CloudFront

eventName	Description	Sample	Rule
any	Catch-all entry for CloudFront rules that match the service but not a specific eventName.	N	N
CreateDistribution	Creates a new CloudFront distribution that defines how content is delivered from origins to viewers.	N	N
UpdateDistribution	Modifies the configuration of an existing CloudFront distribution, including origins, cache behaviors, and viewer certificate settings.	Y	N
AssociateAlias	The AssociateAlias API operation only supports standard distributions.	N	N
AssociateDistributionTenantWebACL	Associates the WAF web ACL with a distribution tenant.	N	N
AssociateDistributionWebACL	Associates the WAF web ACL with a distribution.	N	N
CopyDistribution	Creates a staging distribution using the configuration of the provided primary distribution.	N	N
CreateAnycastIpList	Creates an Anycast static IP list.	N	N
CreateCachePolicy	Creates a cache policy.	Y	N
CreateCloudFrontOriginAccessIdentity	Create a new origin access identity.	Y	N
CreateConnectionFunction	Creates a connection function.	N	N
CreateConnectionGroup	Creates a connection group.	Y	N
CreateContinuousDeploymentPolicy	Creates a continuous deployment policy that distributes traffic for a custom domain name to two different CloudFront distributions.	N	N
CreateDistributionTenant	Creates a distribution tenant.	N	N
CreateDistributionWithTags	Create a new distribution with tags.	N	N
CreateFieldLevelEncryptionConfig	Create a new field-level encryption configuration.	Y	N
CreateFieldLevelEncryptionProfile	Create a field-level encryption profile.	Y	N
CreateFunction	Creates a CloudFront function.	Y	N
CreateInvalidation	Create a new invalidation.	N	N
CreateInvalidationForDistributionTenant	Creates an invalidation for a distribution tenant.	N	N
CreateKeyGroup	Creates a key group that you can use with CloudFront signed URLs and signed cookies.	Y	N
CreateKeyValueStore	Specifies the key value store resource to add to your account.	Y	N
CreateMonitoringSubscription	Enables or disables additional Amazon CloudWatch metrics for the specified CloudFront distribution.	N	N
CreateOriginAccessControl	Creates a new origin access control in CloudFront.	Y	N
CreateOriginRequestPolicy	Creates an origin request policy.	Y	N
CreatePublicKey	Add a new public key to CloudFront to use, for example, for field-level encryption.	Y	N
CreateRealtimeLogConfig	Creates a real-time log configuration.	N	N
CreateResponseHeadersPolicy	Creates a response headers policy.	Y	N
CreateStreamingDistribution	Create a new streaming distribution.	N	N
CreateStreamingDistributionWithTags	Create a new streaming distribution with tags.	N	N
CreateTrustStore	Creates a trust store.	N	N
CreateVpcOrigin	Create an Amazon CloudFront VPC origin.	N	N
DeleteAnycastIpList	Deletes an Anycast static IP list.	Y	N
DeleteCachePolicy	Deletes a cache policy.	Y	N
DeleteCloudFrontOriginAccessIdentity	Delete an origin access identity.	Y	N
DeleteConnectionFunction	Deletes a connection function.	Y	N
DeleteConnectionGroup	Deletes a connection group.	Y	N
DeleteContinuousDeploymentPolicy	Deletes a continuous deployment policy.	Y	N
DeleteDistribution	Delete a distribution.	Y	N
DeleteDistributionTenant	Deletes a distribution tenant.	N	N
DeleteFieldLevelEncryptionConfig	Remove a field-level encryption configuration.	Y	N
DeleteFieldLevelEncryptionProfile	Remove a field-level encryption profile.	Y	N
DeleteFunction	Deletes a CloudFront function.	Y	N
DeleteKeyGroup	Deletes a key group.	Y	N
DeleteKeyValueStore	Specifies the key value store to delete.	Y	N
DeleteMonitoringSubscription	Disables additional CloudWatch metrics for the specified CloudFront distribution.	Y	N
DeleteOriginAccessControl	Deletes a CloudFront origin access control.	Y	N
DeleteOriginRequestPolicy	Deletes an origin request policy.	Y	N
DeletePublicKey	Remove a public key you previously added to CloudFront.	Y	N
DeleteRealtimeLogConfig	Deletes a real-time log configuration.	Y	N
DeleteResourcePolicy	Deletes the resource policy attached to the CloudFront resource.	Y	N
DeleteResponseHeadersPolicy	Deletes a response headers policy.	Y	N
DeleteStreamingDistribution	Delete a streaming distribution.	Y	N
DeleteTrustStore	Deletes a trust store.	Y	N
DeleteVpcOrigin	Delete an Amazon CloudFront VPC origin.	N	N
DescribeConnectionFunction	Describes a connection function.	Y	N
DescribeFunction	Gets configuration information and metadata about a CloudFront function, but not the function's code.	Y	N
DescribeKeyValueStore	Specifies the key value store and its configuration.	Y	N
DisassociateDistributionTenantWebACL	Disassociates a distribution tenant from the WAF web ACL.	N	N
DisassociateDistributionWebACL	Disassociates a distribution from the WAF web ACL.	Y	N
GetAnycastIpList	Gets an Anycast static IP list.	Y	N
