Amazon CloudTrail Event

Represents a CloudTrail event record containing information about an API call or account activity.

CloudTrailAuditComplianceGovernanceSecurity

Properties

Name	Type	Description
eventVersion	string	The version of the event log format.
userIdentity	object	Information about the user that made the request.
eventTime	string	The date and time the request was made.
eventSource	string	The service that the request was made to.
eventName	string	The requested action (API operation name).
awsRegion	string	The AWS Region that the request was made to.
sourceIPAddress	string	The IP address that the request was made from.
userAgent	string	The agent through which the request was made.
errorCode	string	The AWS service error if the request returned an error.
errorMessage	string	The error message if the request returned an error.
requestParameters	object	The parameters sent with the request.
responseElements	object	The response element for actions that make changes.
eventID	string	A GUID generated by CloudTrail to uniquely identify each event.
eventType	string	Identifies the type of event that generated the event record.
readOnly	boolean	Whether the event is a read-only event.
managementEvent	boolean	Whether the event is a management event.

View JSON Schema on GitHub

JSON Schema

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://api-evangelist.com/schemas/amazon/cloudtrail/event.json",
  "title": "Amazon CloudTrail Event",
  "description": "Represents a CloudTrail event record containing information about an API call or account activity.",
  "type": "object",
  "required": ["eventVersion", "eventSource", "eventName"],
  "properties": {
    "eventVersion": {
      "type": "string",
      "description": "The version of the event log format."
    },
    "userIdentity": {
      "type": "object",
      "description": "Information about the user that made the request.",
      "properties": {
        "type": {
          "type": "string",
          "description": "The type of the identity.",
          "enum": ["Root", "IAMUser", "AssumedRole", "FederatedUser", "AWSService", "AWSAccount"]
        },
        "principalId": {
          "type": "string",
          "description": "A unique identifier for the entity that made the call."
        },
        "arn": {
          "type": "string",
          "description": "The ARN of the principal that made the call."
        },
        "accountId": {
          "type": "string",
          "description": "The account that owns the entity that made the call."
        },
        "userName": {
          "type": "string",
          "description": "The friendly name of the identity."
        }
      }
    },
    "eventTime": {
      "type": "string",
      "format": "date-time",
      "description": "The date and time the request was made."
    },
    "eventSource": {
      "type": "string",
      "description": "The service that the request was made to."
    },
    "eventName": {
      "type": "string",
      "description": "The requested action (API operation name)."
    },
    "awsRegion": {
      "type": "string",
      "description": "The AWS Region that the request was made to."
    },
    "sourceIPAddress": {
      "type": "string",
      "description": "The IP address that the request was made from."
    },
    "userAgent": {
      "type": "string",
      "description": "The agent through which the request was made."
    },
    "errorCode": {
      "type": "string",
      "description": "The AWS service error if the request returned an error."
    },
    "errorMessage": {
      "type": "string",
      "description": "The error message if the request returned an error."
    },
    "requestParameters": {
      "type": "object",
      "description": "The parameters sent with the request.",
      "additionalProperties": true
    },
    "responseElements": {
      "type": "object",
      "description": "The response element for actions that make changes.",
      "additionalProperties": true
    },
    "eventID": {
      "type": "string",
      "description": "A GUID generated by CloudTrail to uniquely identify each event."
    },
    "eventType": {
      "type": "string",
      "description": "Identifies the type of event that generated the event record.",
      "enum": ["AwsApiCall", "AwsServiceEvent", "AwsConsoleAction", "AwsConsoleSignIn"]
    },
    "readOnly": {
      "type": "boolean",
      "description": "Whether the event is a read-only event."
    },
    "managementEvent": {
      "type": "boolean",
      "description": "Whether the event is a management event."
    }
  },
  "additionalProperties": true
}