows of the table). You can use only advanced event selectors to log the resource types shown in the remaining rows.

For event data stores, you can use only advanced event selectors to include data events.

Data events supported by AWS CloudTrail

AWS service	Description	Resource type (console)	resources.type value
Amazon RDS	Amazon RDS API activity on a DB Cluster.	RDS Data API - DB Cluster	`AWS::RDS::DBCluster`
Amazon S3	Amazon S3 object-level API activity (for example, `GetObject`, `DeleteObject`, and `PutObject` API operations) on objects in general purpose buckets.	S3	`AWS::S3::Object`
Amazon S3	Amazon S3 API activity on access points.	S3 Access Point	`AWS::S3::AccessPoint`
Amazon S3	Amazon S3 object-level API activity (for example, `GetObject`, `DeleteObject`, and `PutObject` API operations) on objects in directory buckets.	S3 Express	`AWS::S3Express::Object`
Amazon S3	Amazon S3 Object Lambda access points API activity, such as calls to `CompleteMultipartUpload` and `GetObject`.	S3 Object Lambda	`AWS::S3ObjectLambda::AccessPoint`
Amazon S3	Amazon FSx API activity on volumes.	FSx Volume	`AWS::FSx::Volume`
Amazon S3 Tables	Amazon S3 API activity on tables.	S3 table	`AWS::S3Tables::Table`
Amazon S3 Tables	Amazon S3 API activity on table buckets.	S3 table bucket	`AWS::S3Tables::TableBucket`
Amazon S3 Vectors	Amazon S3 API activity on vector buckets.	S3 vector bucket	`AWS::S3Vectors::VectorBucket`
Amazon S3 Vectors	Amazon S3 API activity on vector indexes.	S3 vector index	`AWS::S3Vectors::Index`
Amazon S3 on Outposts	Amazon S3 on Outposts object-level API activity.	S3 Outposts	`AWS::S3Outposts::Object`
Amazon SNS	Amazon SNS `Publish` API operations on platform endpoints.	SNS platform endpoint	`AWS::SNS::PlatformEndpoint`
Amazon SNS	Amazon SNS `Publish` and `PublishBatch` API operations on topics.	SNS topic	`AWS::SNS::Topic`
Amazon SQS	Amazon SQS API activity on messages.	SQS	`AWS::SQS::Queue`
Supply Chain	Supply Chain API activity on an instance.	Supply Chain	`AWS::SCN::Instance`
Amazon SWF	Amazon SWF API activity on domains.	SWF domain	`AWS::SWF::Domain`
AWS AppConfig	AWS AppConfig API activity for configuration operations such as calls to `StartConfigurationSession` and `GetLatestConfiguration`.	AWS AppConfig	`AWS::AppConfig::Configuration`
AWS AppSync	AWS AppSync API activity on AppSync GraphQL APIs.	AppSync GraphQL	`AWS::AppSync::GraphQLApi`
Amazon Aurora DSQL	Amazon Aurora DSQL API activity on cluster resources.	Amazon Aurora DSQL	`AWS::DSQL::Cluster`
AWS B2B Data Interchange	B2B Data Interchange API activity for Transformer operations such as calls to `GetTransformerJob` and `StartTransformerJob`.	B2B Data Interchange	`AWS::B2BI::Transformer`
AWS Backup	AWS Backup Search Data API activity on search jobs.	AWS Backup Search Data APIs	`AWS::Backup::SearchJob`
Amazon Bedrock	Amazon Bedrock API activity on an agent alias.	Bedrock agent alias	`AWS::Bedrock::AgentAlias`
Amazon Bedrock	Amazon Bedrock API activity on async invocations.	Bedrock async invoke	`AWS::Bedrock::AsyncInvoke`
Amazon Bedrock	Amazon Bedrock API activity on a flow alias.	Bedrock flow alias	`AWS::Bedrock::FlowAlias`
Amazon Bedrock	Amazon Bedrock API activity on guardrails.	Bedrock guardrail	`AWS::Bedrock::Guardrail`
Amazon Bedrock	Amazon Bedrock API activity on inline agents.	Bedrock Invoke Inline-Agent	`AWS::Bedrock::InlineAgent`
Amazon Bedrock	Amazon Bedrock API activity on a knowledge base.	Bedrock knowledge base	`AWS::Bedrock::KnowledgeBase`
Amazon Bedrock	Amazon Bedrock API activity on models.	Bedrock model	`AWS::Bedrock::Model`
Amazon Bedrock	Amazon Bedrock API activity on prompts.	Bedrock prompt	`AWS::Bedrock::PromptVersion`
Amazon Bedrock	Amazon Bedrock API activity on sessions.	Bedrock session	`AWS::Bedrock::Session`
Amazon Bedrock	Amazon Bedrock API activity on flow executions.	Bedrock flow execution	`AWS::Bedrock::FlowExecution`