GetCachePolicy	Gets a cache policy, including the following metadata: The policy's identifier.	Y	N
GetCachePolicyConfig	Gets a cache policy configuration.	Y	N
GetCloudFrontOriginAccessIdentity	Get the information about an origin access identity.	Y	N
GetCloudFrontOriginAccessIdentityConfig	Get the configuration information about an origin access identity.	Y	N
GetConnectionFunction	Gets a connection function.	Y	N
GetConnectionGroup	Gets information about a connection group.	Y	N
GetConnectionGroupByRoutingEndpoint	Gets information about a connection group by using the endpoint that you specify.	Y	N
GetContinuousDeploymentPolicy	Gets a continuous deployment policy, including metadata (the policy's identifier and the date and time when the policy was last modified).	Y	N
GetContinuousDeploymentPolicyConfig	Gets configuration information about a continuous deployment policy.	Y	N
GetDistribution	Get the information about a distribution.	Y	N
GetDistributionConfig	Get the configuration information about a distribution.	Y	N
GetDistributionTenant	Gets information about a distribution tenant.	Y	N
GetDistributionTenantByDomain	Gets information about a distribution tenant by the associated domain.	Y	N
GetFieldLevelEncryption	Get the field-level encryption configuration information.	Y	N
GetFieldLevelEncryptionConfig	Get the field-level encryption configuration information.	Y	N
GetFieldLevelEncryptionProfile	Get the field-level encryption profile information.	Y	N
GetFieldLevelEncryptionProfileConfig	Get the field-level encryption profile configuration information.	Y	N
GetFunction	Gets the code of a CloudFront function.	Y	N
GetInvalidation	Get the information about an invalidation.	Y	N
GetInvalidationForDistributionTenant	Gets information about a specific invalidation for a distribution tenant.	Y	N
GetKeyGroup	Gets a key group, including the date and time when the key group was last modified.	Y	N
GetKeyGroupConfig	Gets a key group configuration.	Y	N
GetManagedCertificateDetails	Gets details about the CloudFront managed ACM certificate.	Y	N
GetMonitoringSubscription	Gets information about whether additional CloudWatch metrics are enabled for the specified CloudFront distribution.	Y	N
GetOriginAccessControl	Gets a CloudFront origin access control, including its unique identifier.	Y	N
GetOriginAccessControlConfig	Gets a CloudFront origin access control configuration.	Y	N
GetOriginRequestPolicy	Gets an origin request policy, including the following metadata: The policy's identifier.	Y	N
GetOriginRequestPolicyConfig	Gets an origin request policy configuration.	Y	N
GetPublicKey	Get the public key information.	Y	N
GetPublicKeyConfig	Return public key configuration informaation	Y	N
GetRealtimeLogConfig	Gets a real-time log configuration.	Y	N
GetResourcePolicy	Retrieves the resource policy for the specified CloudFront resource that you own and have shared.	Y	N
GetResponseHeadersPolicy	Gets a response headers policy, including metadata (the policy's identifier and the date and time when the policy was last modified).	Y	N
GetResponseHeadersPolicyConfig	Gets a response headers policy configuration.	Y	N
GetStreamingDistribution	Get the information about a streaming distribution.	Y	N
GetStreamingDistributionConfig	Get the configuration information about a streaming distribution.	Y	N
GetTrustStore	Gets a trust store.	Y	N
GetVpcOrigin	Get the details of an Amazon CloudFront VPC origin.	Y	N
ListAnycastIpLists	Lists your Anycast static IP lists.	Y	N
ListCachePolicies	Gets a list of cache policies.	Y	N
ListCloudFrontOriginAccessIdentities	List origin access identities.	Y	N
ListConflictingAliases	The ListConflictingAliases API operation only supports standard distributions.	Y	N
ListConnectionFunctions	Lists connection functions.	Y	N
ListConnectionGroups	Lists the connection groups in your Amazon Web Services account.	Y	N
ListContinuousDeploymentPolicies	Gets a list of the continuous deployment policies in your Amazon Web Services account.	Y	N
ListDistributions	List distributions.	Y	N
ListDistributionsByAnycastIpListId	Lists the distributions in your account that are associated with the specified AnycastIpListId.	Y	N
ListDistributionsByCachePolicyId	Gets a list of distribution IDs for distributions that have a cache behavior that's associated with the specified cache policy.	Y	N
ListDistributionsByConnectionFunction	Lists distributions by connection function.	Y	N
ListDistributionsByConnectionMode	Lists the distributions by the connection mode that you specify.	Y	N
ListDistributionsByKeyGroup	Gets a list of distribution IDs for distributions that have a cache behavior that references the specified key group.	Y	N
ListDistributionsByOriginRequestPolicyId	Gets a list of distribution IDs for distributions that have a cache behavior that's associated with the specified origin request policy.	Y	N
