Menu
Amazon CloudWatch Events
User Guide

Event Types for CloudWatch Events

Amazon CloudWatch Events supports the following events:

Amazon EBS Events

The following are examples of the events for Amazon Elastic Block Store (Amazon EBS). For more information, see Amazon CloudWatch Events for Amazon EBS in the Amazon EC2 User Guide for Linux Instances.

EBS Snapshot Notification

Amazon EBS created a snapshot (createSnapshot), copied a snapshot (copySnapshot), or shared a snapshot (shareSnapshot).

{
  "version": "0",
  "id": "01234567-0123-0123-0123-012345678901",
  "detail-type": "EBS Snapshot Notification",
  "source": "aws.ec2",
  "account": "123456789012",
  "time": "2016-11-14T01:30:00Z",
  "region": "us-east-1",
  "resources": [
    "arn:aws:ec2::us-west-2:snapshot/snap-01234567"
  ],
  "detail": {
    "event": "createSnapshot",
    "result": "succeeded",
    "cause": "",
    "request-id": "",
    "snapshot_id": "arn:aws:ec2::us-west-2:snapshot/snap-01234567",
    "source": "arn:aws:ec2::us-west-2:volume/vol-01234567",
    "StartTime": "2016-11-14T00:00:00Z",
    "EndTime": "2016-11-ddT01:30:00Z"
  }
}

EBS Volume Notification

Amazon EBS failed to create a volume (createVolume), failed to attach a volume (attachVolume), or failed to reattach a volume (reattachVolume).

{
  "version": "0",
  "id": "01234567-0123-0123-0123-0123456789ab",
  "detail-type": "EBS Volume Notification",
  "source": "aws.ec2",
  "account": "012345678901",
  "time": "2016-11-14T00:30:07Z",
  "region": "sa-east-1",
  "resources": [
    "arn:aws:ec2:sa-east-1:0123456789ab:volume/vol-01234567",
  ],
  "detail": {
    "event": "createVolume",
    "result": "failed",
    "cause": "arn:aws:kms:sa-east-1:0123456789ab:key/01234567-0123-0123-0123-0123456789ab is disabled.",
    "request-id": "01234567-0123-0123-0123-0123456789ab",
  
}

Amazon EC2 Events

The following is an example of an EC2 Instance State-change Notification event, with an instance in the pending state:

{
  "id": "7bf73129-1428-4cd3-a780-95db273d1602",
  "detail-type": "EC2 Instance State-change Notification",
  "source": "aws.ec2", "account": "123456789012",
  "time": "2015-11-11T21:29:54Z",
  "region": "us-east-1",
  "resources": [ "arn:aws:ec2:us-east-1:123456789012:instance/i-abcd1111" ],
  "detail": { "instance-id": "i-abcd1111", "state": "pending"
  } 
}

Amazon EC2 System Manager Events

The following are examples of the events for Amazon EC2 Systems Manager (Systems Manager). For more information, see Log Command Execution Status Changes for Run Command in the Amazon EC2 User Guide for Linux Instances.

EC2 Command Status-change Notification

{
    "version": "0",
    "id": "51c0891d-0e34-45b1-83d6-95db273d1602",
    "detail-type": "EC2 Command Status-change Notification",
    "source": "aws.ssm",
    "account": "123456789012",
    "time": "2016-07-10T21:51:32Z",
    "region": "us-east-1",
    "resources": ["arn:aws:ec2:us-east-1:123456789012:instance/i-abcd1111"],
    "detail": {
        "command-id": "e8d3c0e4-71f7-4491-898f-c9b35bee5f3b",
        "document-name": "AWS-RunPowerShellScript",
        "expire-after": "2016-07-14T22:01:30.049Z",
        "parameters": {
            "executionTimeout": ["3600"],
            "commands": ["date"]
        },
        "requested-date-time": "2016-07-10T21:51:30.049Z",
        "status": "Success"
    }
}