Amazon Bedrock	Amazon Bedrock API activity on an automated reasoning policy.	Bedrock automated reasoning policy	`AWS::Bedrock::AutomatedReasoningPolicy`
Amazon Bedrock	Amazon Bedrock API activity on an automated reasoning policy version.	Bedrock automated reasoning policy version	`AWS::Bedrock::AutomatedReasoningPolicyVersion`
Amazon Bedrock	Amazon Bedrock data automation project API activity.	Bedrock Data Automation project	`AWS::Bedrock::DataAutomationProject`
Amazon Bedrock	Bedrock data automation invocation API activity.	Bedrock Data Automation invocation	`AWS::Bedrock::DataAutomationInvocation`
Amazon Bedrock	Amazon Bedrock data automation profile API activity.	Bedrock Data Automation profile	`AWS::Bedrock::DataAutomationProfile`
Amazon Bedrock	Amazon Bedrock blueprint API activity.	Bedrock blueprint	`AWS::Bedrock::Blueprint`
Amazon Bedrock	Amazon Bedrock Code-Interpreter API activity.	Bedrock-AgentCore Code-Interpreter	`AWS::BedrockAgentCore::CodeInterpreter`
Amazon Bedrock	Amazon Bedrock Browser API activity.	Bedrock-AgentCore Browser	`AWS::BedrockAgentCore::Browser`
Amazon Bedrock	Amazon Bedrock Workload Identity API activity.	Bedrock-AgentCore Workload Identity	`AWS::BedrockAgentCore::WorkloadIdentity`
Amazon Bedrock	Amazon Bedrock Workload Identity Directory API activity.	Bedrock-AgentCore Workload Identity Directory	`AWS::BedrockAgentCore::WorkloadIdentityDirectory`
Amazon Bedrock	Amazon Bedrock Token Vault API activity.	Bedrock-AgentCore Token Vault	`AWS::BedrockAgentCore::TokenVault`
Amazon Bedrock	Amazon Bedrock APIKey CredentialProvider API activity.	Bedrock-AgentCore APIKey CredentialProvider	`AWS::BedrockAgentCore::APIKeyCredentialProvider`
Amazon Bedrock	Amazon Bedrock Runtime API activity.	Bedrock-AgentCore Runtime	`AWS::BedrockAgentCore::Runtime`
Amazon Bedrock	Amazon Bedrock Runtime-Endpoint API activity.	Bedrock-AgentCore Runtime-Endpoint	`AWS::BedrockAgentCore::RuntimeEndpoint`
Amazon Bedrock	Amazon Bedrock Gateway API activity.	Bedrock-AgentCore Gateway	`AWS::BedrockAgentCore::Gateway`
Amazon Bedrock	Amazon Bedrock Memory API activity.	Bedrock-AgentCore Memory	`AWS::BedrockAgentCore::Memory`
Amazon Bedrock	Amazon Bedrock Oauth2 CredentialProvider API activity.	Bedrock-AgentCore Oauth2 CredentialProvider	`AWS::BedrockAgentCore::OAuth2CredentialProvider`
Amazon Bedrock	Amazon Bedrock Browser-Custom API activity.	Bedrock-AgentCore Browser-Custom	`AWS::BedrockAgentCore::BrowserCustom`
Amazon Bedrock	Amazon Bedrock Code-Interpreter-Custom API activity.	Bedrock-AgentCore Code-Interpreter-Custom	`AWS::BedrockAgentCore::CodeInterpreterCustom`
Amazon Bedrock	Amazon Bedrock Tool API activity.	Bedrock Tool	`AWS::Bedrock::Tool`
AWS Cloud Map	AWS Cloud Map API activity on a namespace.	AWS Cloud Map namespace	`AWS::ServiceDiscovery::Namespace`
AWS Cloud Map	AWS Cloud Map API activity on a service.	AWS Cloud Map service	`AWS::ServiceDiscovery::Service`
Amazon CloudFront	CloudFront API activity on a KeyValueStore.	CloudFront KeyValueStore	`AWS::CloudFront::KeyValueStore`
AWS CloudTrail	CloudTrail `PutAuditEvents` activity on a CloudTrail Lake channel that is used to log events from outside AWS.	CloudTrail channel	`AWS::CloudTrail::Channel`
Amazon CloudWatch	Amazon CloudWatch API activity on metrics.	CloudWatch metric	`AWS::CloudWatch::Metric`
Amazon CloudWatch Network Flow Monitor	Amazon CloudWatch Network Flow Monitor API activity on monitors.	Network Flow Monitor monitor	`AWS::NetworkFlowMonitor::Monitor`
Amazon CloudWatch Network Flow Monitor	Amazon CloudWatch Network Flow Monitor API activity on scopes.	Network Flow Monitor scope	`AWS::NetworkFlowMonitor::Scope`
Amazon CloudWatch RUM	Amazon CloudWatch RUM API activity on app monitors.	RUM app monitor	`AWS::RUM::AppMonitor`
Amazon CodeGuru Profiler	CodeGuru Profiler API activity on profiling groups.	CodeGuru Profiler profiling group	`AWS::CodeGuruProfiler::ProfilingGroup`