ListDistributionsByOwnedResource	Lists the CloudFront distributions that are associated with the specified resource that you own.	Y	N
ListDistributionsByRealtimeLogConfig	Gets a list of distributions that have a cache behavior that's associated with the specified real-time log configuration.	Y	N
ListDistributionsByResponseHeadersPolicyId	Gets a list of distribution IDs for distributions that have a cache behavior that's associated with the specified response headers policy.	Y	N
ListDistributionsByTrustStore	Lists distributions by trust store.	Y	N
ListDistributionsByVpcOriginId	List CloudFront distributions by their VPC origin ID.	Y	N
ListDistributionsByWebACLId	List the distributions that are associated with a specified AWS WAF web ACL.	Y	N
ListDistributionTenants	Lists the distribution tenants in your Amazon Web Services account.	Y	N
ListDistributionTenantsByCustomization	Lists distribution tenants by the customization that you specify.	Y	N
ListDomainConflicts	We recommend that you use the ListDomainConflicts API operation to check for domain conflicts, as it supports both standard distributions and distribution tenants.	Y	N
ListFieldLevelEncryptionConfigs	List all field-level encryption configurations that have been created in CloudFront for this account.	Y	N
ListFieldLevelEncryptionProfiles	Request a list of field-level encryption profiles that have been created in CloudFront for this account.	Y	N
ListFunctions	Gets a list of all CloudFront functions in your Amazon Web Services account.	Y	N
ListInvalidations	List invalidation batches.	Y	N
ListInvalidationsForDistributionTenant	Lists the invalidations for a distribution tenant.	Y	N
ListKeyGroups	Gets a list of key groups.	Y	N
ListKeyValueStores	Specifies the key value stores to list.	Y	N
ListOriginAccessControls	Gets the list of CloudFront origin access controls (OACs) in this Amazon Web Services account.	Y	N
ListOriginRequestPolicies	Gets a list of origin request policies.	Y	N
ListPublicKeys	List all public keys that have been added to CloudFront for this account.	Y	N
ListRealtimeLogConfigs	Gets a list of real-time log configurations.	Y	N
ListResponseHeadersPolicies	Gets a list of response headers policies.	Y	N
ListStreamingDistributions	List streaming distributions.	Y	N
ListTagsForResource	List tags for a CloudFront resource.	Y	N
ListTrustStores	Lists trust stores.	Y	N
ListVpcOrigins	List the CloudFront VPC origins in your account.	Y	N
PublishConnectionFunction	Publishes a connection function.	N	N
PublishFunction	Publishes a CloudFront function by copying the function code from the DEVELOPMENT stage to LIVE.	Y	N
PutResourcePolicy	Creates a resource control policy for a given CloudFront resource.	Y	N
TagResource	Add tags to a CloudFront resource.	Y	N
TestConnectionFunction	Tests a connection function.	N	N
TestFunction	Tests a CloudFront function.	Y	N
UntagResource	Remove tags from a CloudFront resource.	Y	N
UpdateAnycastIpList	Updates an Anycast static IP list.	Y	N
UpdateCachePolicy	Updates a cache policy configuration.	Y	N
UpdateCloudFrontOriginAccessIdentity	Update an origin access identity.	Y	N
UpdateConnectionFunction	Updates a connection function.	Y	N
UpdateConnectionGroup	Updates a connection group.	Y	N
UpdateContinuousDeploymentPolicy	Updates a continuous deployment policy.	Y	N
UpdateDistributionTenant	Updates a distribution tenant.	N	N
UpdateDistributionWithStagingConfig	Copies the staging distribution's configuration to its corresponding primary distribution.	N	N
UpdateDomainAssociation	We recommend that you use the UpdateDomainAssociation API operation to move a domain association, as it supports both standard distributions and distribution tenants.	N	N
UpdateFieldLevelEncryptionConfig	Update a field-level encryption configuration.	Y	N
UpdateFieldLevelEncryptionProfile	Update a field-level encryption profile.	Y	N
UpdateFunction	Updates a CloudFront function.	Y	N
UpdateKeyGroup	Updates a key group.	Y	N
UpdateKeyValueStore	Specifies the key value store to update.	Y	N
UpdateOriginAccessControl	Updates a CloudFront origin access control.	Y	N
UpdateOriginRequestPolicy	Updates an origin request policy configuration.	Y	N
UpdatePublicKey	Update public key information.	Y	N
UpdateRealtimeLogConfig	Updates a real-time log configuration.	N	N
UpdateResponseHeadersPolicy	Updates a response headers policy.	Y	N
UpdateStreamingDistribution	Update a streaming distribution.	N	N
UpdateTrustStore	Updates a trust store.	Y	N
UpdateVpcOrigin	Update an Amazon CloudFront VPC origin in your account.	N	N
VerifyDnsConfiguration	Verify the DNS configuration for your domain names.	N	N
ListDistributionsByLambdaFunction	ListDistributionsByLambdaFunction recorded by CloudTrail for Amazon CloudFront. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.	N	N

