Menu
Amazon CloudWatch Events
User Guide

CloudWatch Events Event Examples From Each Supported Service

The following AWS services emit events that can be detected by CloudWatch Events:

Events for Services Not Listed

You can also use CloudWatch Events with services that do not emit events and are not on the preceding list. AWS CloudTrail is a service that automatically records events such as AWS service API calls. You can create CloudWatch Events rules that trigger on the information captured by CloudTrail. For more information about CloudTrail, see What is AWS CloudTrail?. For more information about creating a CloudWatch Events rule that uses CloudTrail, see Creating a CloudWatch Events Rule That Triggers on an AWS API Call Using AWS CloudTrail.

Auto Scaling Events

The following are examples of the events for Auto Scaling. For more information, see Getting CloudWatch Events When Your Auto Scaling Group Scales in the Auto Scaling User Guide.

EC2 Instance-launch Lifecycle Action

Auto Scaling moved an instance to a Pending:Wait state due to a lifecycle hook.

Copy
{ "version": "0", "id": "6a7e8feb-b491-4cf7-a9f1-bf3703467718", "detail-type": "EC2 Instance-launch Lifecycle Action", "source": "aws.autoscaling", "account": "123456789012", "time": "2015-12-22T18:43:48Z", "region": "us-east-1", "resources": [ "arn:aws:autoscaling:us-east-1:123456789012:autoScalingGroup:59fcbb81-bd02-485d-80ce-563ef5b237bf:autoScalingGroupName/sampleASG" ], "detail": { "LifecycleActionToken": "c613620e-07e2-4ed2-a9e2-ef8258911ade", "AutoScalingGroupName": "sampleASG", "LifecycleHookName": "SampleLifecycleHook-12345", "EC2InstanceId": "i-12345678", "LifecycleTransition": "autoscaling:EC2_INSTANCE_LAUNCHING" } }

EC2 Instance Launch Successful

Auto Scaling successfully launched an instance.

Copy
{ "id": "3e3c153a-8339-4e30-8c35-687ebef853fe", "detail-type": "EC2 Instance Launch Successful", "source": "aws.autoscaling", "account": "123456789012", "time": "2015-11-11T21:31:47Z", "region": "us-east-1", "resources": [ "arn:aws:autoscaling:us-east-1:123456789012:autoScalingGroup:eb56d16b-bbf0-401d-b893-d5978ed4a025:autoScalingGroupName/ASGLaunchSuccess", "arn:aws:ec2:us-east-1:123456789012:instance/i-b188560f" ], "detail": { "StatusCode": "InProgress", "AutoScalingGroupName": "ASGLaunchSuccess", "ActivityId": "9cabb81f-42de-417d-8aa7-ce16bf026590", "Details": { "Availability Zone": "us-east-1b", "Subnet ID": "subnet-95bfcebe" }, "RequestId": "9cabb81f-42de-417d-8aa7-ce16bf026590", "EndTime": "2015-11-11T21:31:47.208Z", "EC2InstanceId": "i-b188560f", "StartTime": "2015-11-11T21:31:13.671Z", "Cause": "At 2015-11-11T21:31:10Z a user request created an Auto Scaling group changing the desired capacity from 0 to 1. At 2015-11-11T21:31:11Z an instance was started in response to a difference between desired and actual capacity, increasing the capacity from 0 to 1." } }

EC2 Instance Launch Unsuccessful

Auto Scaling failed to launch an instance.

Copy
{ "id": "1681ab87-4a09-459f-95a2-7fa09403c4b7", "detail-type": "EC2 Instance Launch Unsuccessful", "source": "aws.autoscaling", "account": "123456789012", "time": "2015-11-11T21:42:36Z", "region": "us-east-1", "resources": [ "arn:aws:autoscaling:us-east-1:123456789012:autoScalingGroup:528ffce5-ef9f-4c1d-8d18-5d005b4a438c:autoScalingGroupName/brokenASG", "arn:aws:ec2:us-east-1:123456789012:instance/" ], "detail": { "StatusCode": "Failed", "AutoScalingGroupName": "brokenASG", "ActivityId": "06076c51-4874-487d-b15b-7895a713ab55", "Details": { "Availability Zone": "us-east-1e", "Subnet ID": "subnet-16c5df2c" }, "RequestId": "06076c51-4874-487d-b15b-7895a713ab55", "EndTime": "2015-11-11T21:42:36.000Z", "EC2InstanceId": "", "StartTime": "2015-11-11T21:42:36.698Z", "Cause": "At 2015-11-11T21:42:09Z a user request update of Auto Scaling group constraints to min: 0, max: 10, desired: 2 changing the desired capacity from 0 to 2. At 2015-11-11T21:42:35Z an instance was started in response to a difference between desired and actual capacity, increasing the capacity from 0 to 2." } }

EC2 Instance-terminate Lifecycle Action

Auto Scaling moved an instance to a Terminating:Wait state due to a lifecycle hook.

Copy
{ "version": "0", "id": "468fe059-f4b7-445f-bb22-2a271b94974d", "detail-type": "EC2 Instance-terminate Lifecycle Action", "source": "aws.autoscaling", "account": "123456789012", "time": "2015-12-22T18:43:48Z", "region": "us-east-1", "resources": [ "arn:aws:autoscaling:us-east-1:123456789012:autoScalingGroup:59fcbb81-bd02-485d-80ce-563ef5b237bf:autoScalingGroupName/sampleASG" ], "detail": { "LifecycleActionToken": "630aa23f-48eb-45e7-aba6-799ea6093a0f", "AutoScalingGroupName": "sampleASG", "LifecycleHookName": "SampleLifecycleHook-6789", "EC2InstanceId": "i-12345678", "LifecycleTransition": "autoscaling:EC2_INSTANCE_TERMINATING" } }

EC2 Instance Terminate Successful

Auto Scaling successfully terminated an instance.

Copy
{ "id": "156d01c9-a6c3-4d7e-b883-5758266b95af", "detail-type": "EC2 Instance Terminate Successful", "source": "aws.autoscaling", "account": "123456789012", "time": "2015-11-11T21:36:57Z", "region": "us-east-1", "resources": [ "arn:aws:autoscaling:us-east-1:123456789012:autoScalingGroup:eb56d16b-bbf0-401d-b893-d5978ed4a025:autoScalingGroupName/ASGTerminate", "arn:aws:ec2:us-east-1:123456789012:instance/i-b188560f" ], "detail": { "StatusCode": "InProgress", "AutoScalingGroupName": "ASGTerminate", "ActivityId": "56472e79-538a-4ba7-b3cc-768d889194b0", "Details": { "Availability Zone": "us-east-1b", "Subnet ID": "subnet-95bfcebe" }, "RequestId": "56472e79-538a-4ba7-b3cc-768d889194b0", "EndTime": "2015-11-11T21:36:57.498Z", "EC2InstanceId": "i-b188560f", "StartTime": "2015-11-11T21:36:12.649Z", "Cause": "At 2015-11-11T21:36:03Z a user request update of Auto Scaling group constraints to min: 0, max: 1, desired: 0 changing the desired capacity from 1 to 0. At 2015-11-11T21:36:12Z an instance was taken out of service in response to a difference between desired and actual capacity, shrinking the capacity from 1 to 0. At 2015-11-11T21:36:12Z instance i-b188560f was selected for termination." } }

EC2 Instance Terminate Unsuccessful

Auto Scaling failed to terminate an instance.

Copy
{ "id": "5e3df53a-0239-4e31-7d15-087ebef903ce", "detail-type": "EC2 Instance Terminate Unsuccessful", "source": "aws.autoscaling", "account": "123456789012", "time": "2015-12-01T23:34:57Z", "region": "us-east-1", "resources": [ "arn:aws:autoscaling:us-east-1:123456789012:autoScalingGroup:cf5ebd9c-8e2a-4197-abe2-2fb94e8d1f87:autoScalingGroupName/ASGTermFail", "arn:aws:ec2:us-east-1:123456789012:instance/i-b188560f" ], "detail": { "StatusCode": "InProgress", "Description": "Terminating EC2 instance: i-b188560f", "AutoScalingGroupName": "ASGTermFail", "ActivityId": "c1a8f6ce-82e8-4517-96ba-67d1999ceee4", "Details": { "Availability Zone": "us-east-1e", "Subnet ID": "subnet-915643ba" }, "RequestId": "c1a8f6ce-82e8-4517-96ba-67d1999ceee4", "StatusMessage": "", "EndTime": "2015-12-01T23:34:57.721Z", "EC2InstanceId": "i-b188560f", "StartTime": "2015-12-01T23:33:48.489Z", "Cause": "At 2015-12-01T23:33:41Z a user request explicitly set group desired capacity changing the desired capacity from 2 to 0. At 2015-12-01T23:33:47Z an instance was taken out of service in response to a difference between desired and actual capacity, shrinking the capacity from 2 to 0. At 2015-12-01T23:33:47Z instance i-0867b4292c0cff474 was selected for termination. At 2015-12-01T23:33:48Z instance i-b188560f was selected for termination." } }

AWS API Call Events

The following is an example of an AWS API call event to Amazon S3 to create a bucket:

Copy
{ "version": "0", "id": "36eb8523-97d0-4518-b33d-ee3579ff19f0", "detail-type": "AWS API Call via CloudTrail", "source": "aws.s3", "account": "123456789012", "time": "2016-02-20T01:09:13Z", "region": "us-east-1", "resources": [], "detail": { "eventVersion": "1.03", "userIdentity": { "type": "Root", "principalId": "123456789012", "arn": "arn:aws:iam::123456789012:root", "accountId": "123456789012", "sessionContext": { "attributes": { "mfaAuthenticated": "false", "creationDate": "2016-02-20T01:05:59Z" } } }, "eventTime": "2016-02-20T01:09:13Z", "eventSource": "s3.amazonaws.com", "eventName": "CreateBucket", "awsRegion": "us-east-1", "sourceIPAddress": "100.100.100.100", "userAgent": "[S3Console/0.4]", "requestParameters": { "bucketName": "bucket-test-iad" }, "responseElements": null, "requestID": "9D767BCC3B4E7487", "eventID": "24ba271e-d595-4e66-a7fd-9c16cbf8abae", "eventType": "AwsApiCall" } }

Only the read/write events from the following services are supported. Read-only operations—such as those that begin with List, Get, or Describe—aren't supported. In addition, AWS API call events that are larger than 256 KB in size are not supported.