EC2 Command Invocation Status-change Notification

{
    "version": "0",
    "id": "4780e1b8-f56b-4de5-95f2-95db273d1602",
    "detail-type": "EC2 Command Invocation Status-change Notification",
    "source": "aws.ssm",
    "account": "123456789012",
    "time": "2016-07-10T21:51:32Z",
    "region": "us-east-1",
    "resources": ["arn:aws:ec2:us-east-1:123456789012:instance/i-abcd1111"],
    "detail": {
        "command-id": "e8d3c0e4-71f7-4491-898f-c9b35bee5f3b",
        "document-name": "AWS-RunPowerShellScript",
        "instance-id": "i-9bb89e2b",
        "requested-date-time": "2016-07-10T21:51:30.049Z",
        "status": "Success"
    }
}

EC2 Automation Step Status-change Notification

{
  "version": "0",
  "id": "eeca120b-a321-433e-9635-dab369006a6b",
  "detail-type": "EC2 Automation Step Status-change Notification",
  "source": "aws.ssm",
  "account": "123456789012",
  "time": "2016-11-29T19:43:35Z",
  "region": "us-east-1",
  "resources": ["arn:aws:ssm:us-east-1:123456789012:automation-execution/333ba70b-2333-48db-b17e-a5e69c6f4d1c", 
    "arn:aws:ssm:us-east-1:123456789012:automation-definition/runcommand1:1"],
  "detail": {
    "ExecutionId": "333ba70b-2333-48db-b17e-a5e69c6f4d1c",
    "Definition": "runcommand1",
    "DefinitionVersion": 1.0,
    "Status": "Success",
    "EndTime": "Nov 29, 2016 7:43:25 PM",
    "StartTime": "Nov 29, 2016 7:43:23 PM",
    "Time": 2630.0,
    "StepName": "runFixedCmds",
    "Action": "aws:runCommand"
  }
}

EC2 Automation Execution Status-change Notification

{
  "version": "0",
  "id": "d290ece9-1088-4383-9df6-cd5b4ac42b99",
  "detail-type": "EC2 Automation Execution Status-change Notification",
  "source": "aws.ssm",
  "account": "123456789012",
  "time": "2016-11-29T19:43:35Z",
  "region": "us-east-1",
  "resources": ["arn:aws:ssm:us-east-1:123456789012:automation-execution/333ba70b-2333-48db-b17e-a5e69c6f4d1c", 
    "arn:aws:ssm:us-east-1:123456789012:automation-definition/runcommand1:1"],
  "detail": {
    "ExecutionId": "333ba70b-2333-48db-b17e-a5e69c6f4d1c",
    "Definition": "runcommand1",
    "DefinitionVersion": 1.0,
    "Status": "Success",
    "StartTime": "Nov 29, 2016 7:43:20 PM",
    "EndTime": "Nov 29, 2016 7:43:26 PM",
    "Time": 5753.0,
    "ExecutedBy": "arn:aws:iam::123456789012:user/userName"
  }
}

Amazon ECS Events

The following are examples of the events for Amazon EC2 Container Service (Amazon ECS). For more information, see Amazon ECS Event Stream for CloudWatch Events in the Amazon EC2 Container Service Developer Guide.

ECS Container Instance State Change

Note that the contents of the detail section are not shown here. They resemble the contents of the ContainerInstance object.

{
  "version": "0",
  "id": "182f055c-38f2-4e56-922e-bf209ca88cf9",
  "detail-type": "ECS Container Instance State Change",
  "source": "aws.ecs",
  "account": "123456789012",
  "time": "2016-11-18T22:15:15Z",
  "region": "us-west-2",
  "resources": [
    "arn:aws:ecs:us-west-2:123456789012:container-instance/a48e7e5a-4709-47b3-a698-819dab95c16f"
  ],
  "detail": {
    ...
  }
}

ECS Task State Change

Note that the contents of the detail section are not shown here. They resemble the contents of the Task object.

