AWS CloudFormation
| eventName | Description | Sample | Rule |
|---|---|---|---|
| any | Catch-all entry for AWS CloudFormation rules that match the service but not a specific eventName. | N | N |
| Create | Creates an AWS CloudFormation stack by provisioning the set of AWS resources defined in the specified template. | Y | Y |
| Create | Creates instances of a CloudFormation StackSet in specified accounts and AWS Regions, deploying the stack template to each target. | N | Y |
| Activate | Activate trusted access with Organizations. | N | N |
| Activate | Activates a public third-party extension, such as a resource or module, to make it available for use in stack templates in your current account and Region. | N | N |
| Batch | Returns configuration data for the specified CloudFormation extensions, from the CloudFormation registry in your current account and Region. | N | N |
| Cancel | Cancels an update on the specified stack. | Y | N |
| Continue | Continues rolling back a stack from UPDATE_ROLLBACK_FAILED to UPDATE_ROLLBACK_COMPLETE state. | Y | N |
| Create | Creates a list of changes that will be applied to a stack so that you can review the changes before executing them. | Y | N |
| Create | Creates a template from existing resources that are not already managed with CloudFormation. | Y | N |
| Create | Creates a refactor across multiple stacks, with the list of stacks and resources that are affected. | N | N |
| Create | Creates a StackSet. | Y | N |
| Deactivate | Deactivates trusted access with Organizations. | N | N |
| Deactivate | Deactivates a public third-party extension, such as a resource or module, or a CloudFormation Hook when you no longer use it. | Y | N |
| Delete | Deletes the specified change set. | Y | N |
| Delete | Deleted a generated template. | Y | N |
| Delete | Deletes a specified stack. | Y | N |
| Delete | Deletes stack instances for the specified accounts, in the specified Amazon Web Services Regions. | Y | N |
| Delete | Deletes a StackSet. | Y | N |
| Deregister | Marks an extension or extension version as DEPRECATED in the CloudFormation registry, removing it from active use. | Y | N |
| Describe | Retrieves your account's CloudFormation limits, such as the maximum number of stacks that you can create in your account. | Y | N |
| Describe | Returns the inputs for the change set and a list of changes that CloudFormation will make if you execute the change set. | Y | N |
| Describe | Returns Hook-related information for the change set and a list of changes that CloudFormation makes when you run the change set. | Y | N |
| Describe | Returns CloudFormation events based on flexible query criteria. | Y | N |
| Describe | Describes a generated template. | Y | N |
| Describe | Retrieves information about the account's OrganizationAccess status. | N | N |
| Describe | Returns information about a CloudFormation extension publisher. | Y | N |
| Describe | Describes details of a resource scan. | Y | N |
| Describe | Returns information about a stack drift detection operation. | Y | N |
| Describe | Returns all stack related events for a specified stack in reverse chronological order. | Y | N |
| Describe | Returns the stack instance that's associated with the specified StackSet, Amazon Web Services account, and Amazon Web Services Region. | N | N |
| Describe | Describes the stack refactor status. | Y | N |
| Describe | Returns a description of the specified resource in the specified stack. | Y | N |
| Describe | Returns drift information for the resources that have been checked for drift in the specified stack. | Y | N |
| Describe | Returns Amazon Web Services resource descriptions for running and deleted stacks. | Y | N |
| Describe | Returns the description for the specified stack; if no stack name was specified, then it returns the description for all the stacks created. | Y | N |
| Describe | Returns the description of the specified StackSet. | Y | N |
| Describe | Returns the description of the specified StackSet operation. | Y | N |
| Describe | Returns detailed information about an extension from the CloudFormation registry in your current account and Region. | Y | N |
| Describe | Returns information about an extension's registration, including its current status and type and version identifiers. | Y | N |
| Detect | Detects whether a stack's actual configuration differs, or has drifted, from its expected configuration, as defined in the stack template and any values specified as template parameters. | Y | N |
| Detect | Returns information about whether a resource's actual configuration differs, or has drifted, from its expected configuration, as defined in the stack template and any values specified as template parameters. | Y | N |
| Detect | Detect drift on a StackSet. | N | N |
| Estimate | Returns the estimated monthly cost of a template. | Y | N |
| Execute | Updates a stack using the input information that was provided when the specified change set was created. | Y | N |
| Execute | Executes the stack refactor operation. | N | N |
| Get | Retrieves a generated template. | Y | N |
| Get | Retrieves detailed information and remediation guidance for a Hook invocation result. | Y | N |
| Get | Returns the stack policy for a specified stack. | Y | N |
| Get | Returns the template body for a specified stack. | Y | N |
| Get | Returns information about a new or existing template. | Y | N |
| Import | Import existing stacks into a new StackSets. | N | N |
| List | Returns the ID and status of each active change set for a stack. | Y | N |
| List | Lists all exported output values in the account and Region in which you call this action. | Y | N |
| List | Lists your generated templates in this Region. | Y | N |
| List | Returns summaries of invoked Hooks. | Y | N |
| List | Lists all stacks that are importing an exported output value. | Y | N |
| List | Lists the related resources for a list of resources from a resource scan. | N | N |
| List | Lists the resources from a resource scan. | Y | N |
| List | List the resource scans from newest to oldest. | Y | N |
| List | Returns drift information for resources in a stack instance. | N | N |
| List | Returns summary information about stack instances that are associated with the specified StackSet. | Y | N |
| List | Lists the stack refactor actions that will be taken after calling the ExecuteStackRefactor action. | Y | N |
| List | Lists all account stack refactor operations and their statuses. | Y | N |
| List | Returns descriptions of all resources of the specified stack. | Y | N |
| List | Returns the summary information for stacks whose status matches the specified StackStatusFilter. | Y | N |
| List | Returns summary information about deployment targets for a StackSet. | Y | N |
| List | Returns summary information about the results of a StackSet operation. | Y | N |
| List | Returns summary information about operations performed on a StackSet. | Y | N |
| List | Returns summary information about StackSets that are associated with the user. | Y | N |
| List | Returns a list of registration tokens for the specified extension(s). | Y | N |
| List | Returns summary information about all extensions, including your private resource types, modules, and Hooks as well as all public extensions from Amazon Web Services and third-party publishers. | Y | N |
| List | Returns summary information about the versions of an extension. | Y | N |
| Publish | Publishes the specified extension to the CloudFormation registry as a public extension in this Region. | N | N |
| Record | Reports progress of a resource handler to CloudFormation. | N | N |
| Register | Registers your account as a publisher of public extensions in the CloudFormation registry. | N | N |
| Register | Registers an extension with the CloudFormation service. | N | N |
| Rollback | When specifying RollbackStack, you preserve the state of previously provisioned resources when an operation fails. | Y | N |
| Set | Sets a stack policy for a specified stack. | Y | N |
| Set | Specifies the configuration data for a CloudFormation extension, such as a resource or Hook, in the given account and Region. | N | N |
| Set | Specify the default version of an extension. | N | N |
| Signal | Sends a signal to the specified resource with a success or failure status. | N | N |
| Start | Starts a scan of the resources in this account in this Region. | Y | N |
| Stop | Stops an in-progress operation on a StackSet and its associated stack instances. | Y | N |
| Test | Tests a registered extension to make sure it meets all necessary requirements for being published in the CloudFormation registry. | N | N |
| Update | Updates a generated template. | Y | N |
| Update | Updates a stack as specified in the template. | Y | N |
| Update | Updates the parameter values for stack instances for the specified accounts, within the specified Amazon Web Services Regions. | Y | N |
| Update | Updates the StackSet and associated stack instances in the specified accounts and Amazon Web Services Regions. | Y | N |
| Update | Updates termination protection for the specified stack. | Y | N |
| Validate | Validates a specified template. | Y | N |
any: AWS CloudFormation (catch-all)
#Description
Catch-all entry for AWS CloudFormation rules that match the service but not a specific eventName.
CreateStack
#Description
Creates an AWS CloudFormation stack by provisioning the set of AWS resources defined in the specified template.
