AWS IAM Access Analyzer

eventName	Description	Sample	Rule
any	Catch-all entry for AWS IAM Access Analyzer rules that match the service but not a specific eventName.	N	N
DeleteAnalyzer	Deletes the specified IAM Access Analyzer, stopping all findings generation for resources monitored by that analyzer.	Y	Y
ApplyArchiveRule	Retroactively applies the archive rule to existing findings that meet the archive rule criteria.	Y	N
CancelPolicyGeneration	Cancels the requested policy generation.	Y	N
CheckAccessNotGranted	Checks whether the specified access isn't allowed by a policy.	Y	N
CheckNoNewAccess	Checks whether new access is allowed for an updated policy when compared to the existing policy.	Y	N
CheckNoPublicAccess	Checks whether a resource policy can grant public access to the specified resource type.	Y	N
CreateAccessPreview	Creates an access preview that allows you to preview IAM Access Analyzer findings for your resource before deploying resource permissions.	Y	N
CreateAnalyzer	Creates an analyzer for your account.	Y	N
CreateArchiveRule	Creates an archive rule for the specified analyzer.	Y	N
CreateServiceLinkedAnalyzer	Creates a service-linked analyzer managed by an Amazon Web Services service.	Y	N
DeleteArchiveRule	Deletes the specified archive rule.	Y	N
DeleteServiceLinkedAnalyzer	Deletes a service-linked analyzer.	Y	N
GenerateFindingRecommendation	Creates a recommendation for an unused permissions finding.	Y	N
GetAccessPreview	Retrieves information about an access preview for the specified analyzer.	Y	N
GetAnalyzedResource	Retrieves information about a resource that was analyzed.	Y	N
GetAnalyzer	Retrieves information about the specified analyzer.	Y	N
GetArchiveRule	Retrieves information about an archive rule.	Y	N
GetFinding	Retrieves information about the specified finding.	Y	N
GetFindingRecommendation	Retrieves information about a finding recommendation for the specified analyzer.	Y	N
GetFindingsStatistics	Retrieves a list of aggregated finding statistics for an external access or unused access analyzer.	Y	N
GetGeneratedPolicy	Retrieves the policy that was generated using StartPolicyGeneration.	Y	N
ListAccessPreviewFindings	Retrieves a list of access preview findings generated by the specified access preview.	Y	N
ListAccessPreviews	Retrieves a list of access previews for the specified analyzer.	Y	N
ListAnalyzedResources	Retrieves a list of resources of the specified type that have been analyzed by the specified analyzer.	Y	N
ListAnalyzers	Retrieves a list of analyzers.	Y	N
ListArchiveRules	Retrieves a list of archive rules created for the specified analyzer.	Y	N
ListFindings	Retrieves a list of findings generated by the specified analyzer.	Y	N
ListPolicyGenerations	Lists all of the policy generations requested in the last seven days.	Y	N
ListTagsForResource	Retrieves a list of tags applied to the specified resource.	Y	N
StartPolicyGeneration	Starts the policy generation request.	Y	N
StartResourceScan	Immediately starts a scan of the policies applied to the specified resource.	Y	N
TagResource	Adds a tag to the specified resource.	Y	N
UntagResource	Removes a tag from the specified resource.	Y	N
UpdateAnalyzer	Modifies the configuration of an existing analyzer.	Y	N
UpdateArchiveRule	Updates the criteria and values for the specified archive rule.	Y	N
UpdateFindings	Updates the status for the specified findings.	Y	N
ValidatePolicy	Requests the validation of a policy and returns a list of findings.	Y	N

any: AWS IAM Access Analyzer (catch-all)

Service: access-analyzer

Description

Catch-all entry for AWS IAM Access Analyzer rules that match the service but not a specific eventName.