{
  "version": "0",
  "id": "2d882db5-3d34-4d75-b299-5a6af9d2a59c",
  "detail-type": "ECS Task State Change",
  "source": "aws.ecs",
  "account": "123456789012",
  "time": "2016-11-18T22:48:57Z",
  "region": "us-west-2",
  "resources": [
    "arn:aws:ecs:us-west-2:123456789012:task/9dd06983-dfd7-437c-8bb1-0dc78d90da91"
  ],
  "detail": {
    ...
  }
}

Auto Scaling Events

The following are examples of the events for Auto Scaling. For more information, see Getting CloudWatch Events When Your Auto Scaling Group Scales in the Auto Scaling User Guide.

EC2 Instance-launch Lifecycle Action

Auto Scaling moved an instance to a Pending:Wait state due to a lifecycle hook.

{
  "version": "0",
  "id": "6a7e8feb-b491-4cf7-a9f1-bf3703467718",
  "detail-type": "EC2 Instance-launch Lifecycle Action",
  "source": "aws.autoscaling",
  "account": "123456789012",
  "time": "2015-12-22T18:43:48Z",
  "region": "us-east-1",
  "resources": [
    "arn:aws:autoscaling:us-east-1:123456789012:autoScalingGroup:59fcbb81-bd02-485d-80ce-563ef5b237bf:autoScalingGroupName/sampleASG"
  ],
  "detail": {
    "LifecycleActionToken": "c613620e-07e2-4ed2-a9e2-ef8258911ade",
    "AutoScalingGroupName": "sampleASG",
    "LifecycleHookName": "SampleLifecycleHook-12345",
    "EC2InstanceId": "i-12345678",
    "LifecycleTransition": "autoscaling:EC2_INSTANCE_LAUNCHING"
  }
}

EC2 Instance Launch Successful

Auto Scaling successfully launched an instance.

{
  "id": "3e3c153a-8339-4e30-8c35-687ebef853fe",
  "detail-type": "EC2 Instance Launch Successful",
  "source": "aws.autoscaling",
  "account": "123456789012",
  "time": "2015-11-11T21:31:47Z",
  "region": "us-east-1",
  "resources": [
      "arn:aws:autoscaling:us-east-1:123456789012:autoScalingGroup:eb56d16b-bbf0-401d-b893-d5978ed4a025:autoScalingGroupName/ASGLaunchSuccess",
      "arn:aws:ec2:us-east-1:123456789012:instance/i-b188560f" 
      ],
  "detail": {
      "StatusCode": "InProgress",
      "AutoScalingGroupName": "ASGLaunchSuccess",
      "ActivityId": "9cabb81f-42de-417d-8aa7-ce16bf026590",
      "Details": {
            "Availability Zone": "us-east-1b",
            "Subnet ID": "subnet-95bfcebe" 
      },
      "RequestId": "9cabb81f-42de-417d-8aa7-ce16bf026590",
      "EndTime": "2015-11-11T21:31:47.208Z",
      "EC2InstanceId": "i-b188560f",
      "StartTime": "2015-11-11T21:31:13.671Z",
      "Cause": "At 2015-11-11T21:31:10Z a user request created an Auto Scaling group changing the desired capacity from 0 to 1. At 2015-11-11T21:31:11Z an instance was started in response to a difference between desired and actual capacity, increasing the capacity from 0 to 1."
      }
}

EC2 Instance Launch Unsuccessful

Auto Scaling failed to launch an instance.

