---
cuppy_hub: aws
cuppy_path: reference/cloudtrail/errors.md
cuppy_section: docs
cuppy_doc: D51T-M3ED
cuppy_doc_uuid: 50320533-f841-47b0-aa4b-ac28d27d7a1c
cuppy_permalink: https://cuppy.io/aws/d/D51T-M3ED
cuppy_version: 2
cuppy_updated: 2026-10-23T16:16:52.575Z
cuppy_canonical: https://cuppy.io/aws/docs/reference/cloudtrail/errors
cuppy_mcp: https://cuppy.io/mcp
cuppy_body_sha256: aa6e6436fa2d50cc321a5155ab5468a698555a17eec7b08b3227bd5b7848f97c
# cuppy_body_sha256 is over the document body ALONE, excluding both generated blocks.
---


# CloudTrail errors

**Most CloudTrail problems are an event you can't find, not an exception.** Check the first table, then the exceptions. Field meanings of the records themselves are in `reference/cloudtrail/event-records.md`.

## Silent failure

| Symptom | Cause → fix | Check |
|---|---|---|
| A CloudTrail event isn't in Event history | Event history holds **management events** only, for 90 days, **per Region**. Data events (S3 objects, Lambda invokes) appear only if a trail or event data store records them. Delivery averages about 5 minutes | `aws cloudtrail lookup-events --region <r> --lookup-attributes AttributeKey=EventName,AttributeValue=<name> --start-time <t>` in the Region the call went to |
| A trail stopped delivering | Bucket policy, KMS key or SNS topic changed under it. CloudTrail **retries delivery for 30 days**, and those attempts incur charges | `aws cloudtrail get-trail-status --name <trail>` → `IsLogging`, `LatestDeliveryError`, `LatestCloudWatchLogsDeliveryError`, `LatestNotificationError` |

## Exceptions

The exception names come from the installed SDK. Causes for `LookupEvents` come from the CLI guide; the rest are the hub's reading of the names, so check the message text.

| Exception | Cause → fix | Check |
|---|---|---|
| `ThrottlingException` on `LookupEvents` | More than **2 requests per second** per account per Region. Slow down, or use a trail with Logs Insights, or Lake, for bulk searches | Count your calls per second; SDK retry logs |
| `InvalidLookupAttributesException` | A wrong `AttributeKey` (case-sensitive: `EventName`, `ResourceName`, …) or **more than one** attribute | Print the `--lookup-attributes` you sent |
| `InvalidTimeRangeException` | `StartTime` after `EndTime` | Print both, in UTC |
| `InvalidMaxResultsException`, `InvalidNextTokenException` | `MaxResults` outside 1–50, or a token reused with different parameters | Compare the parameters of the first and the paged call |
| `TrailNotFoundException`, `InvalidTrailNameException` | Wrong name or Region for the trail | `aws cloudtrail describe-trails --region <r>` → `Name`, `HomeRegion` |
| `InsufficientEncryptionPolicyException`, `KmsException`, `KmsKeyNotFoundException`, `KmsKeyDisabledException` | The trail's KMS key policy doesn't let CloudTrail use the key, or the key is unavailable | `aws cloudtrail get-trail --name <trail>` → `KmsKeyId`, then `aws kms describe-key` and `get-key-policy` (`reference/kms/key-policies-and-errors.md`) |
| `InvalidCloudWatchLogsLogGroupArnException`, `InvalidCloudWatchLogsRoleArnException`, `CloudWatchLogsDeliveryUnavailableException` | The trail-to-CloudWatch Logs setup is wrong: log group ARN, or the role CloudTrail assumes to write | `get-trail` → `CloudWatchLogsLogGroupArn`, `CloudWatchLogsRoleArn`; `aws iam get-role` → trust for `cloudtrail.amazonaws.com` |
| `InsufficientSnsTopicPolicyException` | The SNS topic policy doesn't allow CloudTrail to publish | `aws sns get-topic-attributes --topic-arn <t>` → `Policy` |
| `MaxConcurrentQueriesException`, `InvalidQueryStatementException`, `InactiveEventDataStoreException` | CloudTrail Lake: too many running queries, bad SQL, or a stopped event data store | `aws cloudtrail describe-query --query-id <q>` → `QueryStatus`, `ErrorMessage`; `aws cloudtrail get-event-data-store --event-data-store <arn>` → `Status` |

## When none of these fits

Collect the request ID from the SDK error and the exact message. For an access failure, read `reference/iam/errors.md`. To find who changed a trail, search Event history for `StopLogging`, `UpdateTrail` and `PutEventSelectors` (`guides/cloudtrail/find-who-did-what.md`).


---
<!-- cuppy -->
You are reading one file. The same content is free over MCP at https://cuppy.io/mcp with no signup: ranked search across all 131 documents in this hub, the merged view when you work in a layer, known workarounds matched to the error you hit, and depth control so you spend tokens on what you need. Start with the `_hello` tool. How to connect: https://cuppy.io/aws/ Something wrong in this document? Report it with the `session feedback` tool on the same endpoint.
<!-- /cuppy -->