DeleteAnalyzer

Service: access-analyzer

Description

Deletes the specified IAM Access Analyzer, stopping all findings generation for resources monitored by that analyzer.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "eventCategory": "Management",
  "eventID": "ced9d0e9-6d55-4599-9397-bb080f765052",
  "eventName": "DeleteAnalyzer",
  "eventSource": "access-analyzer.amazonaws.com",
  "eventTime": "2026-06-29T19:21:45Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "3fd21892-d6e3-4a1f-8dae-5c70ad1b6b88",
  "requestParameters": {
    "analyzerName": "ddddd",
    "clientToken": "777ae334-3c26-4cd7-923f-623570e6f63c"
  },
  "responseElements": {
    "message": "Analyzer not found"
  },
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

YARA-L #

AWS IAM Access Analyzer Deleted source low: Detects when AWS IAM Access Analyzer is deleted.T1562

ApplyArchiveRule

Service: access-analyzer

Description

Retroactively applies the archive rule to existing findings that meet the archive rule criteria.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "9cefaed4-150b-46dd-be4a-990b8d54949b",
  "eventName": "ApplyArchiveRule",
  "eventSource": "access-analyzer.amazonaws.com",
  "eventTime": "2026-06-29T21:46:49Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "85a0457d-3bcb-4ec3-8b18-a5a5377f4ff4",
  "requestParameters": {
    "analyzerArn": "arn:aws:access-analyzer:us-west-1:123456789012:analyzer/dwfix-analyzer",
    "clientToken": "e5a2efae-7756-40c0-b43e-2cadc3353dca",
    "ruleName": "dwfix-rule"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,D,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CancelPolicyGeneration

Service: access-analyzer

Description

Cancels the requested policy generation.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "eventCategory": "Management",
  "eventID": "d6e6b5ee-5862-4787-a7f8-f4deefef2bdf",
  "eventName": "CancelPolicyGeneration",
  "eventSource": "access-analyzer.amazonaws.com",
  "eventTime": "2026-06-29T19:21:46Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "4e39e92a-bdc1-4da5-86ba-20b87a4b96ba",
  "requestParameters": {
    "jobId": "dw-probe"
  },
  "responseElements": {
    "message": "Invalid jobId: dw-probe does not exist",
    "reason": "FIELD_VALIDATION_FAILED"
  },
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CheckAccessNotGranted

Service: access-analyzer

Description

Checks whether the specified access isn't allowed by a policy.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "eventCategory": "Management",
  "eventID": "eab0d4f2-82a2-4959-81cd-3040c0b8b1f2",
  "eventName": "CheckAccessNotGranted",
  "eventSource": "access-analyzer.amazonaws.com",
  "eventTime": "2026-06-29T18:42:38Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "ae6a9321-fd75-4f3b-9401-f1d5e481d45a",
  "requestParameters": {
    "access": [
      {}
    ],
    "policyDocument": "***",
    "policyType": "IDENTITY_POLICY"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CheckNoNewAccess

Service: access-analyzer

Description

Checks whether new access is allowed for an updated policy when compared to the existing policy.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "eventCategory": "Management",
  "eventID": "b2cb8c4d-d0b2-483d-a89b-c99584002938",
  "eventName": "CheckNoNewAccess",
  "eventSource": "access-analyzer.amazonaws.com",
  "eventTime": "2026-06-29T18:42:38Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "559c1e8d-071b-48b5-8b87-bc8216c80058",
  "requestParameters": {
    "existingPolicyDocument": "***",
    "newPolicyDocument": "***",
    "policyType": "IDENTITY_POLICY"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CheckNoPublicAccess

Service: access-analyzer

Description

Checks whether a resource policy can grant public access to the specified resource type.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "eventCategory": "Management",
  "eventID": "9b1744a1-e407-4cbe-bfae-586314081c12",
  "eventName": "CheckNoPublicAccess",
  "eventSource": "access-analyzer.amazonaws.com",
  "eventTime": "2026-06-29T18:42:38Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "e5af8dfd-1335-4cb3-8a04-433a1a40640b",
  "requestParameters": {
    "policyDocument": "***",
    "resourceType": "AWS::DynamoDB::Table"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreateAccessPreview

Service: access-analyzer

Description

Creates an access preview that allows you to preview IAM Access Analyzer findings for your resource before deploying resource permissions.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "eventCategory": "Management",
  "eventID": "ebc5a76b-6b6c-4173-ad72-94aaeaafce42",
  "eventName": "CreateAccessPreview",
  "eventSource": "access-analyzer.amazonaws.com",
  "eventTime": "2026-06-29T21:46:49Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "51d00440-067c-4212-8c3b-0cb88177a9b6",
  "requestParameters": {
    "analyzerArn": "arn:aws:access-analyzer:us-west-1:123456789012:analyzer/dwfix-analyzer",
    "clientToken": "5a278f7e-7745-4e7c-abd1-7656a7aaf010",
    "configurations": {
      "arn:aws:iam::123456789012:user/sample-user": {
        "iamRole": {
          "trustPolicy": {
            "Version": "2012-10-17",
            "Statement": [
              {
                "Effect": "Allow",
                "Principal": {
                  "Service": "ec2.amazonaws.com"
                },
                "Action": "sts:AssumeRole"
              }
            ]
          }
        }
      }
    }
  },
  "responseElements": {
    "message": "Invalid IAM role ARN",
    "reason": "FIELD_VALIDATION_FAILED"
  },
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,D,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreateAnalyzer

Service: access-analyzer

Description

Creates an analyzer for your account.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "3615e8ac-683b-4f3c-acfb-cedfa790105f",
  "eventName": "CreateAnalyzer",
  "eventSource": "access-analyzer.amazonaws.com",
  "eventTime": "2026-06-29T21:46:44Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "db9710f4-e38d-4754-affe-24b3320631aa",
  "requestParameters": {
    "analyzerName": "dwfix-analyzer",
    "clientToken": "6ca5ee30-c453-42bd-a8bc-bc713a5b99a9",
    "tags": {
      "Project": "dwfix",
      "Purpose": "sample-collection"
    },
    "type": "ACCOUNT"
  },
  "responseElements": {
    "arn": "arn:aws:access-analyzer:us-west-1:123456789012:analyzer/dwfix-analyzer"
  },
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,D,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreateArchiveRule

Service: access-analyzer

Description

Creates an archive rule for the specified analyzer.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "d083a1d8-e638-4d40-906c-e14cc157fb14",
  "eventName": "CreateArchiveRule",
  "eventSource": "access-analyzer.amazonaws.com",
  "eventTime": "2026-06-29T21:46:49Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "77448842-8b27-4a8e-a529-f142310dcd9b",
  "requestParameters": {
    "analyzerName": "dwfix-analyzer",
    "clientToken": "2f4ed623-ff76-46a2-9302-adc6dd93e1bf",
    "filter": {
      "error": {
        "exists": false
      }
    },
    "ruleName": "dwfix-rule"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,D,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreateServiceLinkedAnalyzer

Service: access-analyzer

Description

Creates a service-linked analyzer managed by an Amazon Web Services service.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "AccessDenied",
  "eventCategory": "Management",
  "eventID": "99ac47de-4707-46cd-b603-b203e20d100a",
  "eventName": "CreateServiceLinkedAnalyzer",
  "eventSource": "access-analyzer.amazonaws.com",
  "eventTime": "2026-06-29T21:46:49Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "83fe04dc-89c0-4b1c-ba65-f9eb37083768",
  "requestParameters": {
    "clientToken": "8b896f3a-e24b-4e63-b665-a2699e043821",
    "type": "ACCOUNT_UNUSED_ACCESS"
  },
  "responseElements": {
    "message": "The caller does not have sufficient permissions, or the service principal is not authorized to create analyzers"
  },
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,D,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteArchiveRule

Service: access-analyzer

Description

Deletes the specified archive rule.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "eventCategory": "Management",
  "eventID": "1d7b2aa4-9dad-441b-bea0-e050f7a50154",
  "eventName": "DeleteArchiveRule",
  "eventSource": "access-analyzer.amazonaws.com",
  "eventTime": "2026-06-29T19:21:46Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "16d9133a-9ab3-45ad-a1c4-9180b5db9b0e",
  "requestParameters": {
    "analyzerName": "ddddd",
    "clientToken": "122e15f2-27cc-4e6c-b3b1-48d5c3cb45ea",
    "ruleName": "ddddd"
  },
  "responseElements": {
    "message": "Analyzer not found"
  },
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteServiceLinkedAnalyzer

Service: access-analyzer

Description

Deletes a service-linked analyzer.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "AccessDenied",
  "eventCategory": "Management",
  "eventID": "d6fe3eb5-0969-4a3c-9bc4-845ba865a1cf",
  "eventName": "DeleteServiceLinkedAnalyzer",
  "eventSource": "access-analyzer.amazonaws.com",
  "eventTime": "2026-06-29T19:21:46Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "de1900d3-92e5-4fcb-8e12-85dd5e610adb",
  "requestParameters": {
    "analyzerName": "ddddd",
    "clientToken": "fe57a2e1-5f7c-4dea-b7ed-bdfea881f279"
  },
  "responseElements": {
    "message": "Permission Denied"
  },
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GenerateFindingRecommendation

Service: access-analyzer

Description

Creates a recommendation for an unused permissions finding.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "eventCategory": "Management",
  "eventID": "729d0ec0-6247-4ce7-b848-e63ded694c88",
  "eventName": "GenerateFindingRecommendation",
  "eventSource": "access-analyzer.amazonaws.com",
  "eventTime": "2026-06-29T21:46:49Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "a829e12d-4893-4b96-8c5a-50be8ee82dd7",
  "requestParameters": {
    "analyzerArn": "arn:aws:access-analyzer:us-west-1:123456789012:analyzer/dwfix-analyzer",
    "id": "00000000-0000-0000-0000-000000000000"
  },
  "responseElements": {
    "message": "Unsupported analyzer type for recommendation",
    "reason": "FIELD_VALIDATION_FAILED"
  },
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,D,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetAccessPreview

Service: access-analyzer

Description

Retrieves information about an access preview for the specified analyzer.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "AccessDenied",
  "eventCategory": "Management",
  "eventID": "f0bd868a-8b76-47ff-a070-102645ab10d4",
  "eventName": "GetAccessPreview",
  "eventSource": "access-analyzer.amazonaws.com",
  "eventTime": "2026-06-29T18:42:38Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "f0d9ef51-631c-4e62-8bf4-4381243afe34",
  "requestParameters": {
    "accessPreviewId": "dw-probe",
    "analyzerArn": "arn:aws:iam::123456789012:role/dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetAnalyzedResource

Service: access-analyzer

Description

Retrieves information about a resource that was analyzed.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "AccessDenied",
  "eventCategory": "Management",
  "eventID": "e14bc3f4-694e-4be0-b754-b4fbf0f82f8e",
  "eventName": "GetAnalyzedResource",
  "eventSource": "access-analyzer.amazonaws.com",
  "eventTime": "2026-06-29T18:42:38Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "4ced0f08-f176-448f-af80-9e6678e8eb1f",
  "requestParameters": {
    "analyzerArn": "arn:aws:iam::123456789012:role/dw-probe",
    "resourceArn": "arn:aws:iam::123456789012:role/dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetAnalyzer

Service: access-analyzer

Description

Retrieves information about the specified analyzer.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "eventCategory": "Management",
  "eventID": "f77af8c2-d5a2-4982-85df-a866a2ba7d44",
  "eventName": "GetAnalyzer",
  "eventSource": "access-analyzer.amazonaws.com",
  "eventTime": "2026-06-29T18:42:38Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "6fea7f75-5ee0-4764-8220-eb8327396145",
  "requestParameters": {
    "analyzerName": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetArchiveRule

Service: access-analyzer

Description

Retrieves information about an archive rule.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "eventCategory": "Management",
  "eventID": "17aed8eb-de85-4203-be5a-9d104d23d868",
  "eventName": "GetArchiveRule",
  "eventSource": "access-analyzer.amazonaws.com",
  "eventTime": "2026-06-29T18:42:38Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "f3abfa22-5e7e-4bdb-ad7b-2c31f3ae28e1",
  "requestParameters": {
    "analyzerName": "ddddd",
    "ruleName": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetFinding

Service: access-analyzer

Description

Retrieves information about the specified finding.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "AccessDenied",
  "eventCategory": "Management",
  "eventID": "6191a521-8c81-46cf-ac5a-13e84319222e",
  "eventName": "GetFinding",
  "eventSource": "access-analyzer.amazonaws.com",
  "eventTime": "2026-06-29T18:42:38Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "d080c588-928b-4f60-af28-8143d1944435",
  "requestParameters": {
    "analyzerArn": "arn:aws:iam::123456789012:role/dw-probe",
    "id": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetFindingRecommendation

Service: access-analyzer

Description

Retrieves information about a finding recommendation for the specified analyzer.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "AccessDenied",
  "eventCategory": "Management",
  "eventID": "a458877d-0a28-4ab9-8a64-d19ce717a0d0",
  "eventName": "GetFindingRecommendation",
  "eventSource": "access-analyzer.amazonaws.com",
  "eventTime": "2026-06-29T18:42:38Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "105dc94b-afa4-4a20-b8ec-96341ff29f8a",
  "requestParameters": {
    "analyzerArn": "arn:aws:iam::123456789012:role/dw-probe",
    "id": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetFindingsStatistics

Service: access-analyzer

Description

Retrieves a list of aggregated finding statistics for an external access or unused access analyzer.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "AccessDenied",
  "eventCategory": "Management",
  "eventID": "049af4ec-0a23-4f33-b4e4-556b8fd2b6c2",
  "eventName": "GetFindingsStatistics",
  "eventSource": "access-analyzer.amazonaws.com",
  "eventTime": "2026-06-29T18:42:38Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "96e7ee9d-ce27-482e-88f9-43f72988ab4b",
  "requestParameters": {
    "analyzerArn": "arn:aws:iam::123456789012:role/dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetGeneratedPolicy

Service: access-analyzer

Description

Retrieves the policy that was generated using StartPolicyGeneration.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "eventCategory": "Management",
  "eventID": "5c4e2608-ddc0-4b66-800f-aa3610fae90c",
  "eventName": "GetGeneratedPolicy",
  "eventSource": "access-analyzer.amazonaws.com",
  "eventTime": "2026-06-29T18:42:38Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "ac0c8be5-54d4-40c2-8ba4-0b39ee5eaa4b",
  "requestParameters": {
    "jobId": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListAccessPreviewFindings

Service: access-analyzer

Description

Retrieves a list of access preview findings generated by the specified access preview.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "AccessDenied",
  "eventCategory": "Management",
  "eventID": "b9492627-15a3-486a-bac4-af8ba6eeca4d",
  "eventName": "ListAccessPreviewFindings",
  "eventSource": "access-analyzer.amazonaws.com",
  "eventTime": "2026-06-29T18:42:38Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "44a54c40-5c30-45d3-aebd-e54218f47dc9",
  "requestParameters": {
    "accessPreviewId": "dw-probe",
    "analyzerArn": "arn:aws:iam::123456789012:role/dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListAccessPreviews

Service: access-analyzer

Description

Retrieves a list of access previews for the specified analyzer.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "AccessDenied",
  "eventCategory": "Management",
  "eventID": "ee26045b-6af7-4a7e-bda0-06b19ab721cb",
  "eventName": "ListAccessPreviews",
  "eventSource": "access-analyzer.amazonaws.com",
  "eventTime": "2026-06-29T18:42:38Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "bde3eced-f99c-4237-8aaf-084aeab3b839",
  "requestParameters": {
    "analyzerArn": "arn:aws:iam::123456789012:role/dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListAnalyzedResources

Service: access-analyzer

Description

Retrieves a list of resources of the specified type that have been analyzed by the specified analyzer.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "AccessDenied",
  "eventCategory": "Management",
  "eventID": "c324112e-55ad-498d-9217-4c9ea74ae9b2",
  "eventName": "ListAnalyzedResources",
  "eventSource": "access-analyzer.amazonaws.com",
  "eventTime": "2026-06-29T18:42:39Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "991b9ab8-977e-460e-b59f-ccad104e71fd",
  "requestParameters": {
    "analyzerArn": "arn:aws:iam::123456789012:role/dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListAnalyzers

Service: access-analyzer

Description

Retrieves a list of analyzers.