Example CloudTrail Event #
{
"awsRegion": "us-east-1",
"eventID": "6c4587f5-212d-4173-bc29-5c00bc0c3da1",
"eventName": "CreateStack",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2018-08-05T16:51:14Z",
"eventType": "AwsApiCall",
"eventVersion": "1.05",
"recipientAccountId": "811596193553",
"requestID": "c38bc83a-98cf-11e8-960c-52ab6bc0dcc4",
"requestParameters": {
"capabilities": [
"CAPABILITY_NAMED_IAM"
],
"disableRollback": false,
"notificationARNs": [],
"parameters": [
{
"parameterKey": "S3Bucket"
}
],
"stackName": "Summit-Route-security-assessment-access",
"tags": [],
"templateURL": "https://s3.amazonaws.com/summitroute-assets/security_assessment_access.template"
},
"responseElements": {
"stackId": "arn:aws:cloudformation:us-east-1:811596193553:stack/Summit-Route-security-assessment-access/c3953d30-98cf-11e8-82dd-9b75e9b8d57e"
},
"sourceIPAddress": "250.251.253.3",
"userAgent": "console.amazonaws.com",
"userIdentity": {
"accessKeyId": "ASIACF0UGMY4WFI0SHMN",
"accountId": "811596193553",
"arn": "arn:aws:iam::811596193553:root",
"principalId": "811596193553",
"sessionContext": {
"attributes": {
"creationDate": "2018-08-05T16:50:57Z",
"mfaAuthenticated": "true"
}
},
"type": "Root",
"userName": "flaws"
}
}
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Elastic #
T1648, T1651↳ also matches CreateStackInstances
References #
CreateStackInstances
#Description
Creates instances of a CloudFormation StackSet in specified accounts and AWS Regions, deploying the stack template to each target.
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Elastic #
T1648, T1651↳ also matches CreateStack
ActivateOrganizationsAccess
#Description
Activate trusted access with Organizations.
ActivateType
#Description
Activates a public third-party extension, such as a resource or module, to make it available for use in stack templates in your current account and Region.
BatchDescribeTypeConfigurations
#Description
Returns configuration data for the specified CloudFormation extensions, from the CloudFormation registry in your current account and Region.
CancelUpdateStack
#Description
Cancels an update on the specified stack.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "ValidationException",
"errorMessage": "Stack: dw-probe does not exist",
"eventCategory": "Management",
"eventID": "818d7e83-7e6b-4656-9e1d-5fe9d0871552",
"eventName": "CancelUpdateStack",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2026-06-29T19:21:53Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "123456789012",
"requestID": "5800867a-d962-4473-a2e5-ef47c1f06b9a",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"tlsDetails": {
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "cloudformation.us-west-1.amazonaws.com",
"tlsVersion": "TLSv1.3"
},
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
ContinueUpdateRollback
#Description
Continues rolling back a stack from UPDATE_ROLLBACK_FAILED to UPDATE_ROLLBACK_COMPLETE state.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "ValidationException",
"errorMessage": "RollbackUpdatedStack cannot be called from current stack status",
"eventCategory": "Management",
"eventID": "2ea8d536-0c45-4e70-b98c-a7a8de7de78a",
"eventName": "ContinueUpdateRollback",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2026-06-29T21:00:04Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "123456789012",
"requestID": "07343928-4134-4ba3-b12e-c05f7ca65a7c",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"tlsDetails": {
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "cloudformation.us-west-1.amazonaws.com",
"tlsVersion": "TLSv1.3"
},
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
CreateChangeSet
#Description
Creates a list of changes that will be applied to a stack so that you can review the changes before executing them.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"eventCategory": "Management",
"eventID": "d30e124f-9b73-48a4-b8ea-ff75e7bd2ea9",
"eventName": "CreateChangeSet",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2026-06-29T20:07:59Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "123456789012",
"requestID": "b0f7c887-1edc-42c3-815f-b62983e7971e",
"requestParameters": {
"changeSetName": "dwfix-cs",
"enableChangeAnalysis": false,
"routeToStateService": false,
"stackName": "dwfix-stack"
},
"responseElements": {
"id": "arn:aws:cloudformation:us-west-1:123456789012:changeSet/dwfix-cs/99e1c067-a1ba-47e1-8db6-8a44bfc7194c"
},
"sourceIPAddress": "203.0.113.5",
"tlsDetails": {
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "cloudformation.us-west-1.amazonaws.com",
"tlsVersion": "TLSv1.3"
},
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,b,Z cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
CreateGeneratedTemplate
#Description
Creates a template from existing resources that are not already managed with CloudFormation.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"eventCategory": "Management",
"eventID": "19611456-b346-48a4-b7bc-f5403a1f1600",
"eventName": "CreateGeneratedTemplate",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2026-06-29T21:00:39Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "123456789012",
"requestID": "f2ebcda0-b605-4d22-a517-23ee4590cc4f",
"requestParameters": null,
"responseElements": {
"arn": "arn:aws:cloudformation:us-west-1:123456789012:generatedTemplate/7c5eabed-bc1a-4641-9908-6ee978a19314",
"name": "dwfix-gen-tpl"
},
"sourceIPAddress": "203.0.113.5",
"tlsDetails": {
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "cloudformation.us-west-1.amazonaws.com",
"tlsVersion": "TLSv1.3"
},
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
CreateStackRefactor
#Description
Creates a refactor across multiple stacks, with the list of stacks and resources that are affected.
CreateStackSet
#Description
Creates a StackSet.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"eventCategory": "Management",
"eventID": "3e4a9432-89ec-408a-bd92-f29412f98b16",
"eventName": "CreateStackSet",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2026-06-29T21:00:38Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "123456789012",
"requestID": "6e23e875-dc71-4d4c-a191-6ce3beb01d43",
"requestParameters": {
"clientRequestToken": "d9e135ab-b9a9-497c-9046-33d60f290730",
"description": "dwfix sample collection stackset",
"permissionModel": "SELF_MANAGED",
"stackSetName": "dwfix-cfn-set"
},
"responseElements": {
"stackSetId": "dwfix-cfn-set:fa3efbca-f5c8-4097-972f-2313f6acc014"
},
"sourceIPAddress": "203.0.113.5",
"tlsDetails": {
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "cloudformation.us-west-1.amazonaws.com",
"tlsVersion": "TLSv1.3"
},
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
DeactivateOrganizationsAccess
#Description
Deactivates trusted access with Organizations.
DeactivateType
#Description
Deactivates a public third-party extension, such as a resource or module, or a CloudFormation Hook when you no longer use it.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "CFNRegistryException",
"errorMessage": "Please use arn or specify a type",
"eventCategory": "Management",
"eventID": "6633e7f2-a3aa-43cd-9bdb-42ff8419ab98",
"eventName": "DeactivateType",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2026-06-29T19:45:15Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "123456789012",
"requestID": "8f7b5332-8569-4e79-bf6a-bdbf38f6adbe",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"tlsDetails": {
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "cloudformation.us-west-1.amazonaws.com",
"tlsVersion": "TLSv1.3"
},
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,b,Z,n cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
DeleteChangeSet
#Description
Deletes the specified change set.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "ValidationException",
"errorMessage": "StackName must be specified if ChangeSetName is not specified as an ARN.",
"eventCategory": "Management",
"eventID": "fb853b1e-c484-4bd3-a0a0-3738269afa40",
"eventName": "DeleteChangeSet",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2026-06-29T19:21:53Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "123456789012",
"requestID": "d976c824-bdd5-472c-a107-dce23c145a40",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"tlsDetails": {
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "cloudformation.us-west-1.amazonaws.com",
"tlsVersion": "TLSv1.3"
},
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
DeleteGeneratedTemplate
#Description
Deleted a generated template.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "GeneratedTemplateNotFoundException",
"errorMessage": "Template with arn ddddd does not exist (Service: CfnTemplateGenerationServiceLambda; Status Code: 400; Error Code: GeneratedTemplateNotFoundException; Request ID: 85192f53-a688-43a7-b977-c924e17c5acc; Proxy: null)",
"eventCategory": "Management",
"eventID": "d9398acd-370c-427f-bf1c-451f7ec6803f",
"eventName": "DeleteGeneratedTemplate",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2026-06-29T19:21:53Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "123456789012",
"requestID": "913c8946-1798-471b-b1bc-99dc7dea2e00",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"tlsDetails": {
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "cloudformation.us-west-1.amazonaws.com",
"tlsVersion": "TLSv1.3"
},
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
DeleteStack
#Description
Deletes a specified stack.
