AWS AppSync

eventName	Description	Sample	Rule
any	Catch-all entry for AWS AppSync rules that match the service but not a specific eventName.	N	N
AssociateApi	Maps an endpoint to your custom domain. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
AssociateMergedGraphqlApi	Creates an association between a Merged API and source API using the source API's identifier. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
AssociateSourceGraphqlApi	Creates an association between a Merged API and source API using the Merged API's identifier. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
CreateApi	Creates an Api object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
CreateApiCache	Creates a cache for the GraphQL API. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
CreateApiKey	Creates a unique key that you can distribute to clients who invoke your API.	Y	N
CreateChannelNamespace	Creates a ChannelNamespace for an Api. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
CreateDataSource	Creates a DataSource object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
CreateDomainName	Creates a custom DomainName object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
CreateFunction	Creates a Function object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
CreateGraphqlApi	Creates a GraphqlApi object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
CreateResolver	Creates a Resolver object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
CreateType	Creates a Type object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
DeleteApi	Deletes an Api object Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
DeleteApiCache	Deletes an ApiCache object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
DeleteApiKey	Deletes an API key. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
DeleteChannelNamespace	Deletes a ChannelNamespace. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
DeleteDataSource	Deletes a DataSource object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
DeleteDomainName	Deletes a custom DomainName object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
DeleteFunction	Deletes a Function. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
DeleteGraphqlApi	Deletes a GraphqlApi object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
DeleteResolver	Deletes a Resolver object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
DeleteType	Deletes a Type object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
DisassociateApi	Removes an ApiAssociation object from a custom domain. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
DisassociateMergedGraphqlApi	Deletes an association between a Merged API and source API using the source API's identifier and the association ID. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
DisassociateSourceGraphqlApi	Deletes an association between a Merged API and source API using the Merged API's identifier and the association ID. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
EvaluateCode	Evaluates the given code and returns the response. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
EvaluateMappingTemplate	Evaluates a given template and returns the response. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
FlushApiCache	Flushes an ApiCache object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
GetApi	Retrieves an Api object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
GetApiAssociation	Retrieves an ApiAssociation object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
GetApiCache	Retrieves an ApiCache object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
GetChannelNamespace	Retrieves the channel namespace for a specified Api. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
GetDataSource	Retrieves a DataSource object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
GetDataSourceIntrospection	Retrieves the record of an existing introspection. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
GetDomainName	Retrieves a custom DomainName object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
GetFunction	Get a Function. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
GetGraphqlApi	Retrieves a GraphqlApi object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
GetGraphqlApiEnvironmentVariables	Retrieves the list of environmental variable key-value pairs associated with an API by its ID value. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
GetIntrospectionSchema	Retrieves the introspection schema for a GraphQL API.	Y	N
GetResolver	Retrieves a Resolver object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
GetSchemaCreationStatus	Retrieves the current status of a schema creation operation. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
GetSourceApiAssociation	Retrieves a SourceApiAssociation object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
GetType	Retrieves a Type object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
ListApiKeys	Lists the API keys for a given API. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
ListApis	Lists the APIs in your AppSync account. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record.	N	N
ListChannelNamespaces	Lists the channel namespaces for a specified Api. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
ListDataSources	Lists the data sources for a given API. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
ListDomainNames	Lists multiple custom domain names. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
ListFunctions	List multiple functions. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
ListGraphqlApis	Lists your GraphQL APIs. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record.	N	N
ListResolvers	Lists the resolvers for a given API and type. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
ListResolversByFunction	List the resolvers that are associated with a specific function. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
ListSourceApiAssociations	Lists the SourceApiAssociationSummary data. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
ListTagsForResource	Lists the tags for a resource. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
ListTypes	Lists the types for a given API. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
ListTypesByAssociation	Lists Type objects by the source API association ID. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
PutGraphqlApiEnvironmentVariables	Creates a list of environmental variables in an API by its ID value. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
StartDataSourceIntrospection	Creates a new introspection. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
StartSchemaCreation	Adds a new schema to your GraphQL API. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
StartSchemaMerge	Initiates a merge operation. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
TagResource	Tags a resource with user-supplied tags. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
UntagResource	Untags a resource. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
UpdateApi	Updates an Api. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
UpdateApiCache	Updates the cache for the GraphQL API. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
UpdateApiKey	Updates an API key. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
UpdateChannelNamespace	Updates a ChannelNamespace associated with an Api. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
UpdateDataSource	Updates a DataSource object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
UpdateDomainName	Updates a custom DomainName object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
UpdateFunction	Updates a Function object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
UpdateGraphqlApi	Updates a GraphqlApi object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
UpdateResolver	Updates a Resolver object.	Y	N
UpdateSourceApiAssociation	Updates some of the configuration choices of a particular source API association. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
UpdateType	Updates a Type object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
ListResourcesForWebACL	ListResourcesForWebACL recorded by CloudTrail for AWS AppSync. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record.	N	N

any: AWS AppSync (catch-all)

Service: appsync

Description

Catch-all entry for AWS AppSync rules that match the service but not a specific eventName.

