AWS CloudTrail

AWS CloudTrail. CloudTrail log-file envelope containing API activity records.

Source and collection

Configured trail delivery or event data store; event history is not a substitute for every data-event category.

Enable required management/data event categories and verify account/region coverage.

Native example and provenance

publisher documentation example. Published example; no independent capture provenance claimed.

Original publisher / pinned upstream fixture — preformatted example 3

One complete record selected; values unchanged.

Download the exact sample · Offline research kit

SHA-256: 909894e5ef0e45804331a23c050431b077049eded8d8bba42bf2225f1b385d4f

{"Records": [{
    "eventVersion": "1.08",
    "userIdentity": {
        "type": "IAMUser",
        "principalId": "EXAMPLE6E4XEGITWATV6R",
        "arn": "arn:aws:iam::123456789012:user/Mateo",
        "accountId": "123456789012",
        "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
        "userName": "Mateo",
        "sessionContext": {
            "sessionIssuer": {},
            "webIdFederationData": {},
            "attributes": {
                "creationDate": "2023-07-19T21:11:57Z",
                "mfaAuthenticated": "false"
            }
        }
    },
    "eventTime": "2023-07-19T21:17:28Z",
    "eventSource": "ec2.amazonaws.com",
    "eventName": "StartInstances",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "192.0.2.0",
    "userAgent": "aws-cli/2.13.5 Python/3.11.4 Linux/4.14.255-314-253.539.amzn2.x86_64 exec-env/CloudShell exe/x86_64.amzn.2 prompt/off command/ec2.start-instances",
    "requestParameters": {
        "instancesSet": {
            "items": [
                {
                    "instanceId": "i-EXAMPLE56126103cb"
                },
                {
                    "instanceId": "i-EXAMPLEaff4840c22"
                }
            ]
        }
    },
    "responseElements": {
        "requestId": "e4336db0-149f-4a6b-844d-EXAMPLEb9d16",
        "instancesSet": {
            "items": [
                {
                    "instanceId": "i-EXAMPLEaff4840c22",
                    "currentState": {
                        "code": 0,
                        "name": "pending"
                    },
                    "previousState": {
                        "code": 80,
                        "name": "stopped"
                    }
                },
                {
                    "instanceId": "i-EXAMPLE56126103cb",
                    "currentState": {
                        "code": 0,
                        "name": "pending"
                    },
                    "previousState": {
                        "code": 80,
                        "name": "stopped"
                    }
                }
            ]
        }
    },
    "requestID": "e4336db0-149f-4a6b-844d-EXAMPLEb9d16",
    "eventID": "e755e09c-42f9-4c5c-9064-EXAMPLE228c7",
    "readOnly": false,
    "eventType": "AwsApiCall",
    "managementEvent": true,
    "recipientAccountId": "123456789012",
    "eventCategory": "Management",
     "tlsDetails": {
        "tlsVersion": "TLSv1.2",
        "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256",
        "clientProvidedHostHeader": "ec2.us-east-1.amazonaws.com"
    },
    "sessionCredentialFromConsole": "true"
}]}

Structure and field interpretation

Observed structure in this specific sample
Field/path	Serialized type
`Records`	array
`Records[0].eventVersion`	str
`Records[0].userIdentity.type`	str
`Records[0].userIdentity.principalId`	str
`Records[0].userIdentity.arn`	str
`Records[0].userIdentity.accountId`	str
`Records[0].userIdentity.accessKeyId`	str
`Records[0].userIdentity.userName`	str
`Records[0].userIdentity.sessionContext.attributes.creationDate`	str
`Records[0].userIdentity.sessionContext.attributes.mfaAuthenticated`	str
`Records[0].eventTime`	str
`Records[0].eventSource`	str
`Records[0].eventName`	str
`Records[0].awsRegion`	str
`Records[0].sourceIPAddress`	str
`Records[0].userAgent`	str
`Records[0].requestParameters.instancesSet.items`	array
`Records[0].requestParameters.instancesSet.items[0].instanceId`	str
`Records[0].responseElements.requestId`	str
`Records[0].responseElements.instancesSet.items`	array
`Records[0].responseElements.instancesSet.items[0].instanceId`	str
`Records[0].responseElements.instancesSet.items[0].currentState.code`	int
`Records[0].responseElements.instancesSet.items[0].currentState.name`	str
`Records[0].responseElements.instancesSet.items[0].previousState.code`	int
`Records[0].responseElements.instancesSet.items[0].previousState.name`	str
`Records[0].requestID`	str
`Records[0].eventID`	str
`Records[0].readOnly`	bool
`Records[0].eventType`	str
`Records[0].managementEvent`	bool
`Records[0].recipientAccountId`	str
`Records[0].eventCategory`	str
`Records[0].tlsDetails.tlsVersion`	str
`Records[0].tlsDetails.cipherSuite`	str
`Records[0].tlsDetails.clientProvidedHostHeader`	str
`Records[0].sessionCredentialFromConsole`	str

Records: Native field; inspect its exact type and nesting in the complete example below.
eventVersion: Native field; inspect its exact type and nesting in the complete example below.
userIdentity: Native field; inspect its exact type and nesting in the complete example below.
eventName: Native field; inspect its exact type and nesting in the complete example below.
eventTime: Native field; inspect its exact type and nesting in the complete example below.

Investigation uses

Review userIdentity, eventName, resources and errors; correlate requestID and session context.
Retain resource, account/project/subscription and region context for correlation.

Validation boundaries

Delivery can duplicate records; eventVersion and optional fields vary. A successful API call does not prove later resource behavior.

This sample passed byte-integrity and JSON/XML parsing checks, including the catalogue’s specified event discriminators. This is not a complete vendor-schema validation or a tested detection.

For a simulation, first parse this fixture offline, then create a separately labelled synthetic variant and test it against the intended collector in an isolated lab. Never replay public example identities or destinations into production.

Ecosystem connections

References

CloudTrail log file examples - AWS CloudTrail

Sample provenance is linked above. Field availability and product behavior must be checked against the deployed version.