Example CloudTrail Event #
{
"awsRegion": "us-east-1",
"eventID": "c87846b9-7680-4426-9d05-e35b69c2b567",
"eventName": "DeleteStack",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2018-08-05T16:53:38Z",
"eventType": "AwsApiCall",
"eventVersion": "1.05",
"recipientAccountId": "811596193553",
"requestID": "196b1dc0-98d0-11e8-b6aa-ae5fc7571c70",
"requestParameters": {
"stackName": "arn:aws:cloudformation:us-east-1:811596193553:stack/Summit-Route-security-assessment-access/c3953d30-98cf-11e8-82dd-9b75e9b8d57e"
},
"responseElements": null,
"sourceIPAddress": "250.251.253.3",
"userAgent": "console.amazonaws.com",
"userIdentity": {
"accessKeyId": "ASIAG2VJIE0XT3ZK8HTZ",
"accountId": "811596193553",
"arn": "arn:aws:iam::811596193553:root",
"principalId": "811596193553",
"sessionContext": {
"attributes": {
"creationDate": "2018-08-05T16:50:57Z",
"mfaAuthenticated": "true"
}
},
"type": "Root",
"userName": "flaws"
}
}
References #
DeleteStackInstances
#Description
Deletes stack instances for the specified accounts, in the specified Amazon Web Services Regions.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "ValidationException",
"errorMessage": "Region dw-probe is not supported",
"eventCategory": "Management",
"eventID": "f93f32b9-9bfd-4dc8-9af5-bf3d1f25c9fe",
"eventName": "DeleteStackInstances",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2026-06-29T19:21:53Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "123456789012",
"requestID": "d53bdb1d-5117-42f9-be96-496a139801ce",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"tlsDetails": {
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "cloudformation.us-west-1.amazonaws.com",
"tlsVersion": "TLSv1.3"
},
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
DeleteStackSet
#Description
Deletes a StackSet.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"eventCategory": "Management",
"eventID": "dbea1948-70e6-4759-9862-db5f2f2a314e",
"eventName": "DeleteStackSet",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2026-06-29T19:21:54Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "123456789012",
"requestID": "441ac691-3996-4643-9ec9-2faf56142d26",
"requestParameters": {
"stackSetName": "dw-probe"
},
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"tlsDetails": {
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "cloudformation.us-west-1.amazonaws.com",
"tlsVersion": "TLSv1.3"
},
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
DeregisterType
#Description
Marks an extension or extension version as DEPRECATED in the CloudFormation registry, removing it from active use.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "CFNRegistryException",
"errorMessage": "The input should be one of ARN or Type Name (and optional version ID, or publisherId with optional publicVersionNumber)",
"eventCategory": "Management",
"eventID": "fc2a1530-84b1-4d10-934c-4e3ba6ae4105",
"eventName": "DeregisterType",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2026-06-29T19:45:15Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "123456789012",
"requestID": "ddd6cec8-f436-46c5-a8b8-995dffeadc99",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"tlsDetails": {
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "cloudformation.us-west-1.amazonaws.com",
"tlsVersion": "TLSv1.3"
},
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,b,Z,n cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
DescribeAccountLimits
#Description
Retrieves your account's CloudFormation limits, such as the maximum number of stacks that you can create in your account.
Example CloudTrail Event #
{
"awsRegion": "us-east-1",
"eventID": "388693a83-10aa-4ed4-a726-bcaad2e9c292",
"eventName": "DescribeAccountLimits",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2018-09-30T23:48:45Z",
"eventType": "AwsApiCall",
"eventVersion": "1.05",
"recipientAccountId": "811596193553",
"requestID": "5e76b539-c50b-11e8-a70a-ae97d6efce83",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "support.amazonaws.com",
"userAgent": "support.amazonaws.com",
"userIdentity": {
"accountId": "811596193553",
"arn": "arn:aws:iam::811596193553:root",
"invokedBy": "support.amazonaws.com",
"principalId": "811596193553",
"type": "Root",
"userName": "flaws"
}
}
References #
DescribeChangeSet
#Description
Returns the inputs for the change set and a list of changes that CloudFormation will make if you execute the change set.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "ValidationException",
"errorMessage": "StackName must be specified if ChangeSetName is not specified as an ARN.",
"eventCategory": "Management",
"eventID": "0c66b22d-77f1-4368-a5e9-d0b257177abb",
"eventName": "DescribeChangeSet",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2026-06-29T18:42:44Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "123456789012",
"requestID": "1a7e8321-0481-4558-be27-76ab6c3f432e",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"tlsDetails": {
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "cloudformation.us-west-1.amazonaws.com",
"tlsVersion": "TLSv1.3"
},
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
DescribeChangeSetHooks
#Description
Returns Hook-related information for the change set and a list of changes that CloudFormation makes when you run the change set.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "ValidationException",
"errorMessage": "StackName must be specified if ChangeSetName is not specified as an ARN.",
"eventCategory": "Management",
"eventID": "ed15cf84-f419-4b75-a573-691943523772",
"eventName": "DescribeChangeSetHooks",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2026-06-29T18:42:44Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "123456789012",
"requestID": "2527bcc7-ddec-4031-89b0-f60fa9a58352",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"tlsDetails": {
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "cloudformation.us-west-1.amazonaws.com",
"tlsVersion": "TLSv1.3"
},
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
DescribeEvents
#Description
Returns CloudFormation events based on flexible query criteria.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "ValidationException",
"errorMessage": "One of ChangeSetName, OperationId or StackName must be specified.",
"eventCategory": "Management",
"eventID": "60a25393-2712-4604-ac34-3cd96b9c542f",
"eventName": "DescribeEvents",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2026-06-29T18:31:31Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "123456789012",
"requestID": "6142605f-1b4f-4d54-a329-cc451bd9b924",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"tlsDetails": {
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "cloudformation.us-west-1.amazonaws.com",
"tlsVersion": "TLSv1.3"
},
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
DescribeGeneratedTemplate
#Description
Describes a generated template.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "GeneratedTemplateNotFoundException",
"errorMessage": "Template with arn ddddd does not exist (Service: CfnTemplateGenerationServiceLambda; Status Code: 400; Error Code: GeneratedTemplateNotFoundException; Request ID: 25c43aa2-e90c-4ef1-ba80-9aa81bf77267; Proxy: null)",
"eventCategory": "Management",
"eventID": "e24dd02e-a8fd-4426-a6dc-6269efe88bc3",
"eventName": "DescribeGeneratedTemplate",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2026-06-29T18:42:44Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "123456789012",
"requestID": "23db7e41-97e3-439e-9419-1469e0bc8c6b",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"tlsDetails": {
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "cloudformation.us-west-1.amazonaws.com",
"tlsVersion": "TLSv1.3"
},
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
DescribeOrganizationsAccess
#Description
Retrieves information about the account's OrganizationAccess status.
DescribePublisher
#Description
Returns information about a CloudFormation extension publisher.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "CFNRegistryException",
"errorMessage": "The account [123456789012] is not registered as a publisher, if you want to describe a specific publisher, please specify the publisherID",
"eventCategory": "Management",
"eventID": "094966fd-e6eb-4b29-becd-3ab736870a71",
"eventName": "DescribePublisher",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2026-06-29T18:31:31Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "123456789012",
"requestID": "5c98aea2-4128-484e-92b2-b56809405290",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"tlsDetails": {
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "cloudformation.us-west-1.amazonaws.com",
"tlsVersion": "TLSv1.3"
},
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
DescribeResourceScan
#Description
Describes details of a resource scan.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "ValidationException",
"errorMessage": "1 validation error detected: Value 'dw-probe' at 'resourceScanId' failed to satisfy constraint: Member must satisfy regular expression pattern: arn:[a-z0-9-]+:cloudformation:[a-z0-9-]+:[0-9]{12}:resourceScan/[a-z0-9-]+",
"eventCategory": "Management",
"eventID": "b0d6384c-713c-49f5-8b2c-6e0f53775cb6",
"eventName": "DescribeResourceScan",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2026-06-29T18:42:45Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "123456789012",
"requestID": "2f691d05-b8ef-4173-bd9a-b4bdfd126711",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"tlsDetails": {
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "cloudformation.us-west-1.amazonaws.com",
"tlsVersion": "TLSv1.3"
},
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
DescribeStackDriftDetectionStatus
#Description
Returns information about a stack drift detection operation.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "ValidationException",
"errorMessage": "Stack drift detection result [ddddd] does not exist",
"eventCategory": "Management",
"eventID": "e206b890-07ca-4e93-90f4-fa25263992f5",
"eventName": "DescribeStackDriftDetectionStatus",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2026-06-29T18:42:45Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "123456789012",
"requestID": "90c8df28-1568-4780-a682-e1c18204b550",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"tlsDetails": {
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "cloudformation.us-west-1.amazonaws.com",
"tlsVersion": "TLSv1.3"
},
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
DescribeStackEvents
#Description
Returns all stack related events for a specified stack in reverse chronological order.