Example CloudTrail Event #

{
  "awsRegion": "us-east-2",
  "eventCategory": "Management",
  "eventID": "658bc58f-8e6b-4d82-9fce-3d9467e119b7",
  "eventName": "ListAnalyzers",
  "eventSource": "access-analyzer.amazonaws.com",
  "eventTime": "2021-07-07T18:01:10Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "797507667711",
  "requestID": "e2fb76be-6f76-4566-ba17-13ea0c5c3d51",
  "requestParameters": {
    "type": "ACCOUNT"
  },
  "responseElements": null,
  "sourceIPAddress": "213.205.197.162",
  "userAgent": "console.amazonaws.com",
  "userIdentity": {
    "accessKeyId": "ASIA3TLZJI37UTIYAZ4G",
    "accountId": "797507667711",
    "arn": "arn:aws:iam::797507667711:user/bruce",
    "principalId": "AIDA3TLZJI372XH6M2Q25",
    "sessionContext": {
      "attributes": {
        "creationDate": "2021-07-07T11:45:11Z",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {},
      "webIdFederationData": {}
    },
    "type": "IAMUser",
    "userName": "bruce"
  }
}

References #

Sample log: cado-security/AWS_EKS_Cluster_Forensics

ListArchiveRules

Service: access-analyzer

Description

Retrieves a list of archive rules created for the specified analyzer.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "eventCategory": "Management",
  "eventID": "4c336eb9-750d-4f70-bade-e5bf01b63433",
  "eventName": "ListArchiveRules",
  "eventSource": "access-analyzer.amazonaws.com",
  "eventTime": "2026-06-29T18:42:39Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "99f3d813-d5fe-45e6-a1eb-00ae6eaf4805",
  "requestParameters": {
    "analyzerName": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListFindings

Service: access-analyzer

Description

Retrieves a list of findings generated by the specified analyzer.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "AccessDenied",
  "eventCategory": "Management",
  "eventID": "e5047ddb-a729-4a6b-b3ef-fb696693bd94",
  "eventName": "ListFindings",
  "eventSource": "access-analyzer.amazonaws.com",
  "eventTime": "2026-06-29T18:42:39Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "9856ef2f-e37e-4086-93e8-e7c5751d0175",
  "requestParameters": {
    "analyzerArn": "arn:aws:iam::123456789012:role/dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListPolicyGenerations

Service: access-analyzer

Description

Lists all of the policy generations requested in the last seven days.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "f04b141a-b130-43d9-9048-002a42742f35",
  "eventName": "ListPolicyGenerations",
  "eventSource": "access-analyzer.amazonaws.com",
  "eventTime": "2026-06-29T18:31:26Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "4332250f-5bd5-4c5f-8fa7-5b27e46befaf",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b,n cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListTagsForResource

Service: access-analyzer

Description

Retrieves a list of tags applied to the specified resource.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "BadRequestException",
  "eventCategory": "Management",
  "eventID": "34bfffc8-3f21-4e65-a093-e8bde40836f9",
  "eventName": "ListTagsForResource",
  "eventSource": "access-analyzer.amazonaws.com",
  "eventTime": "2026-06-29T18:42:39Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "91c8b36d-4791-45f8-ab81-d25db4315279",
  "requestParameters": {
    "resourceArn": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

StartPolicyGeneration

Service: access-analyzer

Description

Starts the policy generation request.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "eventCategory": "Management",
  "eventID": "6bf9f14e-69a8-4085-82ec-e05b3b313295",
  "eventName": "StartPolicyGeneration",
  "eventSource": "access-analyzer.amazonaws.com",
  "eventTime": "2026-06-29T21:46:49Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "54549386-d4a9-4f14-97c7-3ff9233aab0c",
  "requestParameters": {
    "clientToken": "647b58ed-6467-4aea-af41-d8d1ebe8ff19",
    "policyGenerationDetails": {
      "principalArn": "arn:aws:iam::123456789012:user/sample-user"
    }
  },
  "responseElements": {
    "message": "Missing cloudTrailDetails",
    "reason": "FIELD_VALIDATION_FAILED"
  },
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,D,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

StartResourceScan

Service: access-analyzer

Description

Immediately starts a scan of the policies applied to the specified resource.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "eventCategory": "Management",
  "eventID": "3bb29425-d019-48e3-af67-033edeaeed7c",
  "eventName": "StartResourceScan",
  "eventSource": "access-analyzer.amazonaws.com",
  "eventTime": "2026-06-29T21:46:49Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "b6653ab5-6bef-47eb-aac6-1279d5deea50",
  "requestParameters": {
    "analyzerArn": "arn:aws:access-analyzer:us-west-1:123456789012:analyzer/dwfix-analyzer",
    "resourceArn": "arn:aws:iam::123456789012:user/sample-user"
  },
  "responseElements": {
    "message": "Invalid resourceArn",
    "reason": "FIELD_VALIDATION_FAILED"
  },
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,D,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