Amazon CodeWhisperer	Amazon CodeWhisperer API activity on a customization.	CodeWhisperer customization	`AWS::CodeWhisperer::Customization`
Amazon CodeWhisperer	Amazon CodeWhisperer API activity on a profile.	CodeWhisperer	`AWS::CodeWhisperer::Profile`
Amazon Cognito	Amazon Cognito API activity on Amazon Cognito identity pools.	Cognito Identity Pools	`AWS::Cognito::IdentityPool`
AWS Data Exchange	AWS Data Exchange API activity on assets.	Data Exchange asset	`AWS::DataExchange::Asset`
Amazon Data Firehose	Amazon Data Firehose delivery stream API activity.	Amazon Data Firehose	`AWS::KinesisFirehose::DeliveryStream`
AWS Deadline Cloud	Deadline Cloud API activity on fleets.	Deadline Cloud fleet	`AWS::Deadline::Fleet`
AWS Deadline Cloud	Deadline Cloud API activity on jobs.	Deadline Cloud job	`AWS::Deadline::Job`
AWS Deadline Cloud	Deadline Cloud API activity on queues.	Deadline Cloud queue	`AWS::Deadline::Queue`
AWS Deadline Cloud	Deadline Cloud API activity on workers.	Deadline Cloud worker	`AWS::Deadline::Worker`
Amazon DynamoDB	Amazon DynamoDB item-level API activity on tables (for example, `PutItem`, `DeleteItem`, and `UpdateItem` API operations). Note For tables with streams enabled, the `resources` field in the data event contains both `AWS::DynamoDB::Stream` and `AWS::DynamoDB::Table`. If you specify `AWS::DynamoDB::Table` for the `resources.type`, it will log both DynamoDB table and DynamoDB streams events by default. To exclude streams events, add a filter on the `eventName` field.	DynamoDB	`AWS::DynamoDB::Table`
Amazon DynamoDB	Amazon DynamoDB API activity on streams.	DynamoDB Streams	`AWS::DynamoDB::Stream`
Amazon Elastic Block Store	Amazon Elastic Block Store (EBS) direct APIs, such as `PutSnapshotBlock`, `GetSnapshotBlock`, and `ListChangedBlocks` on Amazon EBS snapshots.	Amazon EBS direct APIs	`AWS::EC2::Snapshot`
Amazon Elastic Compute Cloud	Amazon EC2 instance connect endpoint API activity.	EC2 instance connect endpoint	`AWS::EC2::InstanceConnectEndpoint`
Amazon Elastic Container Service	Amazon Elastic Container Service API activity on a container instance.	ECS container instance	`AWS::ECS::ContainerInstance`
Amazon Elastic Kubernetes Service	Amazon Elastic Kubernetes Service API activity on dashboards.	Amazon Elastic Kubernetes Service dashboard	`AWS::EKS::Dashboard`
Amazon EMR	Amazon EMR API activity on a write-ahead log workspace.	EMR write-ahead log workspace	`AWS::EMRWAL::Workspace`
AWS End User Messaging SMS	AWS End User Messaging SMS API activity on origination identities.	SMS Voice origination identity	`AWS::SMSVoice::OriginationIdentity`
AWS End User Messaging SMS	AWS End User Messaging SMS API activity on messages.	SMS Voice message	`AWS::SMSVoice::Message`
AWS End User Messaging Social	AWS End User Messaging Social API activity on phone number IDs.	Social-Messaging Phone Number Id	`AWS::SocialMessaging::PhoneNumberId`
AWS End User Messaging Social	AWS End User Messaging Social API activity on Waba IDs.	Social-Messaging Waba ID	`AWS::SocialMessaging::WabaId`
Amazon FinSpace	Amazon FinSpace API activity on environments.	FinSpace	`AWS::FinSpace::Environment`
Amazon GameLift Streams	Amazon GameLift Streams streaming API activity on applications.	GameLift Streams application	`AWS::GameLiftStreams::Application`
Amazon GameLift Streams	Amazon GameLift Streams streaming API activity on stream groups.	GameLift Streams stream group	`AWS::GameLiftStreams::StreamGroup`
AWS Glue	AWS Glue API activity on tables that were created by Lake Formation.	Lake Formation	`AWS::Glue::Table`
Amazon GuardDuty	Amazon GuardDuty API activity for a detector.	GuardDuty detector	`AWS::GuardDuty::Detector`
AWS HealthImaging	AWS HealthImaging API activity on data stores.	MedicalImaging data store	`AWS::MedicalImaging::Datastore`
AWS HealthImaging	AWS HealthImaging image set API activity.	MedicalImaging image set	`AWS::MedicalImaging::Imageset`
AWS IoT	AWS IoT API activity on certificates.	IoT certificate