--- cuppy_hub: aws cuppy_path: reference/cloudtrail/event-records.md cuppy_section: docs cuppy_doc: K26T-NN3M cuppy_doc_uuid: effcd8d3-5edd-449e-8934-efed0082310b cuppy_permalink: https://cuppy.io/aws/d/K26T-NN3M cuppy_version: 4 cuppy_updated: 2026-10-23T16:16:52.575Z cuppy_canonical: https://cuppy.io/aws/docs/reference/cloudtrail/event-records cuppy_mcp: https://cuppy.io/mcp cuppy_body_sha256: b4f2ee79d7589f13e124302b18766fdf5d75271782db5941611e2a6c925da978 # cuppy_body_sha256 is over the document body ALONE, excluding both generated blocks. --- # CloudTrail event records and `userIdentity` **Three fields answer most questions:** `eventName` (what was done), `userIdentity` (who did it), and `errorCode` (whether it failed, and how). Record format version 1.11 is current. Minor versions only add fields; a new major version would break parsers. ## Record fields | Field | Meaning | |---|---| | `eventTime` | When the request completed (UTC), as recorded by the API host | | `eventSource` | The service, as `.amazonaws.com`. Watch for exceptions: CloudWatch is `monitoring.amazonaws.com` | | `eventName` | The API action, for example `DeleteBucket` | | `awsRegion` | The Region the request was sent to | | `sourceIPAddress` | The caller's IP. For console actions, it is the IP of the user's own resource, not the console server. Calls from services inside AWS show a DNS name, and AWS-originated events usually show `AWS Internal/#` | | `userAgent` | The client (console, SDK, CLI or service), up to 1 KB | | `errorCode` | Present only on failure: the service's error code (up to 1 KB). VPC endpoint policy denials show `VpceAccessDenied`. Some services report errors inside `responseElements` instead | | `errorMessage` | The failure description, **including authorization failure messages** (up to 1 KB). VPC endpoint denials always say "The request was denied due to a VPC endpoint policy." | | `requestParameters` | What the caller sent. **Omitted** over 100 KB | | `responseElements` | What create, update and delete calls returned. `null` for read-only calls and for calls that return nothing; omitted over 100 KB | | `additionalEventData` | Extra data, for example `MFAUsed` on console sign-in | | `requestID` / `eventID` | The service's request ID (for AWS Support) / CloudTrail's unique event ID | | `eventType` | `AwsApiCall`, `AwsServiceEvent`, `AwsConsoleAction`, `AwsConsoleSignIn` or `AwsVpceEvents` | | `readOnly` | `true` for reads such as `Describe*`, `false` for writes | | `eventCategory` / `managementEvent` | `Management`, `Data` or `NetworkActivity` / a boolean (version 1.06 and later) | | `recipientAccountId` | The account that **received** the call. It differs from `userIdentity.accountId` on cross-account access | | `sharedEventID` | The same GUID on the copies of one cross-account action delivered to each account. Absent when caller and owner are the same account | | `vpcEndpointId` | The interface endpoint the call came through | | `tlsDetails` | TLS version, cipher suite and `clientProvidedHostHeader`. Absent for calls AWS services make for you | | `sessionCredentialFromConsole` | Present (`true`) when console session credentials were used through a proxy or external client | ## `userIdentity.type` The type names come from the userIdentity reference. The short descriptions of `Role`, `FederatedUser`, `AWSAccount`, `AWSService` and `Directory` are the hub's reading of those names. | Type | Who | |---|---| | `Root` | The account root user | | `IAMUser` | An IAM user's long-term keys or console password | | `AssumedRole` | Temporary credentials from `AssumeRole*`: the most common type for workloads, CI and SSO | | `Role` | A role identity in some service-made events | | `FederatedUser` | `GetFederationToken` credentials | | `IdentityCenterUser` | An IAM Identity Center user (with `onBehalfOf.userId` and `identityStoreArn`) | | `AWSAccount` / `AWSService` | Another account / an AWS service principal | | `Directory`, `BuilderIdUser`, `Unknown` | Directory service users, AWS Builder ID, unidentified | | `SAMLUser` / `WebIdentityUser` | Appear on `AssumeRoleWithSAML` / `AssumeRoleWithWebIdentity` events themselves | ## Fields that identify a session - `arn`: for `AssumedRole`, `arn:aws:sts:::assumed-role//`. - `principalId`: `:` (the role ID starts `AROA`). - `accessKeyId`: the temporary key that signed the call. It can be empty. All calls made with one session share it. - `sessionContext.sessionIssuer`: `type`, `arn`, `principalId`, `accountId` and `userName` of the **role** that issued the session. This is where the role name lives for `AssumedRole`. - `sessionContext.attributes`: `creationDate` (when the credentials were issued) and `mfaAuthenticated`. - `sessionContext.sourceIdentity`: the original identity, carried through role chains, but only if administrators have configured STS to require a source identity. - `sessionContext.signInSessionArn`: a console sign-in session, which can be audited or revoked. - `sessionContext.webIdFederationData`: the identity provider details for web-identity sessions, such as GitHub OIDC. - `invokedBy`: the AWS service that made the request for you. It appears with service roles, service-linked roles and forward access sessions. - `inScopeOf`: on service-to-service calls, `sourceArn`, `sourceAccount`, `issuerType` and `credentialsIssuedTo`. - `credentialId`: set when a bearer token, such as an Identity Center access token, was used. ## Following a chain Example: GitHub OIDC → CI role → CDK deploy role → CloudFormation execution role. 1. The resource's event (for example `CreateFunction`) shows the role that made the call in `sessionContext.sessionIssuer.arn`. For a CloudFormation stack with a service role, that is the execution role, and `invokedBy` names the service. CloudFormation's session name for that role isn't documented on the fetched pages. 2. Search for the `AssumeRole` event that issued that session: same role and session name, around `creationDate`. Matching on the access key in its `responseElements` is the hub's method; the page suggests matching on `accessKeyId`, `creationDate` and `sessionIssuer`. Its `userIdentity` is the next link up, for example the CDK deploy role or your CI role. 3. Repeat until you reach an `AssumeRoleWithWebIdentity` event (CI: `webIdFederationData` names the provider) or an Identity Center or IAM user. Configuring `sourceIdentity` saves this walk: every downstream event carries the original identity. --- You are reading one file. The same content is free over MCP at https://cuppy.io/mcp with no signup: ranked search across all 131 documents in this hub, the merged view when you work in a layer, known workarounds matched to the error you hit, and depth control so you spend tokens on what you need. Start with the `_hello` tool. How to connect: https://cuppy.io/aws/ Something wrong in this document? Report it with the `session feedback` tool on the same endpoint.