AWS CloudTrail¶
Description¶
CloudTrail
This is the CloudTrail API Reference. It provides descriptions of actions, data types, common parameters, and common errors for CloudTrail.
CloudTrail is a web service that records Amazon Web Services API calls for your Amazon Web Services account and delivers log files to an Amazon S3 bucket. The recorded information includes the identity of the user, the start time of the Amazon Web Services API call, the source IP address, the request parameters, and the response elements returned by the service.
As an alternative to the API, you can use one of the Amazon Web Services SDKs, which consist of libraries and sample code for various programming languages and platforms (Java, Ruby, .NET, iOS, Android, etc.). The SDKs provide programmatic access to CloudTrail. For example, the SDKs handle cryptographically signing requests, managing errors, and retrying requests automatically. For more information about the Amazon Web Services SDKs, including how to download and install them, see Tools to Build on Amazon Web Services.
See the CloudTrail User Guide for information about the data that is included with each Amazon Web Services API call listed in the log files.
Usage¶
Arguments¶
-
configOptional configuration of credentials, endpoint, and/or region.
- credentials:
- creds:
- access_key_id: AWS access key ID
- secret_access_key: AWS secret access key
- session_token: AWS temporary session token
- profile: The name of a profile to use. If not given, then the default profile is used.
- anonymous: Set anonymous credentials.
- creds:
- endpoint: The complete URL to use for the constructed client.
- region: The AWS Region used in instantiating the client.
- close_connection: Immediately close all HTTP connections.
- timeout: The time in seconds till a timeout exception is thrown when attempting to make a connection. The default is 60 seconds.
- s3_force_path_style: Set this to
trueto force the request to use path-style addressing, i.e.http://s3.amazonaws.com/BUCKET/KEY. - sts_regional_endpoint: Set sts regional endpoint resolver to regional or legacy https://docs.aws.amazon.com/sdkref/latest/guide/feature-sts-regionalized-endpoints.html
- use_dual_stack: Set this to
trueto use the dualstack (IPv4 and IPv6) endpoint for a service, where available, falling back to the regular endpoint when it isn't. Defaults to theAWS_USE_DUALSTACK_ENDPOINTenvironment variable when unset.
- credentials:
-
credentialsOptional credentials shorthand for the config parameter
- creds:
- access_key_id: AWS access key ID
- secret_access_key: AWS secret access key
- session_token: AWS temporary session token
- profile: The name of a profile to use. If not given, then the default profile is used.
- anonymous: Set anonymous credentials.
- creds:
-
endpointOptional shorthand for complete URL to use for the constructed client.
-
regionOptional shorthand for AWS Region used in instantiating the client.
Value¶
A client for the service. You can call the service's operations using syntax like svc$operation(...), where svc is the name you've assigned to the client. The available operations are listed in the Operations section.
Service syntax¶
svc <- cloudtrail(
config = list(
credentials = list(
creds = list(
access_key_id = "string",
secret_access_key = "string",
session_token = "string"
),
profile = "string",
anonymous = "logical"
),
endpoint = "string",
region = "string",
close_connection = "logical",
timeout = "numeric",
s3_force_path_style = "logical",
sts_regional_endpoint = "string",
use_dual_stack = "logical"
),
credentials = list(
creds = list(
access_key_id = "string",
secret_access_key = "string",
session_token = "string"
),
profile = "string",
anonymous = "logical"
),
endpoint = "string",
region = "string"
)
Operations¶
add_tags |
Adds one or more tags to a trail, event data store, dashboard, or channel, up to a limit of 50 |
|---|---|
cancel_query |
CloudTrail Lake will no longer be open to new customers starting May 31, 2026 |
create_channel |
CloudTrail Lake will no longer be open to new customers starting May 31, 2026 |
create_dashboard |
CloudTrail Lake will no longer be open to new customers starting May 31, 2026 |
create_event_data_store |
CloudTrail Lake will no longer be open to new customers starting May 31, 2026 |
create_trail |
Creates a trail that specifies the settings for delivery of log data to an Amazon S3 bucket |
delete_channel |
CloudTrail Lake will no longer be open to new customers starting May 31, 2026 |
delete_dashboard |
CloudTrail Lake will no longer be open to new customers starting May 31, 2026 |
delete_event_data_store |
CloudTrail Lake will no longer be open to new customers starting May 31, 2026 |
delete_resource_policy |
Deletes the resource-based policy attached to the CloudTrail event data store, dashboard, or channel |
delete_trail |
Deletes a trail |
deregister_organization_delegated_admin |
Removes CloudTrail delegated administrator permissions from a member account in an organization |
describe_query |