Example CloudTrail Event #
{
"awsRegion": "us-east-1",
"eventID": "27b896005-1c49-4712-9bb2-767d4efd7454",
"eventName": "DescribeStackEvents",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2018-08-05T16:51:14Z",
"eventType": "AwsApiCall",
"eventVersion": "1.05",
"recipientAccountId": "811596193553",
"requestID": "c3e7f200-98cf-11e8-960c-52ab6bc0dcc4",
"requestParameters": {
"stackName": "arn:aws:cloudformation:us-east-1:811596193553:stack/Summit-Route-security-assessment-access/c3953d30-98cf-11e8-82dd-9b75e9b8d57e"
},
"responseElements": null,
"sourceIPAddress": "250.251.253.3",
"userAgent": "console.amazonaws.com",
"userIdentity": {
"accessKeyId": "ASIACF0UGMY4WFI0SHMN",
"accountId": "811596193553",
"arn": "arn:aws:iam::811596193553:root",
"principalId": "811596193553",
"sessionContext": {
"attributes": {
"creationDate": "2018-08-05T16:50:57Z",
"mfaAuthenticated": "true"
}
},
"type": "Root",
"userName": "flaws"
}
}
References #
DescribeStackInstance
#Description
Returns the stack instance that's associated with the specified StackSet, Amazon Web Services account, and Amazon Web Services Region.
DescribeStackRefactor
#Description
Describes the stack refactor status.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "StackRefactorNotFoundException",
"errorMessage": "Stack refactor [dw-probe] does not exist",
"eventCategory": "Management",
"eventID": "a795a681-1d49-47b6-8d49-232fed65b6bf",
"eventName": "DescribeStackRefactor",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2026-06-29T18:42:45Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "123456789012",
"requestID": "2ecf9d5a-f994-4f69-92a7-49c35bd515bb",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"tlsDetails": {
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "cloudformation.us-west-1.amazonaws.com",
"tlsVersion": "TLSv1.3"
},
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
DescribeStackResource
#Description
Returns a description of the specified resource in the specified stack.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "ValidationException",
"errorMessage": "Stack 'dw-probe' does not exist",
"eventCategory": "Management",
"eventID": "b1e3a4a1-5e7b-4433-9763-91c3f7bbcbfd",
"eventName": "DescribeStackResource",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2026-06-29T18:42:45Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "123456789012",
"requestID": "85a028ce-1b81-4245-95b3-4a9ea0e6c4be",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"tlsDetails": {
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "cloudformation.us-west-1.amazonaws.com",
"tlsVersion": "TLSv1.3"
},
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
DescribeStackResourceDrifts
#Description
Returns drift information for the resources that have been checked for drift in the specified stack.
Example CloudTrail Event #
{
"awsRegion": "us-east-1",
"eventID": "260733f55-95b2-4e8b-b7aa-72ebf25034a6",
"eventName": "DescribeStackResourceDrifts",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2019-04-17T16:02:51Z",
"eventType": "AwsApiCall",
"eventVersion": "1.05",
"recipientAccountId": "811596193553",
"requestID": "407e98f1-612a-11e9-b720-390ffa8348e9",
"requestParameters": {
"stackName": "Summit-Route-security-assessment-access"
},
"responseElements": null,
"sourceIPAddress": "86.1.86.209",
"userAgent": "aws-cli/1.16.130 Python/2.7.15rc1 Linux/4.15.0-47-generic botocore/1.12.120",
"userIdentity": {
"accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD",
"accountId": "811596193553",
"arn": "arn:aws:iam::811596193553:user/Level6",
"principalId": "AIDADO2GQD0K8TEF7KW1V",
"type": "IAMUser",
"userName": "Level6"
}
}
References #
DescribeStackResources
#Description
Returns Amazon Web Services resource descriptions for running and deleted stacks.
Example CloudTrail Event #
{
"awsRegion": "us-east-1",
"eventID": "9e39b674-c319-4627-839a-43e404548f07",
"eventName": "DescribeStackResources",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2018-08-05T17:05:17Z",
"eventType": "AwsApiCall",
"eventVersion": "1.05",
"recipientAccountId": "811596193553",
"requestID": "ba2b3260-98d1-11e8-b414-a22415fa3f63",
"requestParameters": {
"stackName": "Summit-Route-security-assessment-access"
},
"responseElements": null,
"sourceIPAddress": "250.251.253.3",
"userAgent": "Boto3/1.5.32 Python/3.6.4 Darwin/17.6.0 Botocore/1.8.50",
"userIdentity": {
"accessKeyId": "ASIAPYBUDZE3ZQU169GB",
"accountId": "811596193553",
"arn": "arn:aws:sts::811596193553:assumed-role/SummitRouteAudit/4032461535040776536",
"principalId": "AROAMY611GPC0EPB1P0F9:4032461535040776536",
"sessionContext": {
"attributes": {
"creationDate": "2018-08-05T17:00:49Z",
"mfaAuthenticated": "true"
},
"sessionIssuer": {
"accountId": "811596193553",
"arn": "arn:aws:iam::811596193553:role/SummitRouteAudit",
"principalId": "AROAMY611GPC0EPB1P0F9",
"type": "Role",
"userName": "SummitRouteAudit"
}
},
"type": "AssumedRole"
}
}
References #
DescribeStacks
#Description
Returns the description for the specified stack; if no stack name was specified, then it returns the description for all the stacks created.
Example CloudTrail Event #
{
"awsRegion": "us-east-2",
"eventCategory": "Management",
"eventID": "f00b72b9-4a7d-4b99-862c-0d52fb3d31eb",
"eventName": "DescribeStacks",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2021-07-07T13:10:43Z",
"eventType": "AwsApiCall",
"eventVersion": "1.08",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "797507667711",
"requestID": "a5b98dd9-3f45-4a06-bdb2-90f8acd2cbe6",
"requestParameters": {
"stackName": "arn:aws:cloudformation:us-east-2:797507667711:stack/Cado-Response/fde7fa20-df23-11eb-8e6a-02ef55bbcee6"
},
"responseElements": null,
"sourceIPAddress": "167.98.108.182",
"userAgent": "console.amazonaws.com",
"userIdentity": {
"accessKeyId": "ASIA3TLZJI37ZJGDS44B",
"accountId": "797507667711",
"arn": "arn:aws:iam::797507667711:user/sean",
"principalId": "AIDA3TLZJI375TCG5FSRI",
"sessionContext": {
"attributes": {
"creationDate": "2021-07-07T11:56:28Z",
"mfaAuthenticated": "false"
},
"sessionIssuer": {},
"webIdFederationData": {}
},
"type": "IAMUser",
"userName": "sean"
}
}
References #
DescribeStackSet
#Description
Returns the description of the specified StackSet.
Example CloudTrail Event #
{
"awsRegion": "us-east-1",
"errorCode": "StackSetNotFoundException",
"errorMessage": "StackSet not found",
"eventID": "a6b14d74-bd6e-45a2-8ffb-db1095576b79",
"eventName": "DescribeStackSet",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2019-04-17T16:01:02Z",
"eventType": "AwsApiCall",
"eventVersion": "1.05",
"recipientAccountId": "811596193553",
"requestID": "ff6eb6c0-6129-11e9-a17d-34f0de0e0cb3",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "86.1.86.209",
"userAgent": "aws-cli/1.16.130 Python/2.7.15rc1 Linux/4.15.0-47-generic botocore/1.12.120",
"userIdentity": {
"accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD",
"accountId": "811596193553",
"arn": "arn:aws:iam::811596193553:user/Level6",
"principalId": "AIDADO2GQD0K8TEF7KW1V",
"type": "IAMUser",
"userName": "Level6"
}
}
References #
DescribeStackSetOperation
#Description
Returns the description of the specified StackSet operation.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "StackSetNotFoundException",
"errorMessage": "StackSet dw-probe not found",
"eventCategory": "Management",
"eventID": "1dcf9bfc-39be-4e3d-a04c-a6038bc3c951",
"eventName": "DescribeStackSetOperation",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2026-06-29T18:42:45Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "123456789012",
"requestID": "b18a0b21-f474-41d2-a6a2-ef9bd127a58c",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"tlsDetails": {
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "cloudformation.us-west-1.amazonaws.com",
"tlsVersion": "TLSv1.3"
},
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
DescribeType
#Description
Returns detailed information about an extension from the CloudFormation registry in your current account and Region.