  • Auto Scaling

  • AWS Certificate Manager

  • AWS CloudFormation

  • Amazon CloudFront

  • AWS CloudHSM

  • Amazon CloudSearch

  • AWS CloudTrail

  • Amazon CloudWatch

  • Amazon CloudWatch Events

  • Amazon CloudWatch Logs

  • AWS CodeDeploy

  • AWS CodePipeline

  • Amazon Cognito Identity

  • Amazon Cognito Sync

  • AWS Config

  • AWS Data Pipeline

  • AWS Device Farm

  • AWS Direct Connect

  • AWS Directory Service

  • AWS Database Migration Service

  • Amazon DynamoDB

  • Amazon EC2 Container Registry

  • Amazon EC2 Container Service

  • Amazon EC2 Systems Manager

  • Amazon ElastiCache

  • AWS Elastic Beanstalk

  • Amazon Elastic Compute Cloud

  • Amazon Elastic File System

  • Elastic Load Balancing

  • Amazon EMR

  • Amazon Elastic Transcoder

  • Amazon Elasticsearch Service

  • Amazon GameLift

  • Amazon Glacier

  • AWS Identity and Access Management [US East (N. Virginia) only]

  • Amazon Inspector

  • AWS IoT

  • AWS Key Management Service

  • Amazon Kinesis

  • Amazon Kinesis Firehose

  • AWS Lambda

  • Amazon Machine Learning

  • AWS OpsWorks

  • Amazon Polly

  • Amazon Redshift

  • Amazon Relational Database Service

  • Amazon Route 53

  • AWS Security Token Service

  • Amazon Simple Email Service

  • Amazon Simple Notification Service

  • Amazon Simple Queue Service

  • Amazon Simple Storage Service

  • Amazon Simple Workflow Service

  • AWS Step Functions

  • AWS Storage Gateway

  • AWS Support

  • AWS WAF

  • Amazon WorkDocs

  • Amazon WorkSpaces

AWS CodeBuild Events

The following are examples of events for AWS CodeBuild.

AWS CodeBuild Build Phase Change Events

These events signal changes in the build phase.

Copy
{ "version":"0", "id":"54454ec6-dd42-4e84-a3bd-bc9a7eb29275", "detail-type":"CodeBuild Build Phase Change", "source":"aws.codebuild", "account":"123456789012", "time":"2017-07-13T20:48:23Z", "region":"us-east-1", "resources":[ "arn:aws:codebuild:us-east-1:123456789012:build/SampleProjectName:dc447f73-8915-4021-889c-f5a5ac23423d" ], "detail":{ "completed-phase":"SUBMITTED", "project-name":"SampleProjectName", "build-id":"arn:aws:codebuild:us-east-1:123456789012:build/SampleProjectName:dc447f73-8915-4021-889c-f5a5ac23423d", "completed-phase-context":"[]", "completed-phase-status":"SUCCEEDED", "completed-phase-duration-seconds":0.0, "version":"1", "completed-phase-start":"Jul 13, 2017 8:48:23 PM", "completed-phase-end":"Jul 13, 2017 8:48:23 PM" } }
Copy
{ "version":"0", "id":"034ae3b3-9bd6-4a2b-93cd-69e9ca6ca934", "detail-type":"CodeBuild Build Phase Change", "source":"aws.codebuild", "account":"123456789012", "time":"2017-07-13T20:48:23Z", "region":"us-east-1", "resources":[ "arn:aws:codebuild:us-east-1:123456789012:build/SampleProjectName:dc447f73-8915-4021-889c-f5a5ac23423d" ], "detail":{ "completed-phase":"PROVISIONING", "project-name":"SampleProjectName", "build-id":"arn:aws:codebuild:us-east-1:123456789012:build/SampleProjectName:dc447f73-8915-4021-889c-f5a5ac23423d", "completed-phase-context":"[]", "completed-phase-status":"CLIENT_ERROR", "completed-phase-duration-seconds":8.0, "version":"1", "completed-phase-start":"Jul 13, 2017 8:48:23 PM", "completed-phase-end":"Jul 13, 2017 8:48:32 PM" } }
Copy
{ "version":"0", "id":"96f4d899-f839-4ed2-bad8-f6dd40d55969", "detail-type":"CodeBuild Build Phase Change", "source":"aws.codebuild", "account":"123456789012", "time":"2017-07-13T20:48:32Z", "region":"us-east-1", "resources":[ "arn:aws:codebuild:us-east-1:123456789012:build/SampleProjectName:dc447f73-8915-4021-889c-f5a5ac23423d" ], "detail":{ "completed-phase":"DOWNLOAD_SOURCE", "project-name":"SampleProjectName", "build-id":"arn:aws:codebuild:us-east-1:123456789012:build/SampleProjectName:dc447f73-8915-4021-889c-f5a5ac23423d", "completed-phase-context":"[]", "completed-phase-status":"SUCCEEDED", "completed-phase-duration-seconds":4.0, "version":"1", "completed-phase-start":"Jul 13, 2017 8:48:32 PM", "completed-phase-end":"Jul 13, 2017 8:48:36 PM" } }
Copy
{ "version":"0", "id":"52556739-c84e-43aa-8588-4ffd28e43d73", "detail-type":"CodeBuild Build Phase Change", "source":"aws.codebuild", "account":"123456789012", "time":"2017-07-13T20:48:36Z", "region":"us-east-1", "resources":[ "arn:aws:codebuild:us-east-1:123456789012:build/SampleProjectName:dc447f73-8915-4021-889c-f5a5ac23423d" ], "detail":{ "completed-phase":"INSTALL", "project-name":"SampleProjectName", "build-id":"arn:aws:codebuild:us-east-1:123456789012:build/SampleProjectName:dc447f73-8915-4021-889c-f5a5ac23423d", "completed-phase-context":"[]", "completed-phase-status":"SUCCEEDED", "completed-phase-duration-seconds":0.0, "version":"1", "completed-phase-start":"Jul 13, 2017 8:48:36 PM", "completed-phase-end":"Jul 13, 2017 8:48:36 PM" } }
Copy
{ "version":"0", "id":"e85ad887-e055-49e4-9be7-2b9e20d45a4c", "detail-type":"CodeBuild Build Phase Change", "source":"aws.codebuild", "account":"123456789012", "time":"2017-07-13T20:48:36Z", "region":"us-east-1", "resources":[ "arn:aws:codebuild:us-east-1:123456789012:build/SampleProjectName:dc447f73-8915-4021-889c-f5a5ac23423d" ], "detail":{ "completed-phase":"PRE_BUILD", "project-name":"SampleProjectName", "build-id":"arn:aws:codebuild:us-east-1:123456789012:build/SampleProjectName:dc447f73-8915-4021-889c-f5a5ac23423d", "completed-phase-context":"[]", "completed-phase-status":"TIMED_OUT", "completed-phase-duration-seconds":0.0, "version":"1", "completed-phase-start":"Jul 13, 2017 8:48:36 PM", "completed-phase-end":"Jul 13, 2017 8:48:37 PM" } }
Copy
{ "version":"0", "id":"3fa5bb2f-6a20-4f2f-8d6a-7ca20fd4b3b1", "detail-type":"CodeBuild Build Phase Change", "source":"aws.codebuild", "account":"123456789012", "time":"2017-07-13T20:48:37Z", "region":"us-east-1", "resources":[ "arn:aws:codebuild:us-east-1:123456789012:build/SampleProjectName:dc447f73-8915-4021-889c-f5a5ac23423d" ], "detail":{ "completed-phase":"BUILD", "project-name":"SampleProjectName", "build-id":"arn:aws:codebuild:us-east-1:123456789012:build/SampleProjectName:dc447f73-8915-4021-889c-f5a5ac23423d", "completed-phase-context":"[]", "completed-phase-status":"STOPPED", "completed-phase-duration-seconds":7.0, "version":"1", "completed-phase-start":"Jul 13, 2017 8:48:37 PM", "completed-phase-end":"Jul 13, 2017 8:48:44 PM" } }
Copy
{ "version":"0", "id":"00c59c6c-087b-44af-a56c-6ccd8ae2b3c0", "detail-type":"CodeBuild Build Phase Change", "source":"aws.codebuild", "account":"123456789012", "time":"2017-07-13T20:48:50Z", "region":"us-east-1", "resources":[ "arn:aws:codebuild:us-east-1:123456789012:build/SampleProjectName:dc447f73-8915-4021-889c-f5a5ac23423d" ], "detail":{ "completed-phase":"UPLOAD_ARTIFACTS", "project-name":"SampleProjectName", "build-id":"arn:aws:codebuild:us-east-1:123456789012:build/SampleProjectName:dc447f73-8915-4021-889c-f5a5ac23423d", "completed-phase-context":"[]", "completed-phase-status":"SUCCEEDED", "completed-phase-duration-seconds":0.0, "version":"1", "completed-phase-start":"Jul 13, 2017 8:48:50 PM", "completed-phase-end":"Jul 13, 2017 8:48:50 PM" } }
Copy
{ "version":"0", "id":"9bdcea62-84d8-44ac-9dd0-992885799589", "detail-type":"CodeBuild Build Phase Change", "source":"aws.codebuild", "account":"123456789012", "time":"2017-07-13T20:48:44Z", "region":"us-east-1", "resources":[ "arn:aws:codebuild:us-east-1:123456789012:build/SampleProjectName:dc447f73-8915-4021-889c-f5a5ac23423d" ], "detail":{ "completed-phase":"POST_BUILD", "project-name":"SampleProjectName", "build-id":"arn:aws:codebuild:us-east-1:123456789012:build/SampleProjectName:dc447f73-8915-4021-889c-f5a5ac23423d", "completed-phase-context":"[]", "completed-phase-status":"SUCCEEDED", "completed-phase-duration-seconds":5.0, "version":"1", "completed-phase-start":"Jul 13, 2017 8:48:44 PM", "completed-phase-end":"Jul 13, 2017 8:48:50 PM" } }
Copy
{ "version":"0", "id":"5e4be48b-86c8-42d7-8fb1-31152598fec0", "detail-type":"CodeBuild Build Phase Change", "source":"aws.codebuild", "account":"123456789012", "time":"2017-07-13T20:48:50Z", "region":"us-east-1", "resources":[ "arn:aws:codebuild:us-east-1:123456789012:build/SampleProjectName:dc447f73-8915-4021-889c-f5a5ac23423d" ], "detail":{ "completed-phase":"FINALIZING", "project-name":"SampleProjectName", "build-id":"arn:aws:codebuild:us-east-1:123456789012:build/SampleProjectName:dc447f73-8915-4021-889c-f5a5ac23423d", "completed-phase-context":"[]", "completed-phase-status":"SUCCEEDED", "completed-phase-duration-seconds":4.0, "version":"1", "completed-phase-start":"Jul 13, 2017 8:48:50 PM", "completed-phase-end":"Jul 13, 2017 8:48:55 PM" } }

AWS CodeBuild Build State Change Events

These events signal changes in the build state.

