---
title: "AWS CloudTrail Events to Monitor and Alert On - Cybr"
description: "A list of CloudTrail events, grouped by service, that can indicate a security event in your AWS account and are worth considering for alerts."
url: https://cybr.com/cloud-security/aws-cloudtrail-events-to-monitor/
---

# AWS CloudTrail Events to Monitor and Alert On

A list of CloudTrail events, grouped by service, that can indicate a security event in your AWS account and are worth considering for alerts.

Christophe

Published March 1, 2024 · Updated October 27, 2026

Which AWS CloudTrail events should you alert on? This list is grouped by event source, and every event on it can indicate a security event: someone disabling logging, creating credentials, opening up access, or exfiltrating data. It started from 4n6ir's Expediate project (no longer online), and we've since corrected and extended it.

Not all of these will make sense for your environment, and some will cause alert fatigue depending on your use case. Use this as a starting point and reference, but think through the implementation. Consider also using existing monitoring and alerting tools like the [AWS Security Survival Kit](https://github.com/zoph-io/aws-security-survival-kit) instead of reinventing the wheel. For how to wire up alerts with EventBridge and SNS, see [AWS Security Monitoring, Logging, and Alerting](https://cybr.com/cloud-security/aws-security-monitoring-logging-alerting/).

Two things to know before you build rules from this list:

- Some services log versioned event names. Lambda, for example, logs `CreateFunction` as `CreateFunction20150331`, so use prefix matching in EventBridge (`{"prefix": "CreateFunction"}`) instead of exact names.
- Data events, like S3 `RestoreObject`, only show up if you've enabled data events on your trail.

> **Tip:** Some of these events fire constantly during normal use. For example, CloudShell's `GetFileDownloadUrls`: here's [how to filter it out of an EventBridge rule](https://cybr.com/cloud-security/eventbridge-ignoring-cloudshell-getfiledownloadurls-events/).

## cloudshell.amazonaws.com

- `CreateEnvironment`
- `CreateSession`
- `DeleteEnvironment`
- `GetEnvironmentStatus`
- `GetFileDownloadUrls`
- `GetFileUploadUrls`
- `PutCredentials`
- `StartEnvironment`
- `StopEnvironment`

## cloudtrail.amazonaws.com

- `DeleteEventDataStore`
- `DeleteTrail`
- `PutEventSelectors`
- `StopEventDataStoreIngestion`
- `StopLogging`
- `UpdateEventDataStore`
- `UpdateTrail`

## config.amazonaws.com

- `DeleteConfigurationRecorder`
- `DeleteDeliveryChannel`
- `StopConfigurationRecorder`

## connect.amazonaws.com

- `CreateInstance`

## ec2.amazonaws.com

- `CreateDefaultVpc`
- `CreateImage`
- `CreateInstanceExportTask`
- `CreateKeyPair`
- `CreateVpc`
- `DeleteFlowLogs`
- `DeleteVpc`
- `DescribeInstanceAttribute`
- `DisableEbsEncryptionByDefault`
- `DisableImageBlockPublicAccess`
- `DisableSerialConsoleAccess`
- `DisableSnapshotBlockPublicAccess`
- `EnableEbsEncryptionByDefault`
- `EnableImageBlockPublicAccess`
- `EnableSerialConsoleAccess`
- `EnableSnapshotBlockPublicAccess`
- `GetPasswordData`
- `ModifyInstanceAttribute`
- `ModifySnapshotAttribute`
- `SharedSnapshotCopyInitiated`
- `SharedSnapshotVolumeCreated`

## ecr.amazonaws.com

- `CreateRepository`
- `GetAuthorizationToken`

## ecs.amazonaws.com

- `RegisterTaskDefinition`
- `RunTask`

## eks.amazonaws.com

- `CreateCluster`
- `DeleteCluster`

## elasticache.amazonaws.com

- `ModifyCacheCluster`
- `ModifyReplicationGroup`

## elasticfilesystem.amazonaws.com

- `DeleteFileSystem`
- `DeleteMountTarget`

## glue.amazonaws.com

- `CreateSession`
- `CreateDevEndpoint` (legacy)
- `DeleteDevEndpoint`
- `UpdateDevEndpoint`

## guardduty.amazonaws.com

- `CreateFilter`
- `CreateIPSet`
- `CreateThreatIntelSet`
- `DeleteDetector`
- `DeleteMembers`
- `DisassociateFromAdministratorAccount`
- `DisassociateMembers`
- `UpdateDetector`
- `UpdateFilter`
- `UpdateThreatIntelSet`