Example CloudTrail Event #
{
"awsRegion": "us-east-1",
"errorCode": "AccessDenied",
"errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudformation:DescribeType",
"eventID": "dd7fd44d-71ca-4f2d-9cbb-4749f21e52a3",
"eventName": "DescribeType",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2020-06-10T05:33:09Z",
"eventType": "AwsApiCall",
"eventVersion": "1.05",
"recipientAccountId": "811596193553",
"requestID": "fbb06bb8-6b24-460d-ad88-c04221ba",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "251.105.254.1",
"userAgent": "Botocore/1.16.26 Python/2.7.18 Linux/5.4.0-2-amd64",
"userIdentity": {
"accessKeyId": "AKIA01U43UX3RBRDXF4Q",
"accountId": "811596193553",
"arn": "arn:aws:iam::811596193553:user/backup",
"principalId": "AIDA9BO36HFBHKGJAO9C1",
"type": "IAMUser",
"userName": "backup"
}
}
References #
DescribeTypeRegistration
#Description
Returns information about an extension's registration, including its current status and type and version identifiers.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "CFNRegistryException",
"errorMessage": "UUID is invalid",
"eventCategory": "Management",
"eventID": "06be744a-a2e5-4248-b859-72f7da527def",
"eventName": "DescribeTypeRegistration",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2026-06-29T18:42:45Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "123456789012",
"requestID": "79e36e10-e5b6-4dc3-9ed2-689c352a2248",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"tlsDetails": {
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "cloudformation.us-west-1.amazonaws.com",
"tlsVersion": "TLSv1.3"
},
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
DetectStackDrift
#Description
Detects whether a stack's actual configuration differs, or has drifted, from its expected configuration, as defined in the stack template and any values specified as template parameters.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"eventCategory": "Management",
"eventID": "4650aac6-05cd-46a5-9a9d-2ba14183e4bf",
"eventName": "DetectStackDrift",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2026-06-29T21:00:25Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "123456789012",
"requestID": "04f419ef-0bb4-4755-9e1a-d391c9ea6fc7",
"requestParameters": {
"stackName": "dwfix-cfn-test"
},
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"tlsDetails": {
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "cloudformation.us-west-1.amazonaws.com",
"tlsVersion": "TLSv1.3"
},
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
DetectStackResourceDrift
#Description
Returns information about whether a resource's actual configuration differs, or has drifted, from its expected configuration, as defined in the stack template and any values specified as template parameters.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"eventCategory": "Management",
"eventID": "b6a5d098-a409-4c10-8d30-7b6c4dd30538",
"eventName": "DetectStackResourceDrift",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2026-06-29T21:00:27Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "123456789012",
"requestID": "06cb4462-e6a8-4aca-b04a-f530cf3b163e",
"requestParameters": {
"logicalResourceId": "DwfixParam",
"stackName": "dwfix-cfn-test"
},
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"tlsDetails": {
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "cloudformation.us-west-1.amazonaws.com",
"tlsVersion": "TLSv1.3"
},
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
DetectStackSetDrift
#Description
Detect drift on a StackSet.
EstimateTemplateCost
#Description
Returns the estimated monthly cost of a template.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "ValidationException",
"errorMessage": "Template cost calculations cannot be generated for templates containing resource type AWS::SSM::Parameter.",
"eventCategory": "Management",
"eventID": "b94bec02-52e9-4ff3-a357-a44a63420ac9",
"eventName": "EstimateTemplateCost",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2026-06-29T21:00:27Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "123456789012",
"requestID": "faa3c22c-a401-4084-b634-8e149762a299",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"tlsDetails": {
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "cloudformation.us-west-1.amazonaws.com",
"tlsVersion": "TLSv1.3"
},
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
ExecuteChangeSet
#Description
Updates a stack using the input information that was provided when the specified change set was created.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"eventCategory": "Management",
"eventID": "9f52093f-8d76-434e-a7cb-d5b0fe1518de",
"eventName": "ExecuteChangeSet",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2026-06-29T21:00:15Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "123456789012",
"requestID": "912c88fa-53ce-4fba-a55d-03b76fe57874",
"requestParameters": {
"changeSetName": "dwfix-cs-update",
"stackName": "dwfix-cfn-test"
},
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"tlsDetails": {
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "cloudformation.us-west-1.amazonaws.com",
"tlsVersion": "TLSv1.3"
},
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
ExecuteStackRefactor
#Description
Executes the stack refactor operation.
GetGeneratedTemplate
#Description
Retrieves a generated template.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "GeneratedTemplateNotFoundException",
"errorMessage": "Template with arn ddddd does not exist (Service: CfnTemplateGenerationServiceLambda; Status Code: 400; Error Code: GeneratedTemplateNotFoundException; Request ID: 5d7ff223-3114-480b-9d67-b07f01516665; Proxy: null)",
"eventCategory": "Management",
"eventID": "ae98ec6e-fd1d-4174-9dc7-9bdf0c8078a2",
"eventName": "GetGeneratedTemplate",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2026-06-29T18:42:45Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "123456789012",
"requestID": "9bc5b07e-6482-4270-8eda-eb4afda1e181",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"tlsDetails": {
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "cloudformation.us-west-1.amazonaws.com",
"tlsVersion": "TLSv1.3"
},
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
GetHookResult
#Description
Retrieves detailed information and remediation guidance for a Hook invocation result.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "ValidationException",
"errorMessage": "HookResultId must be provided",
"eventCategory": "Management",
"eventID": "93bd3a74-5531-4e53-a147-cd29c545252d",
"eventName": "GetHookResult",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2026-06-29T18:31:31Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "123456789012",
"requestID": "c900b55a-fd76-4b6a-bf36-afc545254a54",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"tlsDetails": {
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "cloudformation.us-west-1.amazonaws.com",
"tlsVersion": "TLSv1.3"
},
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
GetStackPolicy
#Description
Returns the stack policy for a specified stack.
Example CloudTrail Event #
{
"awsRegion": "us-east-1",
"eventID": "34004d4-c500-4d04-b2ae-fe42617597af",
"eventName": "GetStackPolicy",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2018-08-05T16:51:14Z",
"eventType": "AwsApiCall",
"eventVersion": "1.05",
"recipientAccountId": "811596193553",
"requestID": "c40ba650-98cf-11e8-b444-c990200",
"requestParameters": {
"stackName": "arn:aws:cloudformation:us-east-1:811596193553:stack/Summit-Route-security-assessment-access/c3953d30-98cf-11e8-82dd-9b75e9b8d57e"
},
"responseElements": null,
"sourceIPAddress": "250.251.253.3",
"userAgent": "console.amazonaws.com",
"userIdentity": {
"accessKeyId": "ASIACF0UGMY4WFI0SHMN",
"accountId": "811596193553",
"arn": "arn:aws:iam::811596193553:root",
"principalId": "811596193553",
"sessionContext": {
"attributes": {
"creationDate": "2018-08-05T16:50:57Z",
"mfaAuthenticated": "true"
}
},
"type": "Root",
"userName": "flaws"
}
}
References #
GetTemplate
#Description
Returns the template body for a specified stack.
Example CloudTrail Event #
{
"awsRegion": "us-east-1",
"eventID": "77aaa0d9-93a4-4255-b768-b6fc6211ec5e",
"eventName": "GetTemplate",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2018-08-05T16:51:14Z",
"eventType": "AwsApiCall",
"eventVersion": "1.05",
"recipientAccountId": "811596193553",
"requestID": "c3fb0459-98cf-11e8-bb1f-a3cb26067b09",
"requestParameters": {
"stackName": "arn:aws:cloudformation:us-east-1:811596193553:stack/Summit-Route-security-assessment-access/c3953d30-98cf-11e8-82dd-9b75e9b8d57e"
},
"responseElements": null,
"sourceIPAddress": "250.251.253.3",
"userAgent": "console.amazonaws.com",
"userIdentity": {
"accessKeyId": "ASIACF0UGMY4WFI0SHMN",
"accountId": "811596193553",
"arn": "arn:aws:iam::811596193553:root",
"principalId": "811596193553",
"sessionContext": {
"attributes": {
"creationDate": "2018-08-05T16:50:57Z",
"mfaAuthenticated": "true"
}
},
"type": "Root",
"userName": "flaws"
}
}
References #
GetTemplateSummary
#Description
Returns information about a new or existing template.