TagResource

Service: access-analyzer

Description

Adds a tag to the specified resource.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "8ab7bd19-3695-4d96-9215-9ff78a485510",
  "eventName": "TagResource",
  "eventSource": "access-analyzer.amazonaws.com",
  "eventTime": "2026-06-29T21:46:49Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "f057eb4a-89f8-4b8e-a722-b7f95d3fa0d0",
  "requestParameters": {
    "resourceArn": "arn:aws:access-analyzer:us-west-1:123456789012:analyzer/dwfix-analyzer",
    "tags": {
      "AutoDelete": "true",
      "Environment": "test"
    }
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,D,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UntagResource

Service: access-analyzer

Description

Removes a tag from the specified resource.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "BadRequestException",
  "eventCategory": "Management",
  "eventID": "0f04b888-d8d4-4bf8-b199-29f235e29648",
  "eventName": "UntagResource",
  "eventSource": "access-analyzer.amazonaws.com",
  "eventTime": "2026-06-29T19:21:46Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "88fae9ae-7205-4aef-b40c-81167d14df9e",
  "requestParameters": {
    "resourceArn": "dw-probe",
    "tagKeys": "dw-probe"
  },
  "responseElements": {
    "message": "Invalid input resource arn: bad syntax"
  },
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateAnalyzer

Service: access-analyzer

Description

Modifies the configuration of an existing analyzer.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "eventCategory": "Management",
  "eventID": "169025b0-e344-4477-888e-657062baec5e",
  "eventName": "UpdateAnalyzer",
  "eventSource": "access-analyzer.amazonaws.com",
  "eventTime": "2026-06-29T19:21:46Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "6c1d7f17-a5a3-4fb2-a9e8-5acf4240742c",
  "requestParameters": {
    "analyzerName": "ddddd"
  },
  "responseElements": {
    "message": "Analyzer not found"
  },
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateArchiveRule

Service: access-analyzer

Description

Updates the criteria and values for the specified archive rule.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "eventCategory": "Management",
  "eventID": "65b1cfc8-4c7a-4aae-881f-8866bf4da416",
  "eventName": "UpdateArchiveRule",
  "eventSource": "access-analyzer.amazonaws.com",
  "eventTime": "2026-06-29T19:21:46Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "17c57dd0-633d-4a16-a3ed-4d7c0cb1559d",
  "requestParameters": {
    "analyzerName": "ddddd",
    "clientToken": "aeca68b3-e7b5-4102-9f00-78c19d102d16",
    "filter": {},
    "ruleName": "ddddd"
  },
  "responseElements": {
    "message": "Analyzer not found"
  },
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateFindings

Service: access-analyzer

Description

Updates the status for the specified findings.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "AccessDenied",
  "eventCategory": "Management",
  "eventID": "40a3d6c7-9de5-4bbe-afbf-f724adf916ed",
  "eventName": "UpdateFindings",
  "eventSource": "access-analyzer.amazonaws.com",
  "eventTime": "2026-06-29T19:21:46Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "d9ec80fa-7323-4d19-aaf3-2305000a2f56",
  "requestParameters": {
    "analyzerArn": "arn:aws:iam::123456789012:role/dw-probe",
    "clientToken": "c0ac32ad-e48e-46f5-8d61-5074e185d177",
    "status": "ACTIVE"
  },
  "responseElements": {
    "message": "User: arn:aws:iam::123456789012:user/sample-user is not authorized to access this resource"
  },
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ValidatePolicy

Service: access-analyzer

Description

Requests the validation of a policy and returns a list of findings.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "29788994-4e2d-46f1-94e3-185dd02e4b64",
  "eventName": "ValidatePolicy",
  "eventSource": "access-analyzer.amazonaws.com",
  "eventTime": "2026-06-29T21:46:49Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "5d263f1d-eccb-4a9b-999b-dbbcc17713ff",
  "requestParameters": {
    "policyDocument": {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": "s3:GetObject",
          "Resource": "*"
        }
      ]
    },
    "policyType": "IDENTITY_POLICY"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,D,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}