Reading a CloudTrail Event Record

A CloudTrail event is a JSON record with a consistent set of fields. Learning to read it lets you reconstruct exactly what happened during an investigation.

Each record describes one API call: who made it, what they did, when, from where, and what the result was.

The most important field for security is userIdentity. It describes the principal that made the call — its type (IAMUser, AssumedRole, Root, AWSService), account, and ARN (Amazon Resource Name).

This is how you attribute an action to a specific person, role, or service with confidence.

eventName is the API action that was called, like DeleteBucket or RunInstances, and eventSource is the service it belongs to, such as s3.amazonaws.com.

Together they tell you precisely what operation occurred, which is the heart of understanding any event.

The eventTime timestamp (in UTC), awsRegion, and sourceIPAddress place the call in time and space.

A call from an unexpected region or an unfamiliar IP is a classic red flag. The user agent field adds how the call was made — console, CLI, or SDK.

The requestParameters show the inputs to the call — which bucket, which instance, which policy — and responseElements show what AWS returned, like a newly created resource ID.

These let you see exactly what was changed and the outcome, not just that something happened.

If a call was denied, the record includes errorCode and errorMessage, such as AccessDenied.

A burst of denied calls from one principal often means an attacker probing what a stolen credential can do. Failed events are as investigatively valuable as successful ones.

When access comes through assumed roles, follow the chain. The userIdentity may show an assumed-role session, and sessionContext reveals the underlying principal that assumed it.

Tracing this chain answers who ultimately performed an action even when several role hops are involved.

Fields like readOnly and managementEvent tell you the nature of the call at a glance — whether it changed anything and whether it is a control-plane operation.

These help you filter quickly to the events that altered your environment when scanning a flood of records.

Reading one record by hand is fine; sifting millions is not. Send logs to CloudWatch Logs or query the S3 archive with Athena using SQL.

You can filter on userIdentity, eventName, sourceIPAddress, or errorCode to pinpoint exactly the calls that matter in an investigation.

The userAgent field reveals how a call was made — the AWS console, a specific CLI version, an SDK, or an automation tool.

An unexpected user agent can hint at attacker tooling. A call that normally comes from the console suddenly arriving via a raw SDK from an odd IP is the kind of subtle anomaly worth a second look.

To investigate, combine fields: who (userIdentity) did what (eventName) to which resource (requestParameters), when (eventTime), from where (sourceIPAddress), and with what result (responseElements or errorCode).

That full picture, drawn from one record, is the essence of API-activity forensics on AWS.

Find the attribution field.

A CloudTrail event is a JSON record whose key fields answer a full investigation: userIdentity (who, with ARN and role chain via sessionContext), eventName/eventSource (what), eventTime/awsRegion/sourceIPAddress (when and where), and requestParameters/responseElements or errorCode (the change and result). Failed AccessDenied events are valuable signals, and Athena lets you query records at scale.