any: CloudFront (catch-all)

Service: cloudfront

Description

Catch-all entry for CloudFront rules that match the service but not a specific eventName.

CreateDistribution

Service: cloudfront

Description

Creates a new CloudFront distribution that defines how content is delivered from origins to viewers.

Example CloudTrail Event #

This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.

{
  "eventVersion": "1.11",
  "eventID": "3c10d8d6-dfa3-480d-8dff-e3aeaaae8d9e",
  "eventSource": "cloudfront.amazonaws.com",
  "eventName": "CreateDistribution",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "apiVersion": "2020_05_31",
  "readOnly": false,
  "managementEvent": true,
  "requestID": "48c1240d-2716-4a76-974f-1c17c4ce817b",
  "userAgent": "Boto3/1.43.53 md/Botocore#1.43.53 md/awscrt#0.36.0 ua/2.1 os/macos#25.5.0 md/arch#arm64 lang/python#3.11.15 md/pyimpl#CPython m/F,b,Z,e cfg/retry-mode#adaptive Botocore/1.43.53 md/awslabs#mcp#aws-api-mcp-server#1.4.0 md/via/AWS-API-MCP MCPClient/Q-DEV-CLI#1.0.0 cfg/ro#0 cfg/consent#0 cfg/scripts#0 cfg/file-access#workdir",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com"
  }
}

UpdateDistribution

Service: cloudfront

Description

Modifies the configuration of an existing CloudFront distribution, including origins, cache behaviors, and viewer certificate settings.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "InvalidIfMatchVersion",
  "errorMessage": "The If-Match version is missing or not valid for the resource.",
  "eventCategory": "Management",
  "eventID": "b5005c3f-673c-4b8f-ae7b-ee887f1754bf",
  "eventName": "UpdateDistribution",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T19:21:55Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "96745404-4b5f-43d2-8da7-db59d67aaf21",
  "requestParameters": {
    "distributionConfig": {
      "callerReference": "dw-probe",
      "comment": "HIDDEN_DUE_TO_SECURITY_REASONS",
      "defaultCacheBehavior": {
        "targetOriginId": "dw-probe",
        "viewerProtocolPolicy": "allow-all"
      },
      "enabled": false,
      "origins": {
        "items": [
          {
            "domainName": "dw-probe",
            "id": "dw-probe"
          }
        ],
        "quantity": 1
      }
    },
    "id": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

AssociateAlias

Service: cloudfront

Description

The AssociateAlias API operation only supports standard distributions.

AssociateDistributionTenantWebACL

Service: cloudfront

Description

Associates the WAF web ACL with a distribution tenant.

AssociateDistributionWebACL

Service: cloudfront

Description

Associates the WAF web ACL with a distribution.

CopyDistribution

Service: cloudfront

Description

Creates a staging distribution using the configuration of the provided primary distribution.

CreateAnycastIpList

Service: cloudfront

Description

Creates an Anycast static IP list.