Example CloudTrail Event #
{
"awsRegion": "us-east-1",
"eventID": "4821c15e-9667-42db-bdb4-fb275bbc30a3",
"eventName": "GetTemplateSummary",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2018-08-05T16:51:09Z",
"eventType": "AwsApiCall",
"eventVersion": "1.05",
"recipientAccountId": "811596193553",
"requestID": "c0ec3db0-98cf-11e8-bea6-71e68a558e97",
"requestParameters": {
"templateURL": "https://s3.amazonaws.com/summitroute-assets/security_assessment_access.template"
},
"responseElements": {
"capabilities": [
"CAPABILITY_NAMED_IAM"
],
"capabilitiesReason": "The following resource(s) require capabilities: [AWS::IAM::Role]",
"description": "Provides Summit Route with the ability to perform a security assessment on this account. An IAM role is created to provide view-only access of the metadata in the account. Read and write access to the Athena and Glue services is also granted for CloudTrail log analysis, and if the S3 bucket for the CloudTrail logs is provided, then read access is granted to that bucket.",
"parameters": [
{
"description": "S3 bucket for CloudTrail logs (optional). Example: For the bucket \"s3://mycloudtrail\", you would put \"mycloudtrail\" (without quotes) here.",
"noEcho": false,
"parameterKey": "S3Bucket",
"parameterType": "String"
}
]
},
"sourceIPAddress": "250.251.253.3",
"userAgent": "console.amazonaws.com",
"userIdentity": {
"accessKeyId": "ASIACF0UGMY4WFI0SHMN",
"accountId": "811596193553",
"arn": "arn:aws:iam::811596193553:root",
"principalId": "811596193553",
"sessionContext": {
"attributes": {
"creationDate": "2018-08-05T16:50:57Z",
"mfaAuthenticated": "true"
}
},
"type": "Root",
"userName": "flaws"
}
}
References #
ImportStacksToStackSet
#Description
Import existing stacks into a new StackSets.
ListChangeSets
#Description
Returns the ID and status of each active change set for a stack.
Example CloudTrail Event #
{
"awsRegion": "us-east-1",
"eventID": "efed7bbe-1e4c-4640-b3c9-d2544a5aba37",
"eventName": "ListChangeSets",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2018-08-05T16:51:14Z",
"eventType": "AwsApiCall",
"eventVersion": "1.05",
"recipientAccountId": "811596193553",
"requestID": "c632237e-98cf-11e8-b444-c990200",
"requestParameters": {
"stackName": "arn:aws:cloudformation:us-east-1:811596193553:stack/Summit-Route-security-assessment-access/c3953d30-98cf-11e8-82dd-9b75e9b8d57e"
},
"responseElements": null,
"sourceIPAddress": "250.251.253.3",
"userAgent": "console.amazonaws.com",
"userIdentity": {
"accessKeyId": "ASIACF0UGMY4WFI0SHMN",
"accountId": "811596193553",
"arn": "arn:aws:iam::811596193553:root",
"principalId": "811596193553",
"sessionContext": {
"attributes": {
"creationDate": "2018-08-05T16:50:57Z",
"mfaAuthenticated": "true"
}
},
"type": "Root",
"userName": "flaws"
}
}
References #
ListExports
#Description
Lists all exported output values in the account and Region in which you call this action.
Example CloudTrail Event #
{
"awsRegion": "us-east-1",
"errorCode": "AccessDenied",
"errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: cloudformation:ListExports",
"eventID": "b7441b3d-23b1-4ed0-b0c7-98e1052e80cf",
"eventName": "ListExports",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2017-03-11T18:20:56Z",
"eventType": "AwsApiCall",
"eventVersion": "1.04",
"recipientAccountId": "811596193553",
"requestID": "7860c954-0687-11e7-80c0-bdaf835475cd2",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "34.7.241.251",
"userAgent": "aws-cli/1.10.67 Python/2.7.10 Darwin/16.4.0 botocore/1.4.93",
"userIdentity": {
"accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD",
"accountId": "811596193553",
"arn": "arn:aws:iam::811596193553:user/Level6",
"principalId": "AIDADO2GQD0K8TEF7KW1V",
"type": "IAMUser",
"userName": "Level6"
}
}
References #
ListGeneratedTemplates
#Description
Lists your generated templates in this Region.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"eventCategory": "Management",
"eventID": "8d2bbfb3-4c22-4dfb-a368-4f98615d64f6",
"eventName": "ListGeneratedTemplates",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2026-06-29T18:31:31Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "123456789012",
"requestID": "0662fca3-0d2e-4568-97b1-c1b4f97e3189",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"tlsDetails": {
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "cloudformation.us-west-1.amazonaws.com",
"tlsVersion": "TLSv1.3"
},
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
ListHookResults
#Description
Returns summaries of invoked Hooks.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"eventCategory": "Management",
"eventID": "d1399eee-d232-4148-bb27-41850a46cc98",
"eventName": "ListHookResults",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2026-06-29T18:31:31Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "123456789012",
"requestID": "38bafe37-bd3e-4a14-bc87-cf52d8314c76",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"tlsDetails": {
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "cloudformation.us-west-1.amazonaws.com",
"tlsVersion": "TLSv1.3"
},
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
ListImports
#Description
Lists all stacks that are importing an exported output value.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "ValidationException",
"errorMessage": "Export 'dw-probe' does not exist.",
"eventCategory": "Management",
"eventID": "d502d8be-421d-4cf3-8e76-348880bdf055",
"eventName": "ListImports",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2026-06-29T18:42:45Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "123456789012",
"requestID": "5bbf9d81-db9b-4dea-b59c-5cd28f22cf92",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"tlsDetails": {
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "cloudformation.us-west-1.amazonaws.com",
"tlsVersion": "TLSv1.3"
},
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
ListResourceScanResources
#Description
Lists the resources from a resource scan.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "ValidationException",
"errorMessage": "1 validation error detected: Value 'dw-probe' at 'resourceScanId' failed to satisfy constraint: Member must satisfy regular expression pattern: arn:[a-z0-9-]+:cloudformation:[a-z0-9-]+:[0-9]{12}:resourceScan/[a-z0-9-]+",
"eventCategory": "Management",
"eventID": "9d50c9ba-8f27-40fc-b7fe-5b3d72772746",
"eventName": "ListResourceScanResources",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2026-06-29T18:42:45Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "123456789012",
"requestID": "e022b180-1262-478d-9b45-15b8b98ec1ac",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"tlsDetails": {
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "cloudformation.us-west-1.amazonaws.com",
"tlsVersion": "TLSv1.3"
},
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
ListResourceScans
#Description
List the resource scans from newest to oldest.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"eventCategory": "Management",
"eventID": "8622c579-326c-4dc2-ad1c-ab52187b653d",
"eventName": "ListResourceScans",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2026-06-29T18:31:31Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "123456789012",
"requestID": "105873e3-bead-458d-9524-489479401309",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"tlsDetails": {
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "cloudformation.us-west-1.amazonaws.com",
"tlsVersion": "TLSv1.3"
},
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
ListStackInstanceResourceDrifts
#Description
Returns drift information for resources in a stack instance.
ListStackInstances
#Description
Returns summary information about stack instances that are associated with the specified StackSet.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "StackSetNotFoundException",
"errorMessage": "StackSet dw-probe not found",
"eventCategory": "Management",
"eventID": "79c5ccd1-2022-4e02-b607-8246f20baf19",
"eventName": "ListStackInstances",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2026-06-29T18:42:45Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "123456789012",
"requestID": "72702017-09a6-4e1d-a12b-c0ac1c3e828f",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"tlsDetails": {
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "cloudformation.us-west-1.amazonaws.com",
"tlsVersion": "TLSv1.3"
},
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
ListStackRefactorActions
#Description
Lists the stack refactor actions that will be taken after calling the ExecuteStackRefactor action.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "UnknownError",
"errorMessage": "An unknown error occurred",
"eventCategory": "Management",
"eventID": "392d6794-aef2-4813-8fab-96b6dfdec24b",
"eventName": "ListStackRefactorActions",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2026-06-29T18:42:51Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "123456789012",
"requestID": "ca247f83-5aab-4cfa-9111-0343f3e9fe2e",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"tlsDetails": {
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "cloudformation.us-west-1.amazonaws.com",
"tlsVersion": "TLSv1.3"
},
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
ListStackRefactors
#Description
Lists all account stack refactor operations and their statuses.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"eventCategory": "Management",
"eventID": "572151f9-814c-4f9d-b79f-52a00c8187bf",
"eventName": "ListStackRefactors",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2026-06-29T18:31:31Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "123456789012",
"requestID": "40477c11-8faf-47a5-bfa5-2ac3e0b843a6",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"tlsDetails": {
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "cloudformation.us-west-1.amazonaws.com",
"tlsVersion": "TLSv1.3"
},
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
ListStackResources
#Description
Returns descriptions of all resources of the specified stack.