Copy
{ "version":"0", "id":"98a0df14-0aa3-41e1-b603-5b27ce3c1431", "detail-type":"CodeBuild Build State Change", "source":"aws.codebuild", "account":"123456789012", "time":"2017-07-12T00:42:28Z", "region":"us-east-1", "resources":[ "arn:aws:codebuild:us-east-1:123456789012:build/SampleProjectName:6bdced96-e528-485b-a64c-10df867f5f33" ], "detail":{ "build-status":"IN_PROGRESS", "project-name":"SampleProjectName", "build-id":"arn:aws:codebuild:us-east-1:123456789012:build/SampleProjectName:6bdced96-e528-485b-a64c-10df867f5f33", "current-phase":"SUBMITTED", "current-phase-context":"[]", "version":"1" } }
Copy
{ "version":"0", "id":"bfdc1220-60ff-44ad-bfa7-3b6e6ba3b2d0", "detail-type":"CodeBuild Build State Change", "source":"aws.codebuild", "account":"123456789012", "time":"2017-07-12T00:42:28Z", "region":"us-east-1", "resources":[ "arn:aws:codebuild:us-east-1:123456789012:build/SampleProjectName:ed6aa685-0d76-41da-a7f5-6d8760f41f55" ], "detail":{ "build-status":"SUCCEEDED", "project-name":"SampleProjectName", "build-id":"arn:aws:codebuild:us-east-1:123456789012:build/SampleProjectName:ed6aa685-0d76-41da-a7f5-6d8760f41f55", "current-phase":"COMPLETED", "current-phase-context":"[]", "version":"1" } }
Copy
{ "version":"0", "id":"1cb6e284-2c0a-4b4d-95f2-7dc042733d11", "detail-type":"CodeBuild Build State Change", "source":"aws.codebuild", "account":"123456789012", "time":"2017-07-12T00:42:28Z", "region":"us-east-1", "resources":[ "arn:aws:codebuild:us-east-1:123456789012:build/SampleProjectName:a68ca311-846f-4ca4-b606-ae36de59542b" ], "detail":{ "build-status":"FAILED", "project-name":"SampleProjectName", "build-id":"arn:aws:codebuild:us-east-1:123456789012:build/SampleProjectName:a68ca311-846f-4ca4-b606-ae36de59542b", "current-phase":"COMPLETED", "current-phase-context":"[]", "version":"1" } }
Copy
{ "version":"0", "id":"a0d9e327-da71-40f2-ac80-6c53f779f16f", "detail-type":"CodeBuild Build State Change", "source":"aws.codebuild", "account":"123456789012", "time":"2017-07-12T00:42:28Z", "region":"us-east-1", "resources":[ "arn:aws:codebuild:us-east-1:123456789012:build/SampleProjectName:be34f238-6087-4669-93be-f5ba99b66ab0" ], "detail":{ "build-status":"STOPPED", "project-name":"SampleProjectName", "build-id":"arn:aws:codebuild:us-east-1:123456789012:build/SampleProjectName:be34f238-6087-4669-93be-f5ba99b66ab0", "current-phase":"COMPLETED", "current-phase-context":"[]", "version":"1" } }

AWS CodeCommit Events

The following are examples of events for AWS CodeCommit.

referenceCreated event

Copy
{ "version": "0", "id": "01234567-0123-0123-0123-012345678901", "detail-type": "CodeCommit Repository State Change", "source": "aws.codecommit", "account": "123456789012", "time": "2017-06-12T10:23:43Z", "region": "us-east-1", "resources": [ "arn:aws:codecommit:us-east-1:123456789012:myRepo" ], "detail": { "event": "referenceCreated", "repositoryName": "myRepo", "repositoryId": "12345678-1234-5678-abcd-12345678abcd", "referenceType": "tag", "referenceName": "myTag", "referenceFullName": "refs/tags/myTag", "commitId": "3e5983EXAMPLE" } }

referenceUpdated event

Copy
{ "version": "0", "id": "01234567-0123-0123-0123-012345678901", "detail-type": "CodeCommit Repository State Change", "source": "aws.codecommit", "account": "123456789012", "time": "2017-06-12T10:23:43Z", "region": "us-east-1", "resources": [ "arn:aws:codecommit:us-east-1:123456789012:myRepo" ], "detail": { "event": "referenceUpdated", "repositoryName": "myRepo", "repositoryId": "12345678-1234-5678-abcd-12345678abcd", "referenceType": "branch", "referenceName": "myBranch", "referenceFullName": "refs/heads/myBranch", "commitId": "26a8f2EXAMPLE", "oldCommitId": "3e5983EXAMPLE" } }

referenceDeleted event

Copy
{ "version": "0", "id": "01234567-0123-0123-0123-012345678901", "detail-type": "CodeCommit Repository State Change", "source": "aws.codecommit", "account": "123456789012", "time": "2017-06-12T10:23:43Z", "region": "us-east-1", "resources": [ "arn:aws:codecommit:us-east-1:123456789012:myRepo" ], "detail": { "event": "referenceDeleted", "repositoryName": "myRepo", "repositoryId": "12345678-1234-5678-abcd-12345678abcd", "referenceType": "branch", "referenceName": "myBranch", "referenceFullName": "refs/heads/myBranch", "oldCommitId": "26a8f2EXAMPLE" } }

AWS CodeDeploy Events

The following are examples of the events for AWS CodeDeploy. For more information, see Monitoring Deployments with CloudWatch Events in the AWS CodeDeploy User Guide.

CodeDeploy Deployment State-change Notification

There was a change in the state of a deployment.

Copy
{ "account": "123456789012", "region": "us-east-1", "detail-type": "CodeDeploy Deployment State-change Notification", "source": "aws.codedeploy", "version": "0", "time": "2016-06-30T22:06:31Z", "id": "c071bfbf-83c4-49ca-a6ff-3df053957145", "resources": [ "arn:aws:codedeploy:us-east-1:123456789012:application:myApplication", "arn:aws:codedeploy:us-east-1:123456789012:deploymentgroup:myApplication/myDeploymentGroup" ], "detail": { "instanceGroupId": "9fd2fbef-2157-40d8-91e7-6845af69e2d2", "region": "us-east-1", "application": "myApplication", "deploymentId": "d-123456789", "state": "SUCCESS", "deploymentGroup": "myDeploymentGroup" } }

CodeDeploy Instance State-change Notification

There was a change in the state of an instance that belongs to a deployment group.

Copy
{ "account": "123456789012", "region": "us-east-1", "detail-type": "CodeDeploy Instance State-change Notification", "source": "aws.codedeploy", "version": "0", "time": "2016-06-30T23:18:50Z", "id": "fb1d3015-c091-4bf9-95e2-d98521ab2ecb", "resources": [ "arn:aws:ec2:us-east-1:123456789012:instance/i-0000000aaaaaaaaaa", "arn:aws:codedeploy:us-east-1:123456789012:deploymentgroup:myApplication/myDeploymentGroup", "arn:aws:codedeploy:us-east-1:123456789012:application:myApplication" ], "detail": { "instanceId": "i-0000000aaaaaaaaaa", "region": "us-east-1", "state": "SUCCESS", "application": "myApplication", "deploymentId": "d-123456789", "instanceGroupId": "8cd3bfa8-9e72-4cbe-a1e5-da4efc7efd49", "deploymentGroup": "myDeploymentGroup" } }

AWS CodePipeline Events

The following are examples of events for AWS CodePipeline.