{
  "id": "1681ab87-4a09-459f-95a2-7fa09403c4b7",
  "detail-type": "EC2 Instance Launch Unsuccessful",
  "source": "aws.autoscaling",
  "account": "123456789012",
  "time": "2015-11-11T21:42:36Z",
  "region": "us-east-1",
  "resources": [
      "arn:aws:autoscaling:us-east-1:123456789012:autoScalingGroup:528ffce5-ef9f-4c1d-8d18-5d005b4a438c:autoScalingGroupName/brokenASG",
      "arn:aws:ec2:us-east-1:123456789012:instance/" 
      ],
  "detail": {
      "StatusCode": "Failed",
      "AutoScalingGroupName": "brokenASG",
      "ActivityId": "06076c51-4874-487d-b15b-7895a713ab55",
      "Details": {
            "Availability Zone": "us-east-1e",
            "Subnet ID": "subnet-16c5df2c" 
       },
      "RequestId": "06076c51-4874-487d-b15b-7895a713ab55",
      "EndTime": "2015-11-11T21:42:36.000Z",
      "EC2InstanceId": "",
      "StartTime": "2015-11-11T21:42:36.698Z",
      "Cause": "At 2015-11-11T21:42:09Z a user request update of Auto Scaling group constraints to min: 0, max: 10, desired: 2 changing the desired capacity from 0 to 2. At 2015-11-11T21:42:35Z an instance was started in response to a difference between desired and actual capacity, increasing the capacity from 0 to 2."
      }
      }

EC2 Instance-terminate Lifecycle Action

Auto Scaling moved an instance to a Terminating:Wait state due to a lifecycle hook.

{
  "version": "0",
  "id": "468fe059-f4b7-445f-bb22-2a271b94974d",
  "detail-type": "EC2 Instance-terminate Lifecycle Action",
  "source": "aws.autoscaling",
  "account": "123456789012",
  "time": "2015-12-22T18:43:48Z",
  "region": "us-east-1",
  "resources": [
    "arn:aws:autoscaling:us-east-1:123456789012:autoScalingGroup:59fcbb81-bd02-485d-80ce-563ef5b237bf:autoScalingGroupName/sampleASG"
  ],
  "detail": {
    "LifecycleActionToken": "630aa23f-48eb-45e7-aba6-799ea6093a0f",
    "AutoScalingGroupName": "sampleASG",
    "LifecycleHookName": "SampleLifecycleHook-6789",
    "EC2InstanceId": "i-12345678",
    "LifecycleTransition": "autoscaling:EC2_INSTANCE_TERMINATING"
  }
}

EC2 Instance Terminate Successful

Auto Scaling successfully terminated an instance.

{
  "id": "156d01c9-a6c3-4d7e-b883-5758266b95af",
  "detail-type": "EC2 Instance Terminate Successful",
  "source": "aws.autoscaling",
  "account": "123456789012",
  "time": "2015-11-11T21:36:57Z",
  "region": "us-east-1",
  "resources": [
      "arn:aws:autoscaling:us-east-1:123456789012:autoScalingGroup:eb56d16b-bbf0-401d-b893-d5978ed4a025:autoScalingGroupName/ASGTerminate",
      "arn:aws:ec2:us-east-1:123456789012:instance/i-b188560f" 
      ],
  "detail": {
      "StatusCode": "InProgress",
      "AutoScalingGroupName": "ASGTerminate",
      "ActivityId": "56472e79-538a-4ba7-b3cc-768d889194b0",
      "Details": {
            "Availability Zone": "us-east-1b",
            "Subnet ID": "subnet-95bfcebe" 
            },
      "RequestId": "56472e79-538a-4ba7-b3cc-768d889194b0",
      "EndTime": "2015-11-11T21:36:57.498Z",
      "EC2InstanceId": "i-b188560f",
      "StartTime": "2015-11-11T21:36:12.649Z",
      "Cause": "At 2015-11-11T21:36:03Z a user request update of Auto Scaling group constraints to min: 0, max: 1, desired: 0 changing the desired capacity from 1 to 0. At 2015-11-11T21:36:12Z an instance was taken out of service in response to a difference between desired and actual capacity, shrinking the capacity from 1 to 0. At 2015-11-11T21:36:12Z instance i-b188560f was selected for termination."
      }
}

EC2 Instance Terminate Unsuccessful

Auto Scaling failed to terminate an instance.