Example CloudTrail Event #
{
"awsRegion": "us-east-1",
"eventID": "918001f1f-1340-4174-9c3b-cf48a651f35d",
"eventName": "ListStackResources",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2018-08-05T16:51:14Z",
"eventType": "AwsApiCall",
"eventVersion": "1.05",
"recipientAccountId": "811596193553",
"requestID": "c3e6e017-98cf-11e8-bb1f-a3cb26067b09",
"requestParameters": {
"stackName": "arn:aws:cloudformation:us-east-1:811596193553:stack/Summit-Route-security-assessment-access/c3953d30-98cf-11e8-82dd-9b75e9b8d57e"
},
"responseElements": null,
"sourceIPAddress": "250.251.253.3",
"userAgent": "console.amazonaws.com",
"userIdentity": {
"accessKeyId": "ASIACF0UGMY4WFI0SHMN",
"accountId": "811596193553",
"arn": "arn:aws:iam::811596193553:root",
"principalId": "811596193553",
"sessionContext": {
"attributes": {
"creationDate": "2018-08-05T16:50:57Z",
"mfaAuthenticated": "true"
}
},
"type": "Root",
"userName": "flaws"
}
}
References #
ListStacks
#Description
Returns the summary information for stacks whose status matches the specified StackStatusFilter.
Example CloudTrail Event #
{
"awsRegion": "us-east-2",
"eventCategory": "Management",
"eventID": "8b697b99-c6a3-4b8e-a9da-63cc07e1b731",
"eventName": "ListStacks",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2021-07-07T13:08:50Z",
"eventType": "AwsApiCall",
"eventVersion": "1.08",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "797507667711",
"requestID": "a235b74a-8bff-4091-87bc-b67415804182",
"requestParameters": {
"stackStatusFilter": [
"CREATE_IN_PROGRESS",
"UPDATE_COMPLETE",
"DELETE_FAILED",
"REVIEW_IN_PROGRESS",
"ROLLBACK_IN_PROGRESS",
"UPDATE_ROLLBACK_IN_PROGRESS",
"CREATE_COMPLETE",
"UPDATE_ROLLBACK_COMPLETE",
"UPDATE_ROLLBACK_COMPLETE_CLEANUP_IN_PROGRESS",
"ROLLBACK_COMPLETE",
"ROLLBACK_FAILED",
"CREATE_FAILED",
"UPDATE_ROLLBACK_FAILED",
"UPDATE_COMPLETE_CLEANUP_IN_PROGRESS",
"UPDATE_IN_PROGRESS",
"DELETE_IN_PROGRESS",
"IMPORT_COMPLETE",
"IMPORT_IN_PROGRESS",
"IMPORT_ROLLBACK_IN_PROGRESS",
"IMPORT_ROLLBACK_FAILED",
"IMPORT_ROLLBACK_COMPLETE"
]
},
"responseElements": null,
"sourceIPAddress": "167.98.108.182",
"userAgent": "console.amazonaws.com",
"userIdentity": {
"accessKeyId": "ASIA3TLZJI37ZJGDS44B",
"accountId": "797507667711",
"arn": "arn:aws:iam::797507667711:user/sean",
"principalId": "AIDA3TLZJI375TCG5FSRI",
"sessionContext": {
"attributes": {
"creationDate": "2021-07-07T11:56:28Z",
"mfaAuthenticated": "false"
},
"sessionIssuer": {},
"webIdFederationData": {}
},
"type": "IAMUser",
"userName": "sean"
}
}
References #
ListStackSetAutoDeploymentTargets
#Description
Returns summary information about deployment targets for a StackSet.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "StackSetNotFoundException",
"errorMessage": "StackSet dw-probe not found",
"eventCategory": "Management",
"eventID": "1e281dd6-6848-4f7d-a5dd-5d776159f207",
"eventName": "ListStackSetAutoDeploymentTargets",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2026-06-29T18:42:51Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "123456789012",
"requestID": "2d194f2e-0136-46aa-8f6b-f46d458f1e38",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"tlsDetails": {
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "cloudformation.us-west-1.amazonaws.com",
"tlsVersion": "TLSv1.3"
},
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
ListStackSetOperationResults
#Description
Returns summary information about the results of a StackSet operation.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "StackSetNotFoundException",
"errorMessage": "StackSet dw-probe not found",
"eventCategory": "Management",
"eventID": "31610903-e0dc-411f-b150-b59e30cb76b4",
"eventName": "ListStackSetOperationResults",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2026-06-29T18:42:51Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "123456789012",
"requestID": "d2f03bde-1982-4392-b8b5-c8eade598ead",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"tlsDetails": {
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "cloudformation.us-west-1.amazonaws.com",
"tlsVersion": "TLSv1.3"
},
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
ListStackSetOperations
#Description
Returns summary information about operations performed on a StackSet.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "StackSetNotFoundException",
"errorMessage": "StackSet dw-probe not found",
"eventCategory": "Management",
"eventID": "14810e5b-bb12-4617-9e66-44be390402bb",
"eventName": "ListStackSetOperations",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2026-06-29T18:42:51Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "123456789012",
"requestID": "e01cb8be-b2ca-439a-be42-dd348b6b2e7c",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"tlsDetails": {
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "cloudformation.us-west-1.amazonaws.com",
"tlsVersion": "TLSv1.3"
},
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
ListStackSets
#Description
Returns summary information about StackSets that are associated with the user.
Example CloudTrail Event #
{
"awsRegion": "us-west-2",
"eventID": "75cb115b-9829-44a2-bc7d-4df0238f726f",
"eventName": "ListStackSets",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2018-05-26T13:03:30Z",
"eventType": "AwsApiCall",
"eventVersion": "1.05",
"recipientAccountId": "811596193553",
"requestID": "2fc225a2-60e5-11e8-a00c-d74c9e46e8cf",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "251.2.0.207",
"userAgent": "aws-cli/1.14.9 Python/2.7.14 Linux/4.14.33-51.37.amzn1.x86_64 botocore/1.8.13",
"userIdentity": {
"accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD",
"accountId": "811596193553",
"arn": "arn:aws:iam::811596193553:user/Level6",
"principalId": "AIDADO2GQD0K8TEF7KW1V",
"type": "IAMUser",
"userName": "Level6"
}
}
References #
ListTypeRegistrations
#Description
Returns a list of registration tokens for the specified extension(s).
Example CloudTrail Event #
{
"awsRegion": "us-east-1",
"errorCode": "AccessDenied",
"errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudformation:ListTypeRegistrations",
"eventID": "70081-6774-4a2a-833c-473268e6da06",
"eventName": "ListTypeRegistrations",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2020-06-10T05:33:09Z",
"eventType": "AwsApiCall",
"eventVersion": "1.05",
"recipientAccountId": "811596193553",
"requestID": "21f6f863-49c9-4b8d-b49b-912801ea7063",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "251.105.254.1",
"userAgent": "Botocore/1.16.26 Python/2.7.18 Linux/5.4.0-2-amd64",
"userIdentity": {
"accessKeyId": "AKIA01U43UX3RBRDXF4Q",
"accountId": "811596193553",
"arn": "arn:aws:iam::811596193553:user/backup",
"principalId": "AIDA9BO36HFBHKGJAO9C1",
"type": "IAMUser",
"userName": "backup"
}
}
References #
ListTypes
#Description
Returns summary information about all extensions, including your private resource types, modules, and Hooks as well as all public extensions from Amazon Web Services and third-party publishers.
Example CloudTrail Event #
{
"awsRegion": "us-east-1",
"errorCode": "AccessDenied",
"errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudformation:ListTypes",
"eventID": "758baab5-a9db-4fdb-8e42-832ccefd612d",
"eventName": "ListTypes",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2020-06-10T05:33:09Z",
"eventType": "AwsApiCall",
"eventVersion": "1.05",
"recipientAccountId": "811596193553",
"requestID": "170bcf39-5696-460f-8662-135011e4b14",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "251.105.254.1",
"userAgent": "Botocore/1.16.26 Python/2.7.18 Linux/5.4.0-2-amd64",
"userIdentity": {
"accessKeyId": "AKIA01U43UX3RBRDXF4Q",
"accountId": "811596193553",
"arn": "arn:aws:iam::811596193553:user/backup",
"principalId": "AIDA9BO36HFBHKGJAO9C1",
"type": "IAMUser",
"userName": "backup"
}
}
References #
ListTypeVersions
#Description
Returns summary information about the versions of an extension.