CreateCachePolicy

Service: cloudfront

Description

Creates a cache policy.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "b16d648c-f39e-43d5-ae66-82b3e6e661e4",
  "eventName": "CreateCachePolicy",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T20:04:37Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "bd5f5584-05d9-4d6b-9ed7-17a56ee6c1eb",
  "requestParameters": {
    "cachePolicyConfig": {
      "defaultTTL": 1,
      "maxTTL": 1,
      "minTTL": 1,
      "name": "dwfix-cp",
      "parametersInCacheKeyAndForwardedToOrigin": {
        "cookiesConfig": {
          "cookieBehavior": "none"
        },
        "enableAcceptEncodingGzip": false,
        "headersConfig": {
          "headerBehavior": "none"
        },
        "queryStringsConfig": {
          "queryStringBehavior": "none"
        }
      }
    }
  },
  "responseElements": {
    "cachePolicy": {
      "cachePolicyConfig": {
        "defaultTTL": 1,
        "maxTTL": 1,
        "minTTL": 1,
        "name": "dwfix-cp",
        "parametersInCacheKeyAndForwardedToOrigin": {
          "cookiesConfig": {
            "cookieBehavior": "none"
          },
          "enableAcceptEncodingBrotli": false,
          "enableAcceptEncodingGzip": false,
          "headersConfig": {
            "headerBehavior": "none"
          },
          "queryStringsConfig": {
            "queryStringBehavior": "none"
          }
        }
      },
      "id": "4648f800-70d2-4255-bb0c-57e266b622d2",
      "lastModifiedTime": "2026-06-29T20:04:37Z"
    },
    "eTag": "E23ZP02F085DFQ",
    "location": "https://cloudfront.amazonaws.com/2020-05-31/cache-policy/4648f800-70d2-4255-bb0c-57e266b622d2"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,n,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreateCloudFrontOriginAccessIdentity

Service: cloudfront

Description

Create a new origin access identity.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "92977825-c4e3-4cb1-aa14-89b25081962f",
  "eventName": "CreateCloudFrontOriginAccessIdentity",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T20:04:38Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "56dce8fb-f3e3-4ce5-b5dd-e8fc08e80f1d",
  "requestParameters": {
    "cloudFrontOriginAccessIdentityConfig": {
      "callerReference": "dwfix-oai",
      "comment": "dw"
    }
  },
  "responseElements": {
    "cloudFrontOriginAccessIdentity": {
      "cloudFrontOriginAccessIdentityConfig": {
        "callerReference": "dwfix-oai",
        "comment": "dw"
      },
      "id": "EMHSEOYHIEHOM",
      "s3CanonicalUserId": "ec5511f23d96ef88379d2e4bb10b59c7400af2f9692a25d1d392a811e8d99c1c360a6150d7f5ee5e3bf5167191397d63"
    },
    "eTag": "ETVPDKIKX0DER",
    "location": "https://cloudfront.amazonaws.com/2020-05-31/origin-access-identity/cloudfront/EMHSEOYHIEHOM"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,n,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreateConnectionFunction

Service: cloudfront

Description

Creates a connection function.

CreateConnectionGroup

Service: cloudfront

Description

Creates a connection group.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "c8f0810a-27a9-48ee-9da5-a595ebbc847a",
  "eventName": "CreateConnectionGroup",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T20:59:49Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "f88e69d2-ee1a-4934-845e-03f9b7f10898",
  "requestParameters": {
    "enabled": true,
    "ipv6Enabled": false,
    "name": "dwfix-cf-cg"
  },
  "responseElements": {
    "connectionGroup": {
      "arn": "arn:aws:cloudfront::123456789012:connection-group/cg_3FpKtxBfd0NlEcNmajQLoLbZUlq",
      "createdTime": "2026-06-29T20:59:49Z",
      "enabled": true,
      "id": "cg_3FpKtxBfd0NlEcNmajQLoLbZUlq",
      "ipv6Enabled": false,
      "isDefault": false,
      "lastModifiedTime": "2026-06-29T20:59:49Z",
      "name": "dwfix-cf-cg",
      "routingEndpoint": "d33kykkl2rz74j.cloudfront.net",
      "status": "InProgress"
    },
    "eTag": "E23ZP02F085DFQ"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,D,Z,n cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreateContinuousDeploymentPolicy

Service: cloudfront

Description

Creates a continuous deployment policy that distributes traffic for a custom domain name to two different CloudFront distributions.