Pipeline Execution State Change

Copy
{ "version": "0", "id": "CWE-event-id", "detail-type": "CodePipeline Pipeline Execution State Change", "source": "aws.codepipeline", "account": "123456789012", "time": "2017-04-22T03:31:47Z", "region": "us-east-1", "resources": [ "arn:aws:codepipeline:us-east-1:123456789012:pipeline:myPipeline" ], "detail": { "pipeline": "myPipeline", "version": "1", "state": "STARTED", "execution-id": "01234567-0123-0123-0123-012345678901" } }

Stage Execution State Change

Copy
{ "version": "0", "id": "CWE-event-id", "detail-type": "CodePipeline Stage Execution State Change", "source": "aws.codepipeline", "account": "123456789012", "time": "2017-04-22T03:31:47Z", "region": "us-east-1", "resources": [ "arn:aws:codepipeline:us-east-1:123456789012:pipeline:myPipeline" ], "detail": { "pipeline": "myPipeline", "version": "1", "execution-id": "01234567-0123-0123-0123-012345678901", "stage": "Prod", "state": "STARTED" } }

Action Execution State Change

Copy
{ "version": "0", "id": "CWE-event-id", "detail-type": "CodePipeline Action Execution State Change", "source": "aws.codepipeline", "account": "123456789012", "time": "2017-04-22T03:31:47Z", "region": "us-east-1", "resources": [ "arn:aws:codepipeline:us-east-1:123456789012:pipeline:myPipeline" ], "detail": { "pipeline": "myPipeline", "version": 1, "execution-id": "01234567-0123-0123-0123-012345678901", "stage": "Prod", "action": "myAction", "state": "STARTED", "type": { "owner": "AWS", "category": "Deploy", "provider": "CodeDeploy", "version": 1 } } }

AWS Management Console Sign-in Events

Console sign-in events are supported only in the US East (N. Virginia) region. The following is an example of a console sign-in event:

Copy
{ "id": "6f87d04b-9f74-4f04-a780-7acf4b0a9b38", "detail-type": "AWS Console Sign In via CloudTrail", "source": "aws.signin", "account": "123456789012", "time": "2016-01-05T18:21:27Z", "region": "us-east-1", "resources": [], "detail": { "eventVersion": "1.02", "userIdentity": { "type": "Root", "principalId": "123456789012", "arn": "arn:aws:iam::123456789012:root", "accountId": "123456789012" }, "eventTime": "2016-01-05T18:21:27Z", "eventSource": "signin.amazonaws.com", "eventName": "ConsoleLogin", "awsRegion": "us-east-1", "sourceIPAddress": "0.0.0.0", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.106 Safari/537.36", "requestParameters": null, "responseElements": { "ConsoleLogin": "Success" }, "additionalEventData": { "LoginTo": "https://console.aws.amazon.com/console/home?state=hashArgs%23&isauthcode=true", "MobileVersion": "No", "MFAUsed": "No" }, "eventID": "324731c0-64b3-4421-b552-dfc3c27df4f6", "eventType": "AwsConsoleSignIn" } }

Amazon EBS Events

The following are examples of the events for Amazon Elastic Block Store (Amazon EBS). For more information, see Amazon CloudWatch Events for Amazon EBS in the Amazon EC2 User Guide for Linux Instances.

EBS Snapshot Notification

Amazon EBS created a snapshot (createSnapshot), copied a snapshot (copySnapshot), or shared a snapshot (shareSnapshot). The source field within the detail field does not include the account-id as part of the volume ARN.

Copy
{ "version": "0", "id": "01234567-0123-0123-0123-012345678901", "detail-type": "EBS Snapshot Notification", "source": "aws.ec2", "account": "123456789012", "time": "2016-11-14T01:30:00Z", "region": "us-east-1", "resources": [ "arn:aws:ec2::us-west-2:snapshot/snap-01234567" ], "detail": { "event": "createSnapshot", "result": "succeeded", "cause": "", "request-id": "", "snapshot_id": "arn:aws:ec2::us-west-2:snapshot/snap-01234567", "source": "arn:aws:ec2::us-west-2:volume/vol-01234567", "StartTime": "2016-11-14T00:00:00Z", "EndTime": "2016-11-ddT01:30:00Z" } }

EBS Volume Notification

When a volume is successfully created or deleted, no events are generated. Events are generated when Amazon EBS fails to create a volume (createVolume), fails to attach a volume (attachVolume), or fails to reattach a volume (reattachVolume). The following example shows a failed attempt to create a volume.

Copy
{ "version": "0", "id": "01234567-0123-0123-0123-0123456789ab", "detail-type": "EBS Volume Notification", "source": "aws.ec2", "account": "012345678901", "time": "2016-11-14T00:30:07Z", "region": "sa-east-1", "resources": [ "arn:aws:ec2:sa-east-1:0123456789ab:volume/vol-01234567", ], "detail": { "event": "createVolume", "result": "failed", "cause": "arn:aws:kms:sa-east-1:0123456789ab:key/01234567-0123-0123-0123-0123456789ab is disabled.", "request-id": "01234567-0123-0123-0123-0123456789ab", }

Amazon EC2 Events

The following is an example of an EC2 Instance State-change Notification event, with an instance in the pending state. The other possible values for state include running, shutting-down, stopped, stopping, and terminated.

Copy
{ "id":"7bf73129-1428-4cd3-a780-95db273d1602", "detail-type":"EC2 Instance State-change Notification", "source":"aws.ec2", "account":"123456789012", "time":"2015-11-11T21:29:54Z", "region":"us-east-1", "resources":[ "arn:aws:ec2:us-east-1:123456789012:instance/i-abcd1111" ], "detail":{ "instance-id":"i-abcd1111", "state":"pending" } }

Amazon EC2 Systems Manager Events

The following are examples of the events for Amazon EC2 Systems Manager. For more information, see Log Command Execution Status Changes for Run Command in the Amazon EC2 User Guide for Linux Instances.

Run Command Status-change Notification

Copy
{ "version": "0", "id": "51c0891d-0e34-45b1-83d6-95db273d1602", "detail-type": "EC2 Command Status-change Notification", "source": "aws.ssm", "account": "123456789012", "time": "2016-07-10T21:51:32Z", "region": "us-east-1", "resources": ["arn:aws:ec2:us-east-1:123456789012:instance/i-abcd1111"], "detail": { "command-id": "e8d3c0e4-71f7-4491-898f-c9b35bee5f3b", "document-name": "AWS-RunPowerShellScript", "expire-after": "2016-07-14T22:01:30.049Z", "parameters": { "executionTimeout": ["3600"], "commands": ["date"] }, "requested-date-time": "2016-07-10T21:51:30.049Z", "status": "Success" } }

Run Command Invocation Status-change Notification

Copy
{ "version": "0", "id": "4780e1b8-f56b-4de5-95f2-95db273d1602", "detail-type": "EC2 Command Invocation Status-change Notification", "source": "aws.ssm", "account": "123456789012", "time": "2016-07-10T21:51:32Z", "region": "us-east-1", "resources": ["arn:aws:ec2:us-east-1:123456789012:instance/i-abcd1111"], "detail": { "command-id": "e8d3c0e4-71f7-4491-898f-c9b35bee5f3b", "document-name": "AWS-RunPowerShellScript", "instance-id": "i-9bb89e2b", "requested-date-time": "2016-07-10T21:51:30.049Z", "status": "Success" } }

Automation Step Status-change Notification

Copy
{ "version": "0", "id": "eeca120b-a321-433e-9635-dab369006a6b", "detail-type": "EC2 Automation Step Status-change Notification", "source": "aws.ssm", "account": "123456789012", "time": "2016-11-29T19:43:35Z", "region": "us-east-1", "resources": ["arn:aws:ssm:us-east-1:123456789012:automation-execution/333ba70b-2333-48db-b17e-a5e69c6f4d1c", "arn:aws:ssm:us-east-1:123456789012:automation-definition/runcommand1:1"], "detail": { "ExecutionId": "333ba70b-2333-48db-b17e-a5e69c6f4d1c", "Definition": "runcommand1", "DefinitionVersion": 1.0, "Status": "Success", "EndTime": "Nov 29, 2016 7:43:25 PM", "StartTime": "Nov 29, 2016 7:43:23 PM", "Time": 2630.0, "StepName": "runFixedCmds", "Action": "aws:runCommand" } }

Automation Execution Status-change Notification

Copy
{ "version": "0", "id": "d290ece9-1088-4383-9df6-cd5b4ac42b99", "detail-type": "EC2 Automation Execution Status-change Notification", "source": "aws.ssm", "account": "123456789012", "time": "2016-11-29T19:43:35Z", "region": "us-east-1", "resources": ["arn:aws:ssm:us-east-1:123456789012:automation-execution/333ba70b-2333-48db-b17e-a5e69c6f4d1c", "arn:aws:ssm:us-east-1:123456789012:automation-definition/runcommand1:1"], "detail": { "ExecutionId": "333ba70b-2333-48db-b17e-a5e69c6f4d1c", "Definition": "runcommand1", "DefinitionVersion": 1.0, "Status": "Success", "StartTime": "Nov 29, 2016 7:43:20 PM", "EndTime": "Nov 29, 2016 7:43:26 PM", "Time": 5753.0, "ExecutedBy": "arn:aws:iam::123456789012:user/userName" } }

State Manager Association State Change

Copy
{ "version":"0", "id":"db839caf-6f6c-40af-9a48-25b2ae2b7774", "detail-type":"EC2 State Manager Association State Change", "source":"aws.ssm", "account":"123456789012", "time":"2017-05-16T23:01:10Z", "region":"us-west-1", "resources":[ "arn:aws:ssm:us-west-1::document/AWS-RunPowerShellScript" ], "detail":{ "association-id":"6e37940a-23ba-4ab0-9b96-5d0a1a05464f", "document-name":"AWS-RunPowerShellScript", "association-version":"1", "document-version":"Optional.empty", "targets":"[{\"key\":\"InstanceIds\",\"values\":[\"i-12345678\"]}]", "creation-date":"2017-02-13T17:22:54.458Z", "last-successful-execution-date":"2017-05-16T23:00:01Z", "last-execution-date":"2017-05-16T23:00:01Z", "last-updated-date":"2017-02-13T17:22:54.458Z", "status":"Success", "association-status-aggregated-count":"{\"Success\":1}", "schedule-expression":"cron(0 */30 * * * ? *)", "association-cwe-version":"1.0" } }

State Manager Instance Association State Change

Copy
{ "version":"0", "id":"6a7e8feb-b491-4cf7-a9f1-bf3703467718", "detail-type":"EC2 State Manager Instance Association State Change", "source":"aws.ssm", "account":"123456789012", "time":"2017-02-23T15:23:48Z", "region":"us-east-1", "resources":[ "arn:aws:ec2:us-east-1:123456789012:instance/i-12345678", "arn:aws:ssm:us-east-1:123456789012:document/my-custom-document" ], "detail":{ "association-id":"34fcb7e0-9a14-4984-9989-0e04e3f60bd8", "instance-id":"i-12345678", "document-name":"my-custom-document", "document-version":"1", "targets":"[{\"key\":\"instanceids\",\"values\":[\"i-12345678\"]}]", "creation-date":"2017-02-23T15:23:48Z", "last-successful-execution-date":"2017-02-23T16:23:48Z", "last-execution-date":"2017-02-23T16:23:48Z", "status":"Success", "detailed-status":"", "error-code":"testErrorCode", "execution-summary":"testExecutionSummary", "output-url":"sampleurl", "instance-association-cwe-version":"1" } }

Amazon EC2 Systems Manager Parameter Store Events

The following are examples of the events for Amazon EC2 Systems Manager (SSM) Parameter Store.