Example CloudTrail Event #
{
"awsRegion": "us-east-1",
"errorCode": "AccessDenied",
"errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudformation:ListTypeVersions",
"eventID": "caee3f6e-8f55-448e-8ec4-1a77c1d465202",
"eventName": "ListTypeVersions",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2020-06-10T05:33:09Z",
"eventType": "AwsApiCall",
"eventVersion": "1.05",
"recipientAccountId": "811596193553",
"requestID": "5896c7c6-3152-4844-bb19-1c15bc047580f",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "251.105.254.1",
"userAgent": "Botocore/1.16.26 Python/2.7.18 Linux/5.4.0-2-amd64",
"userIdentity": {
"accessKeyId": "AKIA01U43UX3RBRDXF4Q",
"accountId": "811596193553",
"arn": "arn:aws:iam::811596193553:user/backup",
"principalId": "AIDA9BO36HFBHKGJAO9C1",
"type": "IAMUser",
"userName": "backup"
}
}
References #
PublishType
#Description
Publishes the specified extension to the CloudFormation registry as a public extension in this Region.
RecordHandlerProgress
#Description
Reports progress of a resource handler to CloudFormation.
RegisterPublisher
#Description
Registers your account as a publisher of public extensions in the CloudFormation registry.
RegisterType
#Description
Registers an extension with the CloudFormation service.
RollbackStack
#Description
When specifying RollbackStack, you preserve the state of previously provisioned resources when an operation fails.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "ValidationException",
"errorMessage": "RollbackStack can only be called on any of the [UPDATE_FAILED, CREATE_FAILED] statuses.",
"eventCategory": "Management",
"eventID": "4b6997fe-053f-4272-8de8-e6609c970058",
"eventName": "RollbackStack",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2026-06-29T21:00:04Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "123456789012",
"requestID": "b37d4dc3-98c2-49ed-885a-81675e84edae",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"tlsDetails": {
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "cloudformation.us-west-1.amazonaws.com",
"tlsVersion": "TLSv1.3"
},
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
SetStackPolicy
#Description
Sets a stack policy for a specified stack.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"eventCategory": "Management",
"eventID": "ddf70c68-c512-43b3-9cb8-7c6f54d942bf",
"eventName": "SetStackPolicy",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2026-06-29T20:07:59Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "123456789012",
"requestID": "bca34bfe-c273-4e8c-bf43-175a08b451c9",
"requestParameters": {
"stackName": "dwfix-stack",
"stackPolicyBody": {
"Statement": [
{
"Effect": "Allow",
"Action": "Update:*",
"Principal": "*",
"Resource": "*"
}
]
}
},
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"tlsDetails": {
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "cloudformation.us-west-1.amazonaws.com",
"tlsVersion": "TLSv1.3"
},
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,b,Z cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
SetTypeConfiguration
#Description
Specifies the configuration data for a CloudFormation extension, such as a resource or Hook, in the given account and Region.
SetTypeDefaultVersion
#Description
Specify the default version of an extension.
SignalResource
#Description
Sends a signal to the specified resource with a success or failure status.
StartResourceScan
#Description
Starts a scan of the resources in this account in this Region.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"eventCategory": "Management",
"eventID": "e5a9a1ba-f542-4f78-878c-89d49046f464",
"eventName": "StartResourceScan",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2026-06-29T21:00:43Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "123456789012",
"requestID": "6273b7e1-5ebd-4b54-b46e-1dcdd3866a64",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"tlsDetails": {
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "cloudformation.us-west-1.amazonaws.com",
"tlsVersion": "TLSv1.3"
},
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
StopStackSetOperation
#Description
Stops an in-progress operation on a StackSet and its associated stack instances.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "StackSetNotFoundException",
"errorMessage": "StackSet dw-probe not found",
"eventCategory": "Management",
"eventID": "7d621ce5-f4fa-427d-95db-c115e2fcfa40",
"eventName": "StopStackSetOperation",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2026-06-29T19:21:54Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "123456789012",
"requestID": "83978c4e-688c-441b-96c5-27f482d349e9",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"tlsDetails": {
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "cloudformation.us-west-1.amazonaws.com",
"tlsVersion": "TLSv1.3"
},
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
TestType
#Description
Tests a registered extension to make sure it meets all necessary requirements for being published in the CloudFormation registry.
UpdateGeneratedTemplate
#Description
Updates a generated template.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "GeneratedTemplateNotFoundException",
"errorMessage": "Template with arn ddddd does not exist (Service: CfnTemplateGenerationServiceLambda; Status Code: 400; Error Code: GeneratedTemplateNotFoundException; Request ID: dcec19cb-ee5f-4765-a4a0-5b764d331b07; Proxy: null)",
"eventCategory": "Management",
"eventID": "81c2da7a-8379-445b-b8bf-7282efb909b1",
"eventName": "UpdateGeneratedTemplate",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2026-06-29T19:21:54Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "123456789012",
"requestID": "df19e615-bd75-4fe7-bb51-8abb3a79494a",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"tlsDetails": {
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "cloudformation.us-west-1.amazonaws.com",
"tlsVersion": "TLSv1.3"
},
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
UpdateStack
#Description
Updates a stack as specified in the template.
Example CloudTrail Event #
{
"awsRegion": "us-west-2",
"errorCode": "AccessDenied",
"errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudformation:UpdateStack on resource: arn:aws:cloudformation:us-west-2:811596193553:stack/test/*",
"eventID": "b874c48f-4c0f-42de-85c0-658bfb1bfbb7",
"eventName": "UpdateStack",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2020-01-30T08:46:55Z",
"eventType": "AwsApiCall",
"eventVersion": "1.05",
"recipientAccountId": "811596193553",
"requestID": "c6fee9e2-e276-4464-a083-8437a16913",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "117.31.254.13",
"userAgent": "aws-cli/1.16.301 Python/3.6.9 Linux/4.4.0-01985-Microsoft botocore/1.13.37",
"userIdentity": {
"accessKeyId": "AKIA01U43UX3RBRDXF4Q",
"accountId": "811596193553",
"arn": "arn:aws:iam::811596193553:user/backup",
"principalId": "AIDA9BO36HFBHKGJAO9C1",
"type": "IAMUser",
"userName": "backup"
}
}
References #
UpdateStackInstances
#Description
Updates the parameter values for stack instances for the specified accounts, within the specified Amazon Web Services Regions.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "ValidationException",
"errorMessage": "Region dw-probe is not supported",
"eventCategory": "Management",
"eventID": "e443562d-2025-45f0-9739-c9ddc73f0271",
"eventName": "UpdateStackInstances",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2026-06-29T19:21:54Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "123456789012",
"requestID": "b9a35006-8a14-4495-a301-8e7d7d1a19b4",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"tlsDetails": {
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "cloudformation.us-west-1.amazonaws.com",
"tlsVersion": "TLSv1.3"
},
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
UpdateStackSet
#Description
Updates the StackSet and associated stack instances in the specified accounts and Amazon Web Services Regions.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "ValidationException",
"errorMessage": "Exactly one of TemplateBody, Stack Id or TemplateUrl must be specified",
"eventCategory": "Management",
"eventID": "71b269da-01e6-451e-b22e-f3af6f54d646",
"eventName": "UpdateStackSet",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2026-06-29T19:21:54Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "123456789012",
"requestID": "bec9575c-982b-4c0b-8847-15169b44d3f1",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"tlsDetails": {
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "cloudformation.us-west-1.amazonaws.com",
"tlsVersion": "TLSv1.3"
},
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
UpdateTerminationProtection
#Description
Updates termination protection for the specified stack.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "ValidationException",
"errorMessage": "Stack [ddddd] does not exist",
"eventCategory": "Management",
"eventID": "bf8ce525-3dfb-459f-8eeb-9fabd9959995",
"eventName": "UpdateTerminationProtection",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2026-06-29T19:21:54Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "123456789012",
"requestID": "725c81da-03c0-437b-98b8-f2079e709eea",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"tlsDetails": {
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "cloudformation.us-west-1.amazonaws.com",
"tlsVersion": "TLSv1.3"
},
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
ValidateTemplate
#Description
Validates a specified template.
Example CloudTrail Event #
{
"awsRegion": "us-west-2",
"errorCode": "AccessDenied",
"errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudformation:ValidateTemplate",
"eventID": "a4bb2c2f-0a20-40c8-9dd6-42d8e9f8cc6b",
"eventName": "ValidateTemplate",
"eventSource": "cloudformation.amazonaws.com",
"eventTime": "2017-04-18T00:40:49Z",
"eventType": "AwsApiCall",
"eventVersion": "1.04",
"recipientAccountId": "811596193553",
"requestID": "ab29e01f-23cf-11e7-85e9-c29705",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "5.8.135.229",
"userAgent": "aws-sdk-ruby2/2.7.11 ruby/2.3.1 i386-mingw32",
"userIdentity": {
"accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ",
"accountId": "811596193553",
"arn": "arn:aws:iam::811596193553:user/backup",
"principalId": "AIDA9BO36HFBHKGJAO9C1",
"type": "IAMUser",
"userName": "backup"
}
}