{
  "id": "5e3df53a-0239-4e31-7d15-087ebef903ce",
  "detail-type": "EC2 Instance Terminate Unsuccessful",
  "source": "aws.autoscaling",
  "account": "123456789012",
  "time": "2015-12-01T23:34:57Z",
  "region": "us-east-1",
  "resources": [
      "arn:aws:autoscaling:us-east-1:123456789012:autoScalingGroup:cf5ebd9c-8e2a-4197-abe2-2fb94e8d1f87:autoScalingGroupName/ASGTermFail",
      "arn:aws:ec2:us-east-1:123456789012:instance/i-b188560f" 
      ], 
  "detail": {
      "StatusCode": "InProgress",
      "Description": "Terminating EC2 instance: i-b188560f",
      "AutoScalingGroupName": "ASGTermFail",
      "ActivityId": "c1a8f6ce-82e8-4517-96ba-67d1999ceee4",
      "Details": {
            "Availability Zone": "us-east-1e",
            "Subnet ID": "subnet-915643ba" 
            },
      "RequestId": "c1a8f6ce-82e8-4517-96ba-67d1999ceee4",
      "StatusMessage": "",
      "EndTime": "2015-12-01T23:34:57.721Z",
      "EC2InstanceId": "i-b188560f",
      "StartTime": "2015-12-01T23:33:48.489Z",
      "Cause": "At 2015-12-01T23:33:41Z a user request explicitly set group desired capacity changing the desired capacity from 2 to 0. At 2015-12-01T23:33:47Z an instance was taken out of service in response to a difference between desired and actual capacity, shrinking the capacity from 2 to 0. At 2015-12-01T23:33:47Z instance i-0867b4292c0cff474 was selected for termination. At 2015-12-01T23:33:48Z instance i-b188560f was selected for termination."
      }
}

AWS API Call Events

The following is an example of an AWS API call event to Amazon S3 to create a bucket:

{
    "version": "0",
    "id": "36eb8523-97d0-4518-b33d-ee3579ff19f0",
    "detail-type": "AWS API Call via CloudTrail",
    "source": "aws.s3",
    "account": "123456789012",
    "time": "2016-02-20T01:09:13Z",
    "region": "us-east-1",
    "resources": [],
    "detail": {
        "eventVersion": "1.03",
        "userIdentity": {
            "type": "Root",
            "principalId": "123456789012",
            "arn": "arn:aws:iam::123456789012:root",
            "accountId": "123456789012",
            "sessionContext": {
                "attributes": {
                    "mfaAuthenticated": "false",
                    "creationDate": "2016-02-20T01:05:59Z"
                }
            }
        },
        "eventTime": "2016-02-20T01:09:13Z",
        "eventSource": "s3.amazonaws.com",
        "eventName": "CreateBucket",
        "awsRegion": "us-east-1",
        "sourceIPAddress": "100.100.100.100",
        "userAgent": "[S3Console/0.4]",
        "requestParameters": {
            "bucketName": "bucket-test-iad"
        },
        "responseElements": null,
        "requestID": "9D767BCC3B4E7487",
        "eventID": "24ba271e-d595-4e66-a7fd-9c16cbf8abae",
        "eventType": "AwsApiCall"
    }
}

Only the read/write events from the following services are supported. Read-only APIs, such as those that begin with List, Get, or Describe aren't supported. In addition, AWS API call events that are larger than 256KB in size are not supported.

