AWS CloudTrail event names supported by AWS Audit Manager - AWS Audit Manager

AWS CloudTrail event names supported by AWS Audit Manager

You can capture AWS CloudTrail management events and global service events as evidence in Audit Manager. To do this, you specify the CloudTrail event name as a data source mapping keyword when you create a custom control.


Audit Manager captures management events and global service events only. Data events and insights events are not available as evidence. For more information about the different types of CloudTrail events, see CloudTrail concepts in the AWS CloudTrail User Guide.

As an exception to the above, the following CloudTrail events aren't supported by Audit Manager:

  • kms_GenerateDataKey

  • kms_Decrypt

  • sts_AssumeRole

  • kinesisvideo_GetDataEndpoint

  • kinesisvideo_GetSignalingChannelEndpoint

  • kinesisvideo_DescribeSignalingChannel

  • kinesisvideo_DescribeStream

As of May 11, 2023, Audit Manager no longer supports read-only CloudTrail events as keywords for evidence collection. We removed a total of 3,135 read-only keywords. Because customers and AWS services both make read calls to APIs, read-only events are noisy. As a result, read-only keywords collect a lot of evidence that isn't reliable or relevant for audits. Read-only keywords include List, Describe, and Get API calls (for example, GetObject and ListBuckets for Amazon S3). If you were using one of these keywords for evidence collection, you don't need to do anything. The keywords were automatically removed from the Audit Manager console and from your assessments, and evidence is no longer collected for these keywords.