Create Parameter

Copy
{ "version": "0", "id": "6a7e4feb-b491-4cf7-a9f1-bf3703497718", "detail-type": "Parameter Store Change", "source": "aws.ssm", "account": "123456789012", "time": "2017-05-22T16:43:48Z", "region": "us-east-1", "resources": [ "arn:aws:ssm:us-east-1:123456789012:parameter/foo" ], "detail": { "operation": "Create", "name": "foo", "type": "String", "description": "Sample Parameter" } }

Update Parameter

Copy
{ "version": "0", "id": "9547ef2d-3b7e-4057-b6cb-5fdf09ee7c8f", "detail-type": "Parameter Store Change", "source": "aws.ssm", "account": "123456789012", "time": "2017-05-22T16:44:48Z", "region": "us-east-1", "resources": [ "arn:aws:ssm:us-east-1:123456789012:parameter/foo" ], "detail": { "operation": "Update", "name": "foo", "type": "String", "description": "Sample Parameter" } }

Delete Parameter

Copy
{ "version": "0", "id": "80e9b391-6a9b-413c-839a-453b528053af", "detail-type": "Parameter Store Change", "source": "aws.ssm", "account": "123456789012", "time": "2017-05-22T16:45:48Z", "region": "us-east-1", "resources": [ "arn:aws:ssm:us-east-1:123456789012:parameter/foo" ], "detail": { "operation": "Delete", "name": "foo", "type": "String", "description": "Sample Parameter" } }

Amazon EC2 Systems Manager Configuration Compliance Events

The following are examples of the events for Amazon EC2 Systems Manager (SSM) configuration compliance.

Association Compliant

Copy
{ "version": "0", "id": "01234567-0123-0123-0123-012345678901", "detail-type": "Configuration Compliance State Change", "source": "aws.ssm", "account": "123456789012", "time": "2017-07-17T19:03:26Z", "region": "us-west-1", "resources": [ "arn:aws:ssm:us-west-1:461348341421:managed-instance/i-01234567890abcdef" ], "detail": { "last-runtime": "2017-01-01T10:10:10Z", "compliance-status": "compliant", "resource-type": "managed-instance", "resource-id": "i-01234567890abcdef", "compliance-type": "Association" } }

Association Non-Compliant

Copy
{ "version": "0", "id": "01234567-0123-0123-0123-012345678901", "detail-type": "Configuration Compliance State Change", "source": "aws.ssm", "account": "123456789012", "time": "2017-07-17T19:02:31Z", "region": "us-west-1", "resources": [ "arn:aws:ssm:us-west-1:461348341421:managed-instance/i-01234567890abcdef" ], "detail": { "last-runtime": "2017-01-01T10:10:10Z", "compliance-status": "non_compliant", "resource-type": "managed-instance", "resource-id": "i-01234567890abcdef", "compliance-type": "Association" } }

Patch Compliant

Copy
{ "version": "0", "id": "01234567-0123-0123-0123-012345678901", "detail-type": "Configuration Compliance State Change", "source": "aws.ssm", "account": "123456789012", "time": "2017-07-17T19:03:26Z", "region": "us-west-1", "resources": [ "arn:aws:ssm:us-west-1:461348341421:managed-instance/i-01234567890abcdef" ], "detail": { "resource-type": "managed-instance", "resource-id": "i-01234567890abcdef", "compliance-status": "compliant", "compliance-type": "Patch", "patch-baseline-id": "PB789", "severity": "critical" } }

Patch Non-Compliant

Copy
{ "version": "0", "id": "01234567-0123-0123-0123-012345678901", "detail-type": "Configuration Compliance State Change", "source": "aws.ssm", "account": "123456789012", "time": "2017-07-17T19:02:31Z", "region": "us-west-1", "resources": [ "arn:aws:ssm:us-west-1:461348341421:managed-instance/i-01234567890abcdef" ], "detail": { "resource-type": "managed-instance", "resource-id": "i-01234567890abcdef", "compliance-status": "non_compliant", "compliance-type": "Patch", "patch-baseline-id": "PB789", "severity": "critical" } }

Amazon EC2 Maintenance Windows Events

The following are examples of the events for Amazon EC2 Maintenance Windows.

Register a Target

The status could also be DEREGISTERED.

Copy
{ "version":"0", "id":"01234567-0123-0123-0123-0123456789ab", "detail-type":"Maintenance Window Target Registration Notification", "source":"aws.ssm", "account":"012345678901", "time":"2016-11-16T00:58:37Z", "region":"us-east-1", "resources":[ "arn:aws:ssm:us-west-2:001312665065:maintenancewindow/mw-0ed7251d3fcf6e0c2", "arn:aws:ssm:us-west-2:001312665065:windowtarget/e7265f13-3cc5-4f2f-97a9-7d3ca86c32a6" ], "detail":{ "window-target-id":"e7265f13-3cc5-4f2f-97a9-7d3ca86c32a6", "window-id":"mw-0ed7251d3fcf6e0c2", "status":"REGISTERED" } }

Window Execution Type

The other possibilities for status are PENDING, IN_PROGRESS, SUCCESS, FAILED, TIMED_OUT, and SKIPPED_OVERLAPPING.

Copy
{ "version":"0", "id":"01234567-0123-0123-0123-0123456789ab", "detail-type":"Maintenance Window Execution State-change Notification", "source":"aws.ssm", "account":"012345678901", "time":"2016-11-16T01:00:57Z", "region":"us-east-1", "resources":[ "arn:aws:ssm:us-west-2:0123456789ab:maintenancewindow/mw-123456789012345678" ], "detail":{ "start-time":"2016-11-16T01:00:56.427Z", "end-time":"2016-11-16T01:00:57.070Z", "window-id":"mw-0ed7251d3fcf6e0c2", "window-execution-id":"b60fb56e-776c-4e5c-84ee-123456789012", "status":"TIMED_OUT" } }

Task Execution Type

The other possibilities for status are IN_PROGRESS, SUCCESS, FAILED, and TIMED_OUT.

Copy
{ "version":"0", "id":"01234567-0123-0123-0123-0123456789ab", "detail-type":"Maintenance Window Task Execution State-change Notification", "source":"aws.ssm", "account":"012345678901", "time":"2016-11-16T01:00:56Z", "region":"us-east-1", "resources":[ "arn:aws:ssm:us-west-2:0123456789ab:maintenancewindow/mw-123456789012345678" ], "detail":{ "start-time":"2016-11-16T01:00:56.759Z", "task-execution-id":"6417e808-7f35-4d1a-843f-123456789012", "end-time":"2016-11-16T01:00:56.847Z", "window-id":"mw-0ed7251d3fcf6e0c2", "window-execution-id":"b60fb56e-776c-4e5c-84ee-123456789012", "status":"TIMED_OUT" } }

Task Target Processed

The other possibilities for status are IN_PROGRESS, SUCCESS, FAILED, and TIMED_OUT.

Copy
{ "version":"0", "id":"01234567-0123-0123-0123-0123456789ab", "detail-type":"Maintenance Window Task Target Invocation State-change Notification", "source":"aws.ssm", "account":"012345678901", "time":"2016-11-16T01:00:57Z", "region":"us-east-1", "resources":[ "arn:aws:ssm:us-west-2:0123456789ab:maintenancewindow/mw-123456789012345678" ], "detail":{ "start-time":"2016-11-16T01:00:56.427Z", "end-time":"2016-11-16T01:00:57.070Z", "window-id":"mw-0ed7251d3fcf6e0c2", "window-execution-id":"b60fb56e-776c-4e5c-84ee-123456789012", "task-execution-id":"6417e808-7f35-4d1a-843f-123456789012", "window-target-id":"e7265f13-3cc5-4f2f-97a9-123456789012", "status":"TIMED_OUT", "owner-information":"Owner" } }

Window State Change

The possibilities for status are ENABLED and DISABLED.

Copy
{ "version":"0", "id":"01234567-0123-0123-0123-0123456789ab", "detail-type":"Maintenance Window State-change Notification", "source":"aws.ssm", "account":"012345678901", "time":"2016-11-16T00:58:37Z", "region":"us-east-1", "resources":[ "arn:aws:ssm:us-west-2:0123456789ab:maintenancewindow/mw-123456789012345678" ], "detail":{ "window-id":"mw-123456789012", "status":"DISABLED" } }

Amazon ECS Events

The following are examples of the events for Amazon EC2 Container Service (Amazon ECS). For more information, see Amazon ECS Event Stream for CloudWatch Events in the Amazon EC2 Container Service Developer Guide.

ECS Container Instance State Change

The contents of the detail section are not shown here. They resemble the contents of the ContainerInstance object.

Copy
{ "version": "0", "id": "01234567-0123-0123-0123-0123456789ab", "detail-type": "ECS Container Instance State Change", "source": "aws.ecs", "account": "123456789012", "time": "2016-11-18T22:15:15Z", "region": "us-west-2", "resources": [ "arn:aws:ecs:us-west-2:123456789012:container-instance/a48e7e5a-4709-47b3-a698-819dab95c16f" ], "detail": { ... } }

ECS Task State Change

The contents of the detail section are not shown here. They resemble the contents of the Task object.

Copy
{ "version": "0", "id": "2d882db5-3d34-4d75-b299-5a6af9d2a59c", "detail-type": "ECS Task State Change", "source": "aws.ecs", "account": "123456789012", "time": "2016-11-18T22:48:57Z", "region": "us-west-2", "resources": [ "arn:aws:ecs:us-west-2:123456789012:task/9dd06983-dfd7-437c-8bb1-0dc78d90da91" ], "detail": { ... } }

Amazon EMR Events

The following are examples of events for Amazon EMR.