  • Auto Scaling

  • AWS Certificate Manager

  • AWS CloudFormation

  • Amazon CloudFront

  • AWS CloudHSM

  • Amazon CloudSearch

  • AWS CloudTrail

  • Amazon CloudWatch

  • Amazon CloudWatch Events

  • Amazon CloudWatch Logs

  • AWS CodeDeploy

  • AWS CodePipeline

  • Amazon Cognito Identity

  • Amazon Cognito Sync

  • AWS Config

  • AWS Data Pipeline

  • AWS Device Farm

  • AWS Direct Connect

  • AWS Directory Service

  • AWS Database Migration Service

  • Amazon DynamoDB

  • Amazon EC2 Container Registry

  • Amazon EC2 Container Service

  • Amazon EC2 Simple Systems Manager

  • Amazon ElastiCache

  • AWS Elastic Beanstalk

  • Amazon Elastic Compute Cloud

  • Amazon Elastic File System

  • Elastic Load Balancing

  • Amazon EMR

  • Amazon Elastic Transcoder

  • Amazon Elasticsearch Service

  • Amazon GameLift

  • Amazon Glacier

  • AWS Identity and Access Management [US East (N. Virginia) only]

  • Amazon Inspector

  • AWS IoT

  • AWS Key Management Service

  • Amazon Kinesis

  • Amazon Kinesis Firehose

  • AWS Lambda

  • Amazon Machine Learning

  • AWS OpsWorks

  • Amazon Polly

  • Amazon Redshift

  • Amazon Relational Database Service

  • Amazon Route 53

  • AWS Security Token Service

  • Amazon Simple Email Service

  • Amazon Simple Notification Service

  • Amazon Simple Queue Service

  • Amazon Simple Storage Service

  • Amazon Simple Workflow Service

  • AWS Step Functions

  • AWS Storage Gateway

  • AWS Support

  • AWS WAF

  • Amazon WorkDocs

  • Amazon WorkSpaces

AWS CodeDeploy Events

The following are examples of the events for AWS CodeDeploy. For more information, see Monitoring Deployments with CloudWatch Events in the AWS CodeDeploy User Guide.

CodeDeploy Deployment State-change Notification

There was a change in the state of a deployment.

{
  "account": "123456789012",
  "region": "us-east-1",
  "detail-type": "CodeDeploy Deployment State-change Notification",
  "source": "aws.codedeploy",
  "version": "0",
  "time": "2016-06-30T22:06:31Z",
  "id": "c071bfbf-83c4-49ca-a6ff-3df053957145",
  "resources": [
    "arn:aws:codedeploy:us-east-1:123456789012:application:myApplication",
    "arn:aws:codedeploy:us-east-1:123456789012:deploymentgroup:myApplication/myDeploymentGroup"
  ],
  "detail": {
    "instanceGroupId": "9fd2fbef-2157-40d8-91e7-6845af69e2d2",
    "region": "us-east-1",
    "application": "myApplication",
    "deploymentId": "d-123456789",
    "state": "SUCCESS",
    "deploymentGroup": "myDeploymentGroup"
  }
}

CodeDeploy Instance State-change Notification

There was a change in the state of an instance that belongs to a deployment group.

{
  "account": "123456789012",
  "region": "us-east-1",
  "detail-type": "CodeDeploy Instance State-change Notification",
  "source": "aws.codedeploy",
  "version": "0",
  "time": "2016-06-30T23:18:50Z",
  "id": "fb1d3015-c091-4bf9-95e2-d98521ab2ecb",
  "resources": [
    "arn:aws:ec2:us-east-1:123456789012:instance/i-0000000aaaaaaaaaa",
    "arn:aws:codedeploy:us-east-1:123456789012:deploymentgroup:myApplication/myDeploymentGroup",
    "arn:aws:codedeploy:us-east-1:123456789012:application:myApplication"
  ],
  "detail": {
    "instanceId": "i-0000000aaaaaaaaaa",
    "region": "us-east-1",
    "state": "SUCCESS",
    "application": "myApplication",
    "deploymentId": "d-123456789",
    "instanceGroupId": "8cd3bfa8-9e72-4cbe-a1e5-da4efc7efd49",
    "deploymentGroup": "myDeploymentGroup"
  }
}

AWS Console Sign-in Events

AWS console sign-in events are supported only in the US East (N. Virginia) region. The following is an example of an AWS console sign-in event:

{
  "id": "6f87d04b-9f74-4f04-a780-7acf4b0a9b38",
  "detail-type": "AWS Console Sign In via CloudTrail",
  "source": "aws.signin",
  "account": "123456789012",
  "time": "2016-01-05T18:21:27Z",
  "region": "us-east-1",
  "resources": [],
  "detail": { 
      "eventVersion": "1.02",
      "userIdentity": {
            "type": "Root",
            "principalId": "123456789012",
            "arn": "arn:aws:iam::123456789012:root",
            "accountId": "123456789012"
            },
      "eventTime": "2016-01-05T18:21:27Z",
      "eventSource": "signin.amazonaws.com",
      "eventName": "ConsoleLogin",
      "awsRegion": "us-east-1",
      "sourceIPAddress": "0.0.0.0",
      "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.106 Safari/537.36",
      "requestParameters": null,
      "responseElements": {
            "ConsoleLogin": "Success"
            },
      "additionalEventData": {
            "LoginTo": "https://console.aws.amazon.com/console/home?state=hashArgs%23&isauthcode=true",
            "MobileVersion": "No",
            "MFAUsed": "No" },
      "eventID": "324731c0-64b3-4421-b552-dfc3c27df4f6",
      "eventType": "AwsConsoleSignIn"
      }
}

AWS Health Events

The following is the format for the AWS Personal Health Dashboard (AWS Health) events. For more information, see Managing AWS Health Events with Amazon CloudWatch Events in the AWS Health User Guide.

AWS Health Event

{
  "id": "7bf73129-1428-4cd3-a780-95db273d1602",
  "detail-type": "AWS Health Event",
  "source": "aws.health",
  "account": "123456789012",
  "time": "2016-06-05T06:27:57Z",
  "region": "region",
  "resources": [],
  "detail": {
    "eventArn": "arn:aws:health:region::event/id",
    "service": "service",
    "eventTypeCode": "AWS_service_code",
    "eventTypeCategory": "category",
    "startTime": "Sun, 05 Jun 2016 05:01:10 GMT",
    "endTime": "Sun, 05 Jun 2016 05:30:57 GMT",
    "eventDescription": [{
      "language": "lang-code",
      "latestDescription": "description"
    }]
    ...
  }
}
category

The category code of the event. The possible values are issue, accountNotification, and scheduledChange.

code

The unique identifier for the event type.

id

The unique identifier for the event.

service

The AWS service affected by the event. For example, EC2, S3, REDSHIFT, and RDS.

AWS KMS Events

The following are examples of the AWS Key Management Service (AWS KMS) events. For more information, see AWS KMS Events in the AWS Key Management Service Developer Guide.

KMS CMK Rotation

AWS KMS automatically rotated a CMK's key material.

{
  "version": "0",
  "id": "6a7e8feb-b491-4cf7-a9f1-bf3703467718",
  "detail-type": "KMS CMK Rotation",
  "source": "aws.kms",
  "account": "111122223333",
  "time": "2016-08-25T21:05:33Z",
  "region": "us-west-2",
  "resources": [
    "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
  ],
  "detail": {
    "key-id": "1234abcd-12ab-34cd-56ef-1234567890ab"
  }
}

KMS Imported Key Material Expiration

AWS KMS deleted a CMK's expired key material.

{
  "version": "0",
  "id": "9da9af57-9253-4406-87cb-7cc400e43465",
  "detail-type": "KMS Imported Key Material Expiration",
  "source": "aws.kms",
  "account": "111122223333",
  "time": "2016-08-22T20:12:19Z",
  "region": "us-west-2",
  "resources": [
    "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
  ],
  "detail": {
    "key-id": "1234abcd-12ab-34cd-56ef-1234567890ab"
  }
}

KMS CMK Deletion

AWS KMS completed a scheduled CMK deletion.