AssociateApi

Service: appsync

Description

Maps an endpoint to your custom domain. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

AssociateMergedGraphqlApi

Service: appsync

Description

Creates an association between a Merged API and source API using the source API's identifier. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

AssociateSourceGraphqlApi

Service: appsync

Description

Creates an association between a Merged API and source API using the Merged API's identifier. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

CreateApi

Service: appsync

Description

Creates an Api object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

CreateApiCache

Service: appsync

Description

Creates a cache for the GraphQL API. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

CreateApiKey

Service: appsync

Description

Creates a unique key that you can distribute to clients who invoke your API.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "AccessDenied",
  "eventCategory": "Management",
  "eventID": "95614094-37de-41f8-8dd0-19e73a21bd86",
  "eventName": "CreateApiKey",
  "eventSource": "appsync.amazonaws.com",
  "eventTime": "2024-08-18T13:17:41Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.09",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "45f6dc04-2729-4409-bad4-2aaf95382f74",
  "requestParameters": {
    "apiId": "TrailDiscoverApiId"
  },
  "responseElements": {
    "message": "User: arn:aws:iam::123456789012:user/TrailDiscover is not authorized to perform: appsync:CreateApiKey on resource: arn:aws:appsync:us-east-1:192374575148:/v1/apis/TrailDiscoverApiId/apikeys"
  },
  "sourceIPAddress": "0.0.0.0",
  "userAgent": "aws-cli/2.17.32 md/awscrt#0.21.2 ua/2.0 os/linux#0.0.0.0-microsoft-standard-WSL2 md/arch#x86_64 lang/python#3.11.9 md/pyimpl#CPython exec-env/grimoire_07c3196f-96a4-4e34-ab92-ac480b3f33a7 cfg/retry-mode#standard md/installer#exe md/distrib#ubuntu.24 md/prompt#off md/command#appsync.create-api-key",
  "userIdentity": {
    "accessKeyId": "AKIA****************",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/TrailDiscover",
    "principalId": "AROA****************:User",
    "type": "IAMUser",
    "userName": "TrailDiscover"
  }
}

References #

Sample log: TrailDiscover (CC-BY-4.0)

CreateChannelNamespace

Service: appsync

Description

Creates a ChannelNamespace for an Api. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

CreateDataSource

Service: appsync

Description

Creates a DataSource object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

CreateDomainName

Service: appsync

Description

Creates a custom DomainName object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

CreateFunction

Service: appsync

Description

Creates a Function object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

CreateGraphqlApi

Service: appsync

Description

Creates a GraphqlApi object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

CreateResolver

Service: appsync

Description

Creates a Resolver object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

CreateType

Service: appsync

Description

Creates a Type object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

DeleteApi

Service: appsync

Description

Deletes an Api object Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

DeleteApiCache

Service: appsync

Description

Deletes an ApiCache object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

DeleteApiKey

Service: appsync

Description

Deletes an API key. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

DeleteChannelNamespace

Service: appsync

Description

Deletes a ChannelNamespace. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

DeleteDataSource

Service: appsync

Description

Deletes a DataSource object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

DeleteDomainName

Service: appsync

Description

Deletes a custom DomainName object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

DeleteFunction

Service: appsync

Description

Deletes a Function. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

DeleteGraphqlApi

Service: appsync

Description

Deletes a GraphqlApi object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

DeleteResolver

Service: appsync

Description

Deletes a Resolver object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

DeleteType

Service: appsync

Description

Deletes a Type object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

DisassociateApi

Service: appsync

Description

Removes an ApiAssociation object from a custom domain. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

DisassociateMergedGraphqlApi

Service: appsync

Description

Deletes an association between a Merged API and source API using the source API's identifier and the association ID. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