CloudTrail Lake will no longer be open to new customers starting May 31, 2026 |
describe_trails |
Retrieves settings for one or more trails associated with the current Region for your account |
disable_federation |
CloudTrail Lake will no longer be open to new customers starting May 31, 2026 |
enable_federation |
CloudTrail Lake will no longer be open to new customers starting May 31, 2026 |
generate_query |
CloudTrail Lake will no longer be open to new customers starting May 31, 2026 |
get_channel |
CloudTrail Lake will no longer be open to new customers starting May 31, 2026 |
get_dashboard |
CloudTrail Lake will no longer be open to new customers starting May 31, 2026 |
get_event_configuration |
Retrieves the current event configuration settings for the specified event data store or trail |
get_event_data_store |
CloudTrail Lake will no longer be open to new customers starting May 31, 2026 |
get_event_selectors |
Describes the settings for the event selectors that you configured for your trail |
get_import |
CloudTrail Lake will no longer be open to new customers starting May 31, 2026 |
get_insight_selectors |
Describes the settings for the Insights event selectors that you configured for your trail or event data store |
get_query_results |
CloudTrail Lake will no longer be open to new customers starting May 31, 2026 |
get_resource_policy |
Retrieves the JSON text of the resource-based policy document attached to the CloudTrail event data store, dashboard, or channel |
get_trail |
Returns settings information for a specified trail |
get_trail_status |
Returns a JSON-formatted list of information about the specified trail |
list_channels |
CloudTrail Lake will no longer be open to new customers starting May 31, 2026 |
list_dashboards |
CloudTrail Lake will no longer be open to new customers starting May 31, 2026 |
list_event_data_stores |
CloudTrail Lake will no longer be open to new customers starting May 31, 2026 |
list_import_failures |
CloudTrail Lake will no longer be open to new customers starting May 31, 2026 |
list_imports |
CloudTrail Lake will no longer be open to new customers starting May 31, 2026 |
list_insights_data |
Returns Insights events generated on a trail that logs data events |
list_insights_metric_data |
Returns Insights metrics data for trails that have enabled Insights |
list_public_keys |
Returns all public keys whose private keys were used to sign the digest files within the specified time range |
list_queries |
CloudTrail Lake will no longer be open to new customers starting May 31, 2026 |
list_tags |
Lists the tags for the specified trails, event data stores, dashboards, or channels in the current Region |
list_trails |
Lists trails that are in the current account |
lookup_events |
Looks up management events or CloudTrail Insights events that are captured by CloudTrail |
put_event_configuration |
Updates the event configuration settings for the specified event data store or trail |
put_event_selectors |
Configures event selectors (also referred to as basic event selectors) or advanced event selectors for your trail |
put_insight_selectors |
Lets you enable Insights event logging on specific event categories by specifying the Insights selectors that you want to enable on an existing trail or event data store |
put_resource_policy |
Attaches a resource-based permission policy to a CloudTrail event data store, dashboard, or channel |
register_organization_delegated_admin |
Registers an organization’s member account as the CloudTrail delegated administrator |
remove_tags |
Removes the specified tags from a trail, event data store, dashboard, or channel |
restore_event_data_store |
CloudTrail Lake will no longer be open to new customers starting May 31, 2026 |
search_sample_queries |
CloudTrail Lake will no longer be open to new customers starting May 31, 2026 |
start_dashboard_refresh |
CloudTrail Lake will no longer be open to new customers starting May 31, 2026 |
start_event_data_store_ingestion |
CloudTrail Lake will no longer be open to new customers starting May 31, 2026 |
start_import |
CloudTrail Lake will no longer be open to new customers starting May 31, 2026 |
start_logging |
Starts the recording of Amazon Web Services API calls and log file delivery for a trail |
start_query |
CloudTrail Lake will no longer be open to new customers starting May 31, 2026 |
stop_event_data_store_ingestion |
CloudTrail Lake will no longer be open to new customers starting May 31, 2026 |
stop_import |
CloudTrail Lake will no longer be open to new customers starting May 31, 2026 |
stop_logging |
Suspends the recording of Amazon Web Services API calls and log file delivery for the specified trail |
update_channel |
CloudTrail Lake will no longer be open to new customers starting May 31, 2026 |
update_dashboard |
CloudTrail Lake will no longer be open to new customers starting May 31, 2026 |
update_event_data_store |
CloudTrail Lake will no longer be open to new customers starting May 31, 2026 |
update_trail |
Updates trail settings that control what events you are logging, and how to handle log files |