{
  "version": "0",
  "id": "e9ce3425-7d22-412a-a699-e7a5fc3fbc9a",
  "detail-type": "KMS CMK Deletion",
  "source": "aws.kms",
  "account": "111122223333",
  "time": "2016-08-19T03:23:45Z",
  "region": "us-west-2",
  "resources": [
    "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
  ],
  "detail": {
    "key-id": "1234abcd-12ab-34cd-56ef-1234567890ab"
  }
}

Scheduled Events

The following is an example of a scheduled event:

{
  "id": "53dc4d37-cffa-4f76-80c9-8b7d4a4d2eaa",
  "detail-type": "Scheduled Event",
  "source": "aws.events",
  "account": "123456789012",
  "time": "2015-10-08T16:53:06Z",
  "region": "us-east-1",
  "resources": [ "arn:aws:events:us-east-1:123456789012:rule/MyScheduledRule" ],
  "detail": {}
} 

Trusted Advisor Events

The following are examples of the events for AWS Trusted Advisor. For more information, see Monitoring Trusted Advisor Check Results with Amazon CloudWatch Events in the AWS Support User Guide.

Low Utilization Amazon EC2 Instances

{
  "check-name": "Low Utilization Amazon EC2 Instances",
  "check-item-detail": {
    "Day 1": "0.0%  0.00MB",
    "Day 2": "0.0%  0.00MB",
    "Day 3": "0.0%  0.00MB",
    "Region/AZ": "eu-central-1a",
    "Estimated Monthly Savings": "$10.80",
    "14-Day Average CPU Utilization": "0.0%",
    "Day 14": "0.0%  0.00MB",
    "Day 13": "0.0%  0.00MB",
    "Day 12": "0.0%  0.00MB",
    "Day 11": "0.0%  0.00MB",
    "Day 10": "0.0%  0.00MB",
    "14-Day Average Network I/O": "0.00MB",
    "Number of Days Low Utilization": "14 days",
    "Instance Type": "t2.micro",
    "Instance ID": "i-1a2b3e4f",
    "Day 8": "0.0%  0.00MB",
    "Instance Name": null,
    "Day 9": "0.0%  0.00MB",
    "Day 4": "0.0%  0.00MB",
    "Day 5": "0.0%  0.00MB",
    "Day 6": "0.0%  0.00MB",
    "Day 7": "0.0%  0.00MB"
  },
  "status": "WARN",
  "resource_id": "arn:aws:ec2:eu-central-1:111122223333:instance/i-1a2b3e4f",
  "uuid": "6ba6d96a-d3dd-4fca-8020-350b2e54719c"
}

Load Balancer Optimization

{
  "check-name": "Load Balancer Optimization",
  "check-item-detail": {
    "Instances in Zone a": "0",
    "Status": "Yellow",
    "Instances in Zone b": null,
    "# of Zones": "1",
    "Region": "ap-northeast-2",
    "Load Balancer Name": "xyz-elb-test",
    "Instances in Zone e": null,
    "Instances in Zone c": null,
    "Reason": "No active instances",
    "Instances in Zone d": null
  },
  "status": "WARN",
  "resource_id": "arn:aws:elasticloadbalancing:ap-northeast-2:444455556666:loadbalancer/xyz-elb-test",
  "uuid": "a1bc339a-59c8-4b5f-b248-44c437b68b83"
}

Exposed Access Keys

{
  "check-name": "Exposed Access Keys",
  "check-item-detail": {
    "Case ID": "02648f3b-e18f-4019-8d68-ce25efe080ff",
    "Usage (USD per Day)": "0",
    "User Name (IAM or Root)": "jane-roe-test",
    "Deadline": "1440453299248",
    "Access Key ID": "AKIAIOSFODNN7EXAMPLE",
    "Time Updated": "1440021299248",
    "Fraud Type": "Exposed",
    "Location": "www.github.com"
  },
  "status": "ERROR",
  "resource_id": "",
  "uuid": "cce6d28f-e44b-4e61-aba1-5b4af96a0f59"
}