DisassociateSourceGraphqlApi

Service: appsync

Description

Deletes an association between a Merged API and source API using the Merged API's identifier and the association ID. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

EvaluateCode

Service: appsync

Description

Evaluates the given code and returns the response. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

EvaluateMappingTemplate

Service: appsync

Description

Evaluates a given template and returns the response. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

FlushApiCache

Service: appsync

Description

Flushes an ApiCache object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

GetApi

Service: appsync

Description

Retrieves an Api object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

GetApiAssociation

Service: appsync

Description

Retrieves an ApiAssociation object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

GetApiCache

Service: appsync

Description

Retrieves an ApiCache object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

GetChannelNamespace

Service: appsync

Description

Retrieves the channel namespace for a specified Api. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

GetDataSource

Service: appsync

Description

Retrieves a DataSource object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

GetDataSourceIntrospection

Service: appsync

Description

Retrieves the record of an existing introspection. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

GetDomainName

Service: appsync

Description

Retrieves a custom DomainName object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

GetFunction

Service: appsync

Description

Get a Function. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

GetGraphqlApi

Service: appsync

Description

Retrieves a GraphqlApi object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

GetGraphqlApiEnvironmentVariables

Service: appsync

Description

Retrieves the list of environmental variable key-value pairs associated with an API by its ID value. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

GetIntrospectionSchema

Service: appsync

Description

Retrieves the introspection schema for a GraphQL API.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "AccessDenied",
  "eventCategory": "Management",
  "eventID": "48cde4c9-5dd0-4de2-bc66-de4543710334",
  "eventName": "GetIntrospectionSchema",
  "eventSource": "appsync.amazonaws.com",
  "eventTime": "2024-08-18T13:18:56Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.09",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "1e34929a-fdd7-4ee3-993e-3d5641c7a5d8",
  "requestParameters": {
    "apiId": "TrailDiscover",
    "format": "json"
  },
  "responseElements": null,
  "sourceIPAddress": "0.0.0.0",
  "userAgent": "aws-cli/2.17.32 md/awscrt#0.21.2 ua/2.0 os/linux#0.0.0.0-microsoft-standard-WSL2 md/arch#x86_64 lang/python#3.11.9 md/pyimpl#CPython exec-env/grimoire_eb8e25ac-fa3c-4ed6-a5a6-239a4b4f1175 cfg/retry-mode#standard md/installer#exe md/distrib#ubuntu.24 md/prompt#off md/command#appsync.get-introspection-schema",
  "userIdentity": {
    "accessKeyId": "AKIA****************",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/TrailDiscover",
    "principalId": "AROA****************:User",
    "type": "IAMUser",
    "userName": "TrailDiscover"
  }
}

References #

Sample log: TrailDiscover (CC-BY-4.0)

GetResolver

Service: appsync

Description

Retrieves a Resolver object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

GetSchemaCreationStatus

Service: appsync

Description

Retrieves the current status of a schema creation operation. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

GetSourceApiAssociation

Service: appsync

Description

Retrieves a SourceApiAssociation object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

GetType

Service: appsync

Description

Retrieves a Type object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

ListApiKeys

Service: appsync

Description

Lists the API keys for a given API. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

ListApis

Service: appsync

Description

Lists the APIs in your AppSync account. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record.

Example CloudTrail Event #

This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.

{
  "eventVersion": "1.11",
  "eventID": "82777e07-83bb-4c3d-9983-15df53d4b2d4",
  "eventSource": "appsync.amazonaws.com",
  "eventName": "ListApis",
  "awsRegion": "ap-northeast-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "1b346a0b-6f0f-4be9-9148-4885d46b54a2",
  "userAgent": "config.amazonaws.com"
}

ListChannelNamespaces

Service: appsync

Description

Lists the channel namespaces for a specified Api. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

ListDataSources

Service: appsync

Description

Lists the data sources for a given API. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

ListDomainNames

Service: appsync

Description

Lists multiple custom domain names. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

ListFunctions

Service: appsync

Description

List multiple functions. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

ListGraphqlApis

Service: appsync

Description

Lists your GraphQL APIs. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "f98975d0-4b40-4cb6-8426-7b6acbc86842",
  "eventSource": "appsync.amazonaws.com",
  "eventName": "ListGraphqlApis",
  "awsRegion": "ca-central-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "ea185d63-9cfc-47d6-b748-a8b9b06b8000",
  "userAgent": "aws-sdk-go-v2/1.43.0 ua/2.1 os/linux lang/go#1.26.5 md/GOOS#linux md/GOARCH#arm64 api/appsync#1.47.3 m/C,E,i"
}