CreateDistributionTenant

Service: cloudfront

Description

Creates a distribution tenant.

CreateDistributionWithTags

Service: cloudfront

Description

Create a new distribution with tags.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "d84e8985-a507-42e1-8c62-b6b599800a3b",
  "eventSource": "cloudfront.amazonaws.com",
  "eventName": "CreateDistributionWithTags",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "apiVersion": "2020_05_31",
  "readOnly": false,
  "managementEvent": true,
  "requestID": "d6fed190-c9a3-4b84-8942-ebbf964d25a3",
  "userAgent": "APN/1.0 HashiCorp/1.0 Terraform/1.15.8 (+https://www.terraform.io) terraform-provider-aws/6.27.0 (+https://registry.terraform.io/providers/hashicorp/aws) aws-sdk-go-v2/1.41.0 ua/2.1 os/linux lang/go#1.24.11 md/GOOS#linux md/GOARCH#arm64 api/cloudfront#1.58.3 m/g",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com"
  }
}

CreateFieldLevelEncryptionConfig

Service: cloudfront

Description

Create a new field-level encryption configuration.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "QueryArgProfileEmpty",
  "errorMessage": "The query arg profile in field level encryption config cannot be empty when content type profile is empty or when no default profile id is given in any content type profile.",
  "eventCategory": "Management",
  "eventID": "88b7e386-2555-4357-810c-fc5c90e2e06a",
  "eventName": "CreateFieldLevelEncryptionConfig",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T20:59:29Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "e2ca7fcd-3834-432a-8e23-fe8a4cee7fb7",
  "requestParameters": {
    "fieldLevelEncryptionConfig": {
      "callerReference": "dwfix-cf-flec-ref-1782766768",
      "comment": "dwfix test FLE config",
      "contentTypeProfileConfig": {
        "forwardWhenContentTypeIsUnknown": true
      },
      "queryArgProfileConfig": {
        "forwardWhenQueryArgProfileIsUnknown": true
      }
    }
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,D,Z,n cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreateFieldLevelEncryptionProfile

Service: cloudfront

Description

Create a field-level encryption profile.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "InvalidArgument",
  "errorMessage": "The parameter EncryptionEntities should have at least one value.",
  "eventCategory": "Management",
  "eventID": "8b0573c6-3294-4aea-a20c-a30c264e59a2",
  "eventName": "CreateFieldLevelEncryptionProfile",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T20:59:28Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "6375f25b-b754-4462-b46f-8ae486436d08",
  "requestParameters": {
    "fieldLevelEncryptionProfileConfig": {
      "callerReference": "dwfix-cf-flep-ref-1782766768",
      "comment": "dwfix test FLE profile",
      "encryptionEntities": {
        "quantity": 0
      },
      "name": "dwfix-cf-flep"
    }
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,D,Z,n cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreateFunction

Service: cloudfront

Description

Creates a CloudFront function.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "4c1df752-f0aa-49ef-82e6-692401b0fec2",
  "eventName": "CreateFunction",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T20:04:39Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "faae3da3-42f3-48d6-ab3f-a268753ed1ae",
  "requestParameters": {
    "functionCode": "HIDDEN_DUE_TO_SECURITY_REASONS",
    "functionConfig": {
      "comment": "dw",
      "runtime": "cloudfront-js-2.0"
    },
    "name": "dwfix-cffn"
  },
  "responseElements": {
    "eTag": "ETVPDKIKX0DER",
    "functionSummary": {
      "functionConfig": {
        "comment": "dw",
        "runtime": "cloudfront-js-2.0"
      },
      "functionMetadata": {
        "createdTime": "2026-06-29T20:04:39Z",
        "functionARN": "arn:aws:cloudfront::123456789012:function/dwfix-cffn",
        "lastModifiedTime": "2026-06-29T20:04:39Z",
        "stage": "DEVELOPMENT"
      },
      "name": "dwfix-cffn",
      "status": "UNPUBLISHED"
    },
    "location": "https://cloudfront.amazonaws.com/2020-05-31/function/arn:aws:cloudfront::123456789012:function/dwfix-cffn"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,n,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreateInvalidation

Service: cloudfront

Description

Create a new invalidation.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "ff38cb8c-a157-441d-bd6b-b080011fb4b9",
  "eventSource": "cloudfront.amazonaws.com",
  "eventName": "CreateInvalidation",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "apiVersion": "2020_05_31",
  "readOnly": false,
  "managementEvent": true,
  "requestID": "8793220a-8a1b-46b3-8f22-00f069ae126d",
  "userAgent": "aws-sdk-ruby3/3.246.0 ua/2.1 api/cloudfront#1.144.0 os/linux#musl md/x86_64 lang/ruby#4.0.0 md/4.0.0 m/Z,b,D,g",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com"
  }
}

CreateInvalidationForDistributionTenant

Service: cloudfront

Description

Creates an invalidation for a distribution tenant.