## iam.amazonaws.com

- `AddUserToGroup`
- `AttachGroupPolicy`
- `AttachUserPolicy`
- `ChangePassword`
- `CreateAccessKey`
- `CreateLoginProfile`
- `CreateUser`
- `CreateVirtualMFADevice`
- `DeactivateMFADevice`
- `DeleteAccessKey`
- `DeleteUser`
- `DeleteUserPolicy`
- `DeleteVirtualMFADevice`
- `DetachGroupPolicy`
- `DetachUserPolicy`
- `EnableMFADevice`
- `PutUserPolicy`
- `ResyncMFADevice`
- `UpdateAccessKey`
- `UpdateGroup`
- `UpdateLoginProfile`
- `UpdateSAMLProvider`
- `UpdateUser`

## kms.amazonaws.com

- `DisableKey`
- `PutKeyPolicy`
- `ScheduleKeyDeletion`

## lambda.amazonaws.com

- `AddLayerVersionPermission`
- `AddPermission` (logged as `AddPermission20150331v2`)
- `CreateFunction` (logged as `CreateFunction20150331`)
- `GetLayerVersionPolicy`
- `PublishLayerVersion` (logged as `PublishLayerVersion20181031`)
- `UpdateFunctionCode` (logged as `UpdateFunctionCode20150331v2`)
- `UpdateFunctionConfiguration` (logged as `UpdateFunctionConfiguration20150331v2`)

## macie2.amazonaws.com

- `DisableMacie`

## organizations.amazonaws.com

- `LeaveOrganization`

## rds.amazonaws.com

- `ModifyDBInstance`
- `RestoreDBInstanceFromDBSnapshot`

## rolesanywhere.amazonaws.com

- `CreateProfile`
- `CreateTrustAnchor`

## route53domains.amazonaws.com

- `DisableDomainTransferLock`
- `TransferDomainToAnotherAwsAccount`

## s3.amazonaws.com

- `DeleteBucketEncryption`
- `DeleteBucketPolicy`
- `PutBucketEncryption`
- `PutBucketLifecycle`
- `PutBucketLogging`
- `PutBucketPolicy`
- `PutBucketPublicAccessBlock`
- `PutBucketReplication`
- `PutBucketWebsite`
- `RestoreObject` (data event)

## securityhub.amazonaws.com

- `BatchUpdateFindings`
- `DeleteInsight`
- `DisableSecurityHub`
- `UpdateFindings`
- `UpdateInsight`

## sso.amazonaws.com

- `AttachCustomerManagedPolicyReferenceToPermissionSet`
- `AttachManagedPolicyToPermissionSet`
- `CreateAccountAssignment`
- `CreateInstanceAccessControlAttributeConfiguration`
- `CreatePermissionSet`
- `DeleteAccountAssignment`
- `DeleteInlinePolicyFromPermissionSet`
- `DeleteInstanceAccessControlAttributeConfiguration`
- `DeletePermissionsBoundaryFromPermissionSet`
- `DeletePermissionSet`
- `DetachCustomerManagedPolicyReferenceFromPermissionSet`
- `DetachManagedPolicyFromPermissionSet`
- `ProvisionPermissionSet`
- `PutInlinePolicyToPermissionSet`
- `PutPermissionsBoundaryToPermissionSet`
- `UpdateInstanceAccessControlAttributeConfiguration`
- `UpdatePermissionSet`

## sts.amazonaws.com

- `GetFederationToken`
- `GetSessionToken`

## Sources

- [Logging Amazon S3 API calls with CloudTrail](https://docs.aws.amazon.com/AmazonS3/latest/userguide/cloudtrail-logging-s3-info.html)
- [Logging Lambda API calls with CloudTrail](https://docs.aws.amazon.com/lambda/latest/dg/logging-using-cloudtrail.html)
- [Logging GuardDuty API calls with CloudTrail](https://docs.aws.amazon.com/guardduty/latest/ug/logging-using-cloudtrail.html)
- [AWS Security Survival Kit](https://github.com/zoph-io/aws-security-survival-kit)

## Filed under

- [Cloud Security](https://cybr.com/cloud-security/)
- [Blue Team](https://cybr.com/blue-team/)
- [AWS](https://cybr.com/tag/aws/)
- [AWS Security](https://cybr.com/tag/aws-security/)
- [CloudTrail](https://cybr.com/tag/cloudtrail/)
- [Detection Engineering](https://cybr.com/tag/detection-engineering/)

## Comments

Loading comments…

Recommended resources

[![Explore the AWS Certified Security Specialty course](https://media.cybr.com/2023/12/cybr-aws-security-specialty-banner-768x432.jpg)](https://cybr.com/courses/aws-certified-security-specialty-course/)

## Build practical AWS security skills

Start with the core services, then prepare for the AWS Certified Security Specialty exam with guided lessons and hands-on practice.

[Introduction to AWS Security](https://cybr.com/courses/introduction-to-aws-security/) [Security Specialty course](https://cybr.com/courses/aws-certified-security-specialty-course/)