ListResolvers

Service: appsync

Description

Lists the resolvers for a given API and type. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

ListResolversByFunction

Service: appsync

Description

List the resolvers that are associated with a specific function. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

ListSourceApiAssociations

Service: appsync

Description

Lists the SourceApiAssociationSummary data. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

ListTagsForResource

Service: appsync

Description

Lists the tags for a resource. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

ListTypes

Service: appsync

Description

Lists the types for a given API. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

ListTypesByAssociation

Service: appsync

Description

Lists Type objects by the source API association ID. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

PutGraphqlApiEnvironmentVariables

Service: appsync

Description

Creates a list of environmental variables in an API by its ID value. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

StartDataSourceIntrospection

Service: appsync

Description

Creates a new introspection. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

StartSchemaCreation

Service: appsync

Description

Adds a new schema to your GraphQL API. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

StartSchemaMerge

Service: appsync

Description

Initiates a merge operation. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

TagResource

Service: appsync

Description

Tags a resource with user-supplied tags. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

UntagResource

Service: appsync

Description

Untags a resource. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

UpdateApi

Service: appsync

Description

Updates an Api. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

UpdateApiCache

Service: appsync

Description

Updates the cache for the GraphQL API. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

UpdateApiKey

Service: appsync

Description

Updates an API key. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

UpdateChannelNamespace

Service: appsync

Description

Updates a ChannelNamespace associated with an Api. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

UpdateDataSource

Service: appsync

Description

Updates a DataSource object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

UpdateDomainName

Service: appsync

Description

Updates a custom DomainName object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

UpdateFunction

Service: appsync

Description

Updates a Function object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

UpdateGraphqlApi

Service: appsync

Description

Updates a GraphqlApi object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

UpdateResolver

Service: appsync

Description

Updates a Resolver object.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "AccessDenied",
  "eventCategory": "Management",
  "eventID": "ad140370-6dfb-4d93-9356-ba32eb5acc21",
  "eventName": "UpdateResolver",
  "eventSource": "appsync.amazonaws.com",
  "eventTime": "2024-08-18T13:21:07Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.09",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "413083a6-f841-4812-8dcd-f5d229a889ed",
  "requestParameters": {
    "apiId": "TrailDiscoverApiId",
    "fieldName": "TrailDiscoverFieldName",
    "pipelineConfig": {
      "functions": [
        "TrailDiscoverFunctions"
      ]
    },
    "requestMappingTemplate": "***",
    "responseMappingTemplate": "***",
    "typeName": "TrailDiscoverTypeName"
  },
  "responseElements": {
    "message": "User: arn:aws:iam::123456789012:user/TrailDiscover is not authorized to perform: appsync:UpdateResolver on resource: arn:aws:appsync:us-east-1:192374575148:/v1/apis/TrailDiscoverApiId/types/TrailDiscoverTypeName/resolvers/TrailDiscoverFieldName"
  },
  "sourceIPAddress": "0.0.0.0",
  "userAgent": "aws-cli/2.17.32 md/awscrt#0.21.2 ua/2.0 os/linux#0.0.0.0-microsoft-standard-WSL2 md/arch#x86_64 lang/python#3.11.9 md/pyimpl#CPython exec-env/grimoire_34bbdb4b-caf7-440f-8ca0-7fe6ff217c12 cfg/retry-mode#standard md/installer#exe md/distrib#ubuntu.24 md/prompt#off md/command#appsync.update-resolver",
  "userIdentity": {
    "accessKeyId": "AKIA****************",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/TrailDiscover",
    "principalId": "AROA****************:User",
    "type": "IAMUser",
    "userName": "TrailDiscover"
  }
}

References #

Sample log: TrailDiscover (CC-BY-4.0)

UpdateSourceApiAssociation

Service: appsync

Description

Updates some of the configuration choices of a particular source API association. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

UpdateType

Service: appsync

Description

Updates a Type object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

ListResourcesForWebACL

Service: appsync

Description

ListResourcesForWebACL recorded by CloudTrail for AWS AppSync. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "526a1040-b59b-4469-a916-ad44ffb00fe4",
  "eventSource": "appsync.amazonaws.com",
  "eventName": "ListResourcesForWebACL",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "9fc031dc-d833-401a-bb34-0cc447447a28",
  "userAgent": "wafv2.amazonaws.com"
}