CloudTrail errors
Look up a CloudTrail error by exception name — LookupEvents throttling and attribute errors, trail, KMS, CloudWatch Logs and SNS delivery errors, CloudTrail Lake query errors — plus the silent one, an event missing from Event history, each with cause, the call that confirms it, and fix.
markdownreferencev2D51T-M3EDstage: operatetrust: officialservice: cloudtrailinterface: anyCloudTrail ThrottlingException LookupEventsInvalidLookupAttributesExceptionInvalidTimeRangeExceptionInvalidMaxResultsExceptionInvalidNextTokenExceptionTrailNotFoundExceptionInvalidTrailNameExceptionInsufficientEncryptionPolicyExceptionKmsKeyNotFoundException CloudTrailInvalidCloudWatchLogsLogGroupArnExceptionInvalidCloudWatchLogsRoleArnExceptionCloudWatchLogsDeliveryUnavailableExceptionInsufficientSnsTopicPolicyExceptionMaxConcurrentQueriesExceptionInvalidQueryStatementExceptionInactiveEventDataStoreExceptionCloudTrail event missingget-trail-status LatestDeliveryError
Most CloudTrail problems are an event you can't find, not an exception. Check the first table, then the exceptions. Field meanings of the records themselves are in reference/cloudtrail/event-records.md.
Silent failure
| Symptom | Cause → fix | Check |
|---|---|---|
| A CloudTrail event isn't in Event history | Event history holds management events only, for 90 days, per Region. Data events (S3 objects, Lambda invokes) appear only if a trail or event data store records them. Delivery averages about 5 minutes | aws cloudtrail lookup-events --region <r> --lookup-attributes AttributeKey=EventName,AttributeValue=<name> --start-time <t> in the Region the call went to |
| A trail stopped delivering | Bucket policy, KMS key or SNS topic changed under it. CloudTrail retries delivery for 30 days, and those attempts incur charges | aws cloudtrail get-trail-status --name <trail> → IsLogging, LatestDeliveryError, LatestCloudWatchLogsDeliveryError, LatestNotificationError |
Exceptions
The exception names come from the installed SDK. Causes for LookupEvents come from the CLI guide; the rest are the hub's reading of the names, so check the message text.
| Exception | Cause → fix | Check |
|---|---|---|
ThrottlingException on LookupEvents | More than 2 requests per second per account per Region. Slow down, or use a trail with Logs Insights, or Lake, for bulk searches | Count your calls per second; SDK retry logs |
InvalidLookupAttributesException | A wrong AttributeKey (case-sensitive: EventName, ResourceName, …) or more than one attribute | Print the --lookup-attributes you sent |
InvalidTimeRangeException | StartTime after EndTime | Print both, in UTC |
InvalidMaxResultsException, InvalidNextTokenException | MaxResults outside 1–50, or a token reused with different parameters | Compare the parameters of the first and the paged call |
TrailNotFoundException, InvalidTrailNameException | Wrong name or Region for the trail | aws cloudtrail describe-trails --region <r> → Name, HomeRegion |
InsufficientEncryptionPolicyException, KmsException, KmsKeyNotFoundException, KmsKeyDisabledException | The trail's KMS key policy doesn't let CloudTrail use the key, or the key is unavailable | aws cloudtrail get-trail --name <trail> → KmsKeyId, then aws kms describe-key and get-key-policy (reference/kms/key-policies-and-errors.md) |
InvalidCloudWatchLogsLogGroupArnException, InvalidCloudWatchLogsRoleArnException, CloudWatchLogsDeliveryUnavailableException | The trail-to-CloudWatch Logs setup is wrong: log group ARN, or the role CloudTrail assumes to write | get-trail → CloudWatchLogsLogGroupArn, CloudWatchLogsRoleArn; aws iam get-role → trust for cloudtrail.amazonaws.com |
InsufficientSnsTopicPolicyException | The SNS topic policy doesn't allow CloudTrail to publish | aws sns get-topic-attributes --topic-arn <t> → Policy |
MaxConcurrentQueriesException, InvalidQueryStatementException, InactiveEventDataStoreException | CloudTrail Lake: too many running queries, bad SQL, or a stopped event data store | aws cloudtrail describe-query --query-id <q> → QueryStatus, ErrorMessage; aws cloudtrail get-event-data-store --event-data-store <arn> → Status |
When none of these fits
Collect the request ID from the SDK error and the exact message. For an access failure, read reference/iam/errors.md. To find who changed a trail, search Event history for StopLogging, UpdateTrail and PutEventSelectors (guides/cloudtrail/find-who-did-what.md).