Amazon EMR Auto Scaling Policy State Change

Copy
{ "version":"0", "id":"2f8147ab-8c48-47c6-b0b6-3ee23ec8d300", "detail-type":"EMR Auto Scaling Policy State Change", "source":"aws.emr", "account":"123456789012", "time":"2016-12-16T20:42:44Z", "region":"us-east-1", "resources":[], "detail":{ "resourceId":"ig-X2LBMHTGPCBU", "clusterId":"j-1YONHTCP3YZKC", "state":"PENDING", "message":"AutoScaling policy modified by user request", "scalingResourceType":"INSTANCE_GROUP" } }

Amazon EMR Cluster State Change – Starting

Copy
{ "version": "0", "id": "999cccaa-eaaa-0000-1111-123456789012", "detail-type": "EMR Cluster State Change", "source": "aws.emr", "account": "123456789012", "time": "2016-12-16T20:43:05Z", "region": "us-east-1", "resources": [], "detail": { "severity": "INFO", "stateChangeReason": "{\"code\":\"\"}", "name": "Development Cluster", "clusterId": "j-123456789ABCD", "state": "STARTING", "message": "Amazon EMR cluster j-123456789ABCD (Development Cluster) was requested at 2016-12-16 20:42 UTC and is being created." } }

Amazon EMR Cluster State Change – Terminated

Copy
{ "version": "0", "id": "1234abb0-f87e-1234-b7b6-000000123456", "detail-type": "EMR Cluster State Change", "source": "aws.emr", "account": "123456789012", "time": "2016-12-16T21:00:23Z", "region": "us-east-1", "resources": [], "detail": { "severity": "INFO", "stateChangeReason": "{\"code\":\"USER_REQUEST\",\"message\":\"Terminated by user request\"}", "name": "Development Cluster", "clusterId": "j-123456789ABCD", "state": "TERMINATED", "message": "Amazon EMR Cluster jj-123456789ABCD (Development Cluster) has terminated at 2016-12-16 21:00 UTC with a reason of USER_REQUEST." } }

Amazon EMR Instance Group State Change

Copy
{ "version": "0", "id": "999cccaa-eaaa-0000-1111-123456789012", "detail-type": "EMR Instance Group State Change", "source": "aws.emr", "account": "123456789012", "time": "2016-12-16T20:57:47Z", "region": "us-east-1", "resources": [], "detail": { "market": "ON_DEMAND", "severity": "INFO", "requestedInstanceCount": "2", "instanceType": "m3.xlarge", "instanceGroupType": "CORE", "instanceGroupId": "ig-ABCDEFGHIJKL", "clusterId": "j-123456789ABCD", "runningInstanceCount": "2", "state": "RUNNING", "message": "The resizing operation for instance group ig-ABCDEFGHIJKL in Amazon EMR cluster j-123456789ABCD (Development Cluster) is complete. It now has an instance count of 2. The resize started at 2016-12-16 20:57 UTC and took 0 minutes to complete." } }

Amazon EMR Step Status Change

Copy
{ "version": "0", "id": "999cccaa-eaaa-0000-1111-123456789012", "detail-type": "EMR Step Status Change", "source": "aws.emr", "account": "123456789012", "time": "2016-12-16T20:53:09Z", "region": "us-east-1", "resources": [], "detail": { "severity": "ERROR", "actionOnFailure": "CONTINUE", "stepId": "s-ZYXWVUTSRQPON", "name": "CustomJAR", "clusterId": "j-123456789ABCD", "state": "FAILED", "message": "Step s-ZYXWVUTSRQPON (CustomJAR) in Amazon EMR cluster j-123456789ABCD (Development Cluster) failed at 2016-12-16 20:53 UTC." } }

Amazon GameLift Event

The following are examples of Amazon GameLift events. For more information, see FlexMatch Events Reference in the Amazon GameLift Developer Guide.

Matchmaking Searching

Copy
{ "version": "0", "id": "cc3d3ebe-1d90-48f8-b268-c96655b8f013", "detail-type": "GameLift Matchmaking Event", "source": "aws.gamelift", "account": "123456789012", "time": "2017-08-08T21:15:36.421Z", "region": "us-west-2", "resources": [ "arn:aws:gamelift:us-west-2:123456789012:matchmakingconfiguration/SampleConfiguration" ], "detail": { "tickets": [ { "ticketId": "ticket-1", "startTime": "2017-08-08T21:15:35.676Z", "players": [ { "playerId": "player-1" } ] } ], "estimatedWaitMillis": "NOT_AVAILABLE", "type": "MatchmakingSearching", "gameSessionInfo": { "players": [ { "playerId": "player-1" } ] } } }

Potential Match Created

Copy
{ "version": "0", "id": "fce8633f-aea3-45bc-aeba-99d639cad2d4", "detail-type": "GameLift Matchmaking Event", "source": "aws.gamelift", "account": "123456789012", "time": "2017-08-08T21:17:41.178Z", "region": "us-west-2", "resources": [ "arn:aws:gamelift:us-west-2:123456789012:matchmakingconfiguration/SampleConfiguration" ], "detail": { "tickets": [ { "ticketId": "ticket-1", "startTime": "2017-08-08T21:15:35.676Z", "players": [ { "playerId": "player-1", "team": "red" } ] }, { "ticketId": "ticket-2", "startTime": "2017-08-08T21:17:40.657Z", "players": [ { "playerId": "player-2", "team": "blue" } ] } ], "acceptanceTimeout": 600, "ruleEvaluationMetrics": [ { "ruleName": "EvenSkill", "passedCount": 3, "failedCount": 0 }, { "ruleName": "EvenTeams", "passedCount": 3, "failedCount": 0 }, { "ruleName": "FastConnection", "passedCount": 3, "failedCount": 0 }, { "ruleName": "NoobSegregation", "passedCount": 3, "failedCount": 0 } ], "acceptanceRequired": true, "type": "PotentialMatchCreated", "gameSessionInfo": { "players": [ { "playerId": "player-1", "team": "red" }, { "playerId": "player-2", "team": "blue" } ] }, "matchId": "3faf26ac-f06e-43e5-8d86-08feff26f692" } }

Accept Match

Copy
{ "version": "0", "id": "b3f76d66-c8e5-416a-aa4c-aa1278153edc", "detail-type": "GameLift Matchmaking Event", "source": "aws.gamelift", "account": "123456789012", "time": "2017-08-09T20:04:42.660Z", "region": "us-west-2", "resources": [ "arn:aws:gamelift:us-west-2:123456789012:matchmakingconfiguration/SampleConfiguration" ], "detail": { "tickets": [ { "ticketId": "ticket-1", "startTime": "2017-08-09T20:01:35.305Z", "players": [ { "playerId": "player-1", "team": "red" } ] }, { "ticketId": "ticket-2", "startTime": "2017-08-09T20:04:16.637Z", "players": [ { "playerId": "player-2", "team": "blue", "accepted": false } ] } ], "type": "AcceptMatch", "gameSessionInfo": { "players": [ { "playerId": "player-1", "team": "red" }, { "playerId": "player-2", "team": "blue", "accepted": false } ] }, "matchId": "848b5f1f-0460-488e-8631-2960934d13e5" } }

Accept Match Completed

Copy
{ "version": "0", "id": "b1990d3d-f737-4d6c-b150-af5ace8c35d3", "detail-type": "GameLift Matchmaking Event", "source": "aws.gamelift", "account": "123456789012", "time": "2017-08-08T20:43:14.621Z", "region": "us-west-2", "resources": [ "arn:aws:gamelift:us-west-2:123456789012:matchmakingconfiguration/SampleConfiguration" ], "detail": { "tickets": [ { "ticketId": "ticket-1", "startTime": "2017-08-08T20:30:40.972Z", "players": [ { "playerId": "player-1", "team": "red" } ] }, { "ticketId": "ticket-2", "startTime": "2017-08-08T20:33:14.111Z", "players": [ { "playerId": "player-2", "team": "blue" } ] } ], "acceptance": "TimedOut", "type": "AcceptMatchCompleted", "gameSessionInfo": { "players": [ { "playerId": "player-1", "team": "red" }, { "playerId": "player-2", "team": "blue" } ] }, "matchId": "a0d9bd24-4695-4f12-876f-ea6386dd6dce" } }

Matchmaking Succeeded

Copy
{ "version": "0", "id": "5ccb6523-0566-412d-b63c-1569e00d023d", "detail-type": "GameLift Matchmaking Event", "source": "aws.gamelift", "account": "123456789012", "time": "2017-08-09T19:59:09.159Z", "region": "us-west-2", "resources": [ "arn:aws:gamelift:us-west-2:123456789012:matchmakingconfiguration/SampleConfiguration" ], "detail": { "tickets": [ { "ticketId": "ticket-1", "startTime": "2017-08-09T19:58:59.277Z", "players": [ { "playerId": "player-1", "playerSessionId": "psess-6e7c13cf-10d6-4756-a53f-db7de782ed67", "team": "red" } ] }, { "ticketId": "ticket-2", "startTime": "2017-08-09T19:59:08.663Z", "players": [ { "playerId": "player-2", "playerSessionId": "psess-786b342f-9c94-44eb-bb9e-c1de46c472ce", "team": "blue" } ] } ], "type": "MatchmakingSucceeded", "gameSessionInfo": { "gameSessionArn": "arn:aws:gamelift:us-west-2:123456789012:gamesession/836cf48d-bcb0-4a2c-bec1-9c456541352a", "ipAddress": "192.168.1.1", "port": 10777, "players": [ { "playerId": "player-1", "playerSessionId": "psess-6e7c13cf-10d6-4756-a53f-db7de782ed67", "team": "red" }, { "playerId": "player-2", "playerSessionId": "psess-786b342f-9c94-44eb-bb9e-c1de46c472ce", "team": "blue" } ] }, "matchId": "c0ec1a54-7fec-4b55-8583-76d67adb7754" } }

Matchmaking Timed Out

Copy
{ "version": "0", "id": "fe528a7d-46ad-4bdc-96cb-b094b5f6bf56", "detail-type": "GameLift Matchmaking Event", "source": "aws.gamelift", "account": "123456789012", "time": "2017-08-09T20:11:35.598Z", "region": "us-west-2", "resources": [ "arn:aws:gamelift:us-west-2:123456789012:matchmakingconfiguration/SampleConfiguration" ], "detail": { "reason": "TimedOut", "tickets": [ { "ticketId": "ticket-1", "startTime": "2017-08-09T20:01:35.305Z", "players": [ { "playerId": "player-1", "team": "red" } ] } ], "ruleEvaluationMetrics": [ { "ruleName": "EvenSkill", "passedCount": 3, "failedCount": 0 }, { "ruleName": "EvenTeams", "passedCount": 3, "failedCount": 0 }, { "ruleName": "FastConnection", "passedCount": 3, "failedCount": 0 }, { "ruleName": "NoobSegregation", "passedCount": 3, "failedCount": 0 } ], "type": "MatchmakingTimedOut", "message": "Removed from matchmaking due to timing out.", "gameSessionInfo": { "players": [ { "playerId": "player-1", "team": "red" } ] } } }

Matchmaking Cancelled

Copy
{ "version": "0", "id": "8d6f84da-5e15-4741-8d5c-5ac99091c27f", "detail-type": "GameLift Matchmaking Event", "source": "aws.gamelift", "account": "123456789012", "time": "2017-08-09T20:00:07.843Z", "region": "us-west-2", "resources": [ "arn:aws:gamelift:us-west-2:123456789012:matchmakingconfiguration/SampleConfiguration" ], "detail": { "reason": "Cancelled", "tickets": [ { "ticketId": "ticket-1", "startTime": "2017-08-09T19:59:26.118Z", "players": [ { "playerId": "player-1" } ] } ], "ruleEvaluationMetrics": [ { "ruleName": "EvenSkill", "passedCount": 0, "failedCount": 0 }, { "ruleName": "EvenTeams", "passedCount": 0, "failedCount": 0 }, { "ruleName": "FastConnection", "passedCount": 0, "failedCount": 0 }, { "ruleName": "NoobSegregation", "passedCount": 0, "failedCount": 0 } ], "type": "MatchmakingCancelled", "message": "Cancelled by request.", "gameSessionInfo": { "players": [ { "playerId": "player-1" } ] } } }

Matchmaking Failed

Copy
{ "version": "0", "id": "025b55a4-41ac-4cf4-89d1-f2b3c6fd8f9d", "detail-type": "GameLift Matchmaking Event", "source": "aws.gamelift", "account": "123456789012", "time": "2017-08-16T18:41:09.970Z", "region": "us-west-2", "resources": [ "arn:aws:gamelift:us-west-2:123456789012:matchmakingconfiguration/SampleConfiguration" ], "detail": { "tickets": [ { "ticketId": "ticket-1", "startTime": "2017-08-16T18:41:02.631Z", "players": [ { "playerId": "player-1", "team": "red" } ] } ], "customEventData": "foo", "type": "MatchmakingFailed", "reason": "UNEXPECTED_ERROR", "message": "An unexpected error was encountered during match placing.", "gameSessionInfo": { "players": [ { "playerId": "player-1", "team": "red" } ] }, "matchId": "3ea83c13-218b-43a3-936e-135cc570cba7" } }

AWS Glue Events

The following is the format for AWS Glue events.

Successful Job Run

Copy
{ "version":"0", "id":"abcdef00-1234-5678-9abc-def012345678", "detail-type":"Glue Job State Change", "source":"aws.glue", "account":"123456789012", "time":"2017-09-07T18:57:21Z", "region":"us-west-2", "resources":[], "detail":{ "jobName":"MyJob", "severity":"INFO", "state":"SUCCEEDED", "jobRunId":"jr_abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789", "message":"Job run succeeded" } }

Failed Job Run

Copy
{ "version":"0", "id":"abcdef01-1234-5678-9abc-def012345678", "detail-type":"Glue Job State Change", "source":"aws.glue", "account":"123456789012", "time":"2017-09-07T06:02:03Z", "region":"us-west-2", "resources":[], "detail":{ "jobName":"MyJob", "severity":"ERROR", "state":"FAILED", "jobRunId":"jr_0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef", "message":"JobName:MyJob and JobRunId:jr_0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef failed to execute with exception Role arn:aws:iam::123456789012:role/Glue_Role should be given assume role permissions for Glue Service." } }

AWS Health Events

The following is the format for the AWS Personal Health Dashboard (AWS Health) events. For more information, see Managing AWS Health Events with Amazon CloudWatch Events in the AWS Health User Guide.

AWS Health Event Format

Copy
{ "version": "0", "id": "7bf73129-1428-4cd3-a780-95db273d1602", "detail-type": "AWS Health Event", "source": "aws.health", "account": "123456789012", "time": "2016-06-05T06:27:57Z", "region": "region", "resources": [], "detail": { "eventArn": "arn:aws:health:region::event/id", "service": "service", "eventTypeCode": "AWS_service_code", "eventTypeCategory": "category", "startTime": "Sun, 05 Jun 2016 05:01:10 GMT", "endTime": "Sun, 05 Jun 2016 05:30:57 GMT", "eventDescription": [{ "language": "lang-code", "latestDescription": "description" }] ... } }
category

The category code of the event. The possible values are issue, accountNotification, and scheduledChange.

code

The unique identifier for the event type.

id

The unique identifier for the event.

service

The AWS service affected by the event. For example, EC2, S3, REDSHIFT, and RDS.

Elastic Load Balancing API Issue

Copy
{ "version": "0", "id": "121345678-1234-1234-1234-123456789012", "detail-type": "AWS Health Event", "source": "aws.health", "account": "123456789012", "time": "2016-06-05T06:27:57Z", "region": "ap-southeast-2", "resources": [], "detail": { "eventArn": "arn:aws:health:ap-southeast-2::event/AWS_ELASTICLOADBALANCING_API_ISSUE_90353408594353980", "service": "ELASTICLOADBALANCING", "eventTypeCode": "AWS_ELASTICLOADBALANCING_API_ISSUE", "eventTypeCategory": "issue", "startTime": "Sat, 11 Jun 2016 05:01:10 GMT", "endTime": "Sat, 11 Jun 2016 05:30:57 GMT", "eventDescription": [{ "language": "en_US", "latestDescription": "A description of the event will be provided here" } }

Amazon EC2 Instance Store Drive Performance Degraded

Copy
{ "version": "0", "id": "121345678-1234-1234-1234-123456789012", "detail-type": "AWS Health Event", "source": "aws.health", "account": "123456789012", "time": "2016-06-05T06:27:57Z", "region": "us-west-2", "resources": [ "i-abcd1111" ], "detail": { "eventArn": "arn:aws:health:us-west-2::event/AWS_EC2_INSTANCE_STORE_DRIVE_PERFORMANCE_DEGRADED_90353408594353980", "service": "EC2", "eventTypeCode": "AWS_EC2_INSTANCE_STORE_DRIVE_PERFORMANCE_DEGRADED", "eventTypeCategory": "issue", "startTime": "Sat, 05 Jun 2016 15:10:09 GMT", "eventDescription": [{ "language": "en_US", "latestDescription": "A description of the event will be provided here" }], "affectedEntities": [{ "entityValue": "i-abcd1111", "tags": { "stage": "prod", "app": "my-app" } }

AWS KMS Events

The following are examples of the AWS Key Management Service (AWS KMS) events. For more information, see AWS KMS Events in the AWS Key Management Service Developer Guide.

KMS CMK Rotation

AWS KMS automatically rotated a CMK's key material.

Copy
{ "version": "0", "id": "6a7e8feb-b491-4cf7-a9f1-bf3703467718", "detail-type": "KMS CMK Rotation", "source": "aws.kms", "account": "111122223333", "time": "2016-08-25T21:05:33Z", "region": "us-west-2", "resources": [ "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab" ], "detail": { "key-id": "1234abcd-12ab-34cd-56ef-1234567890ab" } }

KMS Imported Key Material Expiration

AWS KMS deleted a CMK's expired key material.

Copy
{ "version": "0", "id": "9da9af57-9253-4406-87cb-7cc400e43465", "detail-type": "KMS Imported Key Material Expiration", "source": "aws.kms", "account": "111122223333", "time": "2016-08-22T20:12:19Z", "region": "us-west-2", "resources": [ "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab" ], "detail": { "key-id": "1234abcd-12ab-34cd-56ef-1234567890ab" } }

KMS CMK Deletion

AWS KMS completed a scheduled CMK deletion.

Copy
{ "version": "0", "id": "e9ce3425-7d22-412a-a699-e7a5fc3fbc9a", "detail-type": "KMS CMK Deletion", "source": "aws.kms", "account": "111122223333", "time": "2016-08-19T03:23:45Z", "region": "us-west-2", "resources": [ "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab" ], "detail": { "key-id": "1234abcd-12ab-34cd-56ef-1234567890ab" } }

Amazon Macie Events

The following are examples of Amazon Macie events.

Alert Created

Copy
{ "version": "0", "id": "CWE-event-id", "detail-type": "Macie Alert", "source": "aws.macie", "account": "123456789012", "time": "2017-04-24T22:28:49Z", "region": "us-east-1", "resources": [ "arn:aws:macie:us-east-1:123456789012:trigger/trigger_id/alert/alert_id", "arn:aws:macie:us-east-1:123456789012:trigger/trigger_id" ], "detail": { "notification-type": "ALERT_CREATED", "name": "Scanning bucket policies", "tags": [ "Custom_Alert", "Insider" ], "url": "https://lb00.us-east-1.macie.aws.amazon.com/111122223333/posts/alert_id", "alert-arn": "arn:aws:macie:us-east-1:123456789012:trigger/trigger_id/alert/alert_id", "risk-score": 80, "trigger": { "rule-arn": "arn:aws:macie:us-east-1:123456789012:trigger/trigger_id", "alert-type": "basic", "created-at": "2017-01-02 19:54:00.644000", "description": "Alerting on failed enumeration of large number of bucket policies", "risk": 8 }, "created-at": "2017-04-18T00:21:12.059000", "actor": "555566667777:assumed-role:superawesome:aroaidpldc7nsesfnheji", "summary": { "Description": "Alerting on failed enumeration of large number of bucket policies", "IP": { "34.199.185.34": 121, "34.205.153.2": 2, "72.21.196.70": 2 }, "Time Range": [ { "count": 125, "start": "2017-04-24T20:23:49Z", "end": "2017-04-24T20:25:54Z" } ], "Source ARN": "arn:aws:sts::123456789012:assumed-role/RoleName", "Record Count": 1, "Location": { "us-east-1": 125 }, "Event Count": 125, "Events": { "GetBucketLocation": { "count": 48, "ISP": { "Amazon": 48 } }, "ListRoles": { "count": 2, "ISP": { "Amazon": 2 } }, "GetBucketPolicy": { "count": 37, "ISP": { "Amazon": 37 }, "Error Code": { "NoSuchBucketPolicy": 22 } }, "GetBucketAcl": { "count": 37, "ISP": { "Amazon": 37 } }, "ListBuckets": { "count": 1, "ISP": { "Amazon": 1 } } }, "recipientAccountId": { "123456789012": 125 } } } }
Copy
{ "version": "0", "id": "CWE-event-id", "detail-type": "Macie Alert", "source": "aws.macie", "account": "123456789012", "time": "2017-04-18T18:15:41Z", "region": "us-east-1", "resources": [ "arn:aws:macie:us-east-1:123456789012:trigger/trigger_id/alert/alert_id", "arn:aws:macie:us-east-1:123456789012:trigger/trigger_id" ], "detail": { "notification-type": "ALERT_CREATED", "name": "Bucket is writable by all authenticated users", "tags": [ "Custom_Alert", "Audit" ], "url": "https://lb00.us-east-1.macie.aws.amazon.com/111122223333/posts/alert_id", "alert-arn": "arn:aws:macie:us-east-1:123456789012:trigger/trigger_id/alert/alert_id", "risk-score": 70, "trigger": { "rule-arn": "arn:aws:macie:us-east-1:123456789012:trigger/trigger_id", "alert-type": "basic", "created-at": "2017-04-08 00:21:30.749000", "description": "Bucket is writable by all authenticated users", "risk": 7 }, "created-at": "2017-04-18T18:16:17.046454", "actor": "444455556666", "summary": { "Description": "Bucket is writable by all authenticated users", "Bucket": { "secret-bucket-name": 1 }, "Record Count": 1, "ACL": { "secret-bucket-name": [ { "Owner": { "DisplayName": "bucket_owner", "ID": "089d2842f4b392f5c5c61f073bd2e4a37b3bb2e62659318c6960e8981648a17e" }, "Grants": [ { "Grantee": { "Type": "Group", "URI": "http://acs.amazonaws.com/groups/global/AuthenticatedUsers" }, "Permission": "WRITE" } ] } ] }, "Event Count": 1, "Timestamps": { "2017-01-10T22:48:06.784937": 1 } } } }

Alert Updated

Copy
{ "version": "0", "id": "CWE-event-id", "detail-type": "Macie Alert", "source": "aws.macie", "account": "123456789012", "time": "2017-04-18T17:47:48Z", "region": "us-east-1", "resources": [ "arn:aws:macie:us-east-1:123456789012:trigger/trigger_id/alert/alert_id", "arn:aws:macie:us-east-1:123456789012:trigger/trigger_id" ], "detail": { "notification-type": "ALERT_UPDATED", "name": "Public bucket contains high risk object", "tags": [ "Custom_Alert", "Audit" ], "url": "https://lb00.us-east-1.macie.aws.amazon.com/111122223333/posts/alert_id", "alert-arn": "arn:aws:macie:us-east-1:123456789012:trigger/trigger_id/alert/alert_id", "risk-score": 100, "trigger": { "rule-arn": "arn:aws:macie:us-east-1:123456789012:trigger/trigger_id", "alert-type": "basic", "created-at": "2017-04-08 00:23:39.138000", "description": "Public bucket contains high risk object", "risk": 10 }, "created-at": "2017-04-08T00:36:26.270000", "actor": "public_bucket", "summary": { "Description": "Public bucket contains high risk object", "Object": { "public_bucket/secret_key.txt": 1, "public_bucket/financial_summary.txt": 1 }, "Record Count": 2, "Themes": { "Secret Markings": 1, "Corporate Proposals": 1, "Confidential Markings": 1 }, "Event Count": 2, "DLP risk": { "7": 2 }, "Owner": { "bucket_owner": 2 }, "Timestamps": { "2017-04-03T16:12:53+00:00": 2 } } } }
Copy
{ "version": "0", "id": "CWE-event-id", "detail-type": "Macie Alert", "source": "aws.macie", "account": "123456789012", "time": "2017-04-22T03:31:47Z", "region": "us-east-1", "resources": [ "arn:aws:macie:us-east-1:123456789012:trigger/macie/alert/alert_id", "arn:aws:macie:us-east-1:123456789012:trigger/macie" ], "detail": { "notification-type": "ALERT_UPDATED", "name": "Lists the instance profiles that have the specified associated IAM role, Lists the names of the inline policies that are embedded in the specified IAM role", "tags": [ "Predictive", "Behavioral_Anomaly" ], "url": "https://lb00.us-east-1.macie.aws.amazon.com/111122223333/posts/alert_id", "alert-arn": "arn:aws:macie:us-east-1:123456789012:trigger/macie/alert/alert_id", "risk-score": 20, "created-at": "2017-04-22T03:08:35.256000", "actor": "123456789012:assumed-role:rolename", "trigger": { "alert-type": "predictive", "features": { "distinctEventName": { "name": "distinctEventName", "description": "Event Names executed during a user session", "narrative": "A sudden increase in event names utilized by a user can be an indicator of a change in user behavior or account risk", "risk": 3 }, "ListInstanceProfilesForRole": { "name": "ListInstanceProfilesForRole", "description": "Lists the instance profiles that have the specified associated IAM role", "narrative": "Information collection activity suggesting the start of a reconnaissance or exfiltration campaign", "anomalous": true, "multiplier": 8.420560747663552, "excession_times": [ "2017-04-21T18:00:00Z" ], "risk": 1 }, "ListRolePolicies": { "name": "ListRolePolicies", "description": "Lists the names of the inline policies that are embedded in the specified IAM role", "narrative": "Information collection activity suggesting the start of a reconnaisance or exfiltration campaign", "anomalous": true, "multiplier": 12.017441860465116, "excession_times": [ "2017-04-21T18:00:00Z" ], "risk": 2 } } } } }

Scheduled Events

The following is an example of a scheduled event:

Copy
{ "id": "53dc4d37-cffa-4f76-80c9-8b7d4a4d2eaa", "detail-type": "Scheduled Event", "source": "aws.events", "account": "123456789012", "time": "2015-10-08T16:53:06Z", "region": "us-east-1", "resources": [ "arn:aws:events:us-east-1:123456789012:rule/MyScheduledRule" ], "detail": {} }

AWS Trusted Advisor Events

The following are examples of the events for AWS Trusted Advisor. For more information, see Monitoring Trusted Advisor Check Results with Amazon CloudWatch Events in the AWS Support User Guide.

Low Utilization Amazon EC2 Instances

Copy
{ "check-name": "Low Utilization Amazon EC2 Instances", "check-item-detail": { "Day 1": "0.0% 0.00MB", "Day 2": "0.0% 0.00MB", "Day 3": "0.0% 0.00MB", "Region/AZ": "eu-central-1a", "Estimated Monthly Savings": "$10.80", "14-Day Average CPU Utilization": "0.0%", "Day 14": "0.0% 0.00MB", "Day 13": "0.0% 0.00MB", "Day 12": "0.0% 0.00MB", "Day 11": "0.0% 0.00MB", "Day 10": "0.0% 0.00MB", "14-Day Average Network I/O": "0.00MB", "Number of Days Low Utilization": "14 days", "Instance Type": "t2.micro", "Instance ID": "i-1a2b3e4f", "Day 8": "0.0% 0.00MB", "Instance Name": null, "Day 9": "0.0% 0.00MB", "Day 4": "0.0% 0.00MB", "Day 5": "0.0% 0.00MB", "Day 6": "0.0% 0.00MB", "Day 7": "0.0% 0.00MB" }, "status": "WARN", "resource_id": "arn:aws:ec2:eu-central-1:111122223333:instance/i-1a2b3e4f", "uuid": "6ba6d96a-d3dd-4fca-8020-350b2e54719c" }

Load Balancer Optimization

Copy
{ "check-name": "Load Balancer Optimization", "check-item-detail": { "Instances in Zone a": "0", "Status": "Yellow", "Instances in Zone b": null, "# of Zones": "1", "Region": "ap-northeast-2", "Load Balancer Name": "xyz-elb-test", "Instances in Zone e": null, "Instances in Zone c": null, "Reason": "No active instances", "Instances in Zone d": null }, "status": "WARN", "resource_id": "arn:aws:elasticloadbalancing:ap-northeast-2:444455556666:loadbalancer/xyz-elb-test", "uuid": "a1bc339a-59c8-4b5f-b248-44c437b68b83" }

Exposed Access Keys

Copy
{ "check-name": "Exposed Access Keys", "check-item-detail": { "Case ID": "02648f3b-e18f-4019-8d68-ce25efe080ff", "Usage (USD per Day)": "0", "User Name (IAM or Root)": "jane-roe-test", "Deadline": "1440453299248", "Access Key ID": "AKIAIOSFODNN7EXAMPLE", "Time Updated": "1440021299248", "Fraud Type": "Exposed", "Location": "www.github.com" }, "status": "ERROR", "resource_id": "", "uuid": "cce6d28f-e44b-4e61-aba1-5b4af96a0f59" }