CreateKeyGroup

Service: cloudfront

Description

Creates a key group that you can use with CloudFront signed URLs and signed cookies.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "a7473285-db3f-42bc-9ced-6662dd81f9c7",
  "eventName": "CreateKeyGroup",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T20:59:26Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "fd0fc054-cafa-45c3-83f8-9c8c6b601012",
  "requestParameters": {
    "keyGroupConfig": {
      "comment": "dwfix test key group for sample collection",
      "items": [
        "K3JCR2UJO76792"
      ],
      "name": "dwfix-cf-keygroup"
    }
  },
  "responseElements": {
    "eTag": "E23ZP02F085DFQ",
    "keyGroup": {
      "id": "3a19a703-2fa4-4b79-a8b1-8e3cd96ad4f4",
      "keyGroupConfig": {
        "comment": "dwfix test key group for sample collection",
        "items": [
          "K3JCR2UJO76792"
        ],
        "name": "dwfix-cf-keygroup"
      },
      "lastModifiedTime": "2026-06-29T20:59:26Z"
    },
    "location": "https://cloudfront.amazonaws.com/2020-05-31/key-group/3a19a703-2fa4-4b79-a8b1-8e3cd96ad4f4"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,D,Z,n cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreateKeyValueStore

Service: cloudfront

Description

Specifies the key value store resource to add to your account.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "77b2bcd8-6708-497a-b9f2-d8c1c147273c",
  "eventName": "CreateKeyValueStore",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T20:59:46Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "bbd9c45f-0b46-4e26-aadd-3eea94aac3fb",
  "requestParameters": {
    "comment": "dwfix test KV store for sample collection",
    "name": "dwfix-cf-kvs"
  },
  "responseElements": {
    "eTag": "ETVPDKIKX0DER",
    "keyValueStore": {
      "aRN": "arn:aws:cloudfront::123456789012:key-value-store/2c6216a2-4ea4-4e36-bb4e-7b8016ba4ae2",
      "comment": "dwfix test KV store for sample collection",
      "id": "2c6216a2-4ea4-4e36-bb4e-7b8016ba4ae2",
      "lastModifiedTime": "2026-06-29T20:59:46Z",
      "name": "dwfix-cf-kvs",
      "status": "PROVISIONING"
    },
    "location": "https://cloudfront.amazonaws.com/2020-05-31/key-value-store/arn:aws:cloudfront::123456789012:key-value-store/2c6216a2-4ea4-4e36-bb4e-7b8016ba4ae2"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,D,Z,n cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreateMonitoringSubscription

Service: cloudfront

Description

Enables or disables additional Amazon CloudWatch metrics for the specified CloudFront distribution.

CreateOriginAccessControl

Service: cloudfront

Description

Creates a new origin access control in CloudFront.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "66dbbdd1-f3a5-4a7c-bb4b-f3b1779a64df",
  "eventName": "CreateOriginAccessControl",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T20:04:37Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "fa94487c-d27a-4867-94e1-8b8fd56dd87e",
  "requestParameters": {
    "originAccessControlConfig": {
      "name": "dwfix-oac",
      "originAccessControlOriginType": "s3",
      "signingBehavior": "always",
      "signingProtocol": "sigv4"
    }
  },
  "responseElements": {
    "eTag": "ETVPDKIKX0DER",
    "location": "https://cloudfront.amazonaws.com/2020-05-31/origin-access-control/E19LYRL0Y0OEBN",
    "originAccessControl": {
      "id": "E19LYRL0Y0OEBN",
      "originAccessControlConfig": {
        "name": "dwfix-oac",
        "originAccessControlOriginType": "s3",
        "signingBehavior": "always",
        "signingProtocol": "sigv4"
      }
    }
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,n,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreateOriginRequestPolicy

Service: cloudfront

Description

Creates an origin request policy.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "af05bf63-8bb4-4fb1-a05e-6de3d8523c11",
  "eventName": "CreateOriginRequestPolicy",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T20:04:37Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "b79cb98f-d8ea-4799-95f5-9f1ce937736d",
  "requestParameters": {
    "originRequestPolicyConfig": {
      "cookiesConfig": {
        "cookieBehavior": "none"
      },
      "headersConfig": {
        "headerBehavior": "none"
      },
      "name": "dwfix-orp",
      "queryStringsConfig": {
        "queryStringBehavior": "none"
      }
    }
  },
  "responseElements": {
    "eTag": "E23ZP02F085DFQ",
    "location": "https://cloudfront.amazonaws.com/2020-05-31/origin-request-policy/7ac34b1d-e65d-49be-ab0b-d926e39f801d",
    "originRequestPolicy": {
      "id": "7ac34b1d-e65d-49be-ab0b-d926e39f801d",
      "lastModifiedTime": "2026-06-29T20:04:37Z",
      "originRequestPolicyConfig": {
        "cookiesConfig": {
          "cookieBehavior": "none"
        },
        "headersConfig": {
          "headerBehavior": "none"
        },
        "name": "dwfix-orp",
        "queryStringsConfig": {
          "queryStringBehavior": "none"
        }
      }
    }
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,n,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreatePublicKey

Service: cloudfront

Description

Add a new public key to CloudFront to use, for example, for field-level encryption.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "df4d0a46-51f1-4c81-9f84-e26a7cf18a3e",
  "eventName": "CreatePublicKey",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T20:59:26Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "a657590e-4d72-4972-9a53-458821f7a600",
  "requestParameters": {
    "publicKeyConfig": {
      "callerReference": "dwfix-cf-pubkey-ref-1782766765",
      "comment": "dwfix test public key for sample collection",
      "encodedKey": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA7GgE4S9rM+yKg77n60WI\no/IcEIb8ShZXX6gUvCx5Z/AJWpFC6gm/Pm3OI+1B8LGZyYj8lTJpiGck6G0ZMqqn\n40Tc/jsD1mk+i5IwTIbOAE9yQrdo4gN8NTLNy3nxLrcgbLjN2h0PvP+rtfYd2tCO\nUwObxpiOmilj/i8WWT9Hm8mpEvFB/0yf/RSpXqJpjvCffYTDhHjSyHFPFtap02Nm\n7Pcr/2ziHBIrWwiMs2xibsk2xwCoKNYNTbyHO9SHTpvaY6RbXSVobVYdPekDHpUL\nAgjJTZNhCaWUOlNZJr55AFMm5GSn2MTKZbwZFjEM+qEzoNAGbZ92ayTW84My+qbo\nbQIDAQAB\n-----END PUBLIC KEY-----",
      "name": "dwfix-cf-pubkey"
    }
  },
  "responseElements": {
    "eTag": "E23ZP02F085DFQ",
    "location": "https://cloudfront.amazonaws.com/2020-05-31/public-key/K3JCR2UJO76792",
    "publicKey": {
      "createdTime": "2026-06-29T20:59:26Z",
      "id": "K3JCR2UJO76792",
      "publicKeyConfig": {
        "callerReference": "dwfix-cf-pubkey-ref-1782766765",
        "comment": "dwfix test public key for sample collection",
        "encodedKey": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA7GgE4S9rM+yKg77n60WI\no/IcEIb8ShZXX6gUvCx5Z/AJWpFC6gm/Pm3OI+1B8LGZyYj8lTJpiGck6G0ZMqqn\n40Tc/jsD1mk+i5IwTIbOAE9yQrdo4gN8NTLNy3nxLrcgbLjN2h0PvP+rtfYd2tCO\nUwObxpiOmilj/i8WWT9Hm8mpEvFB/0yf/RSpXqJpjvCffYTDhHjSyHFPFtap02Nm\n7Pcr/2ziHBIrWwiMs2xibsk2xwCoKNYNTbyHO9SHTpvaY6RbXSVobVYdPekDHpUL\nAgjJTZNhCaWUOlNZJr55AFMm5GSn2MTKZbwZFjEM+qEzoNAGbZ92ayTW84My+qbo\nbQIDAQAB\n-----END PUBLIC KEY-----\n",
        "name": "dwfix-cf-pubkey"
      }
    }
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,D,Z,n cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreateRealtimeLogConfig

Service: cloudfront

Description

Creates a real-time log configuration.

CreateResponseHeadersPolicy

Service: cloudfront

Description

Creates a response headers policy.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "4ea832c8-5406-4e24-8370-64cecf35b0c0",
  "eventName": "CreateResponseHeadersPolicy",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T20:04:37Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "d29b1409-27ac-4da7-9d48-61e2b3635f79",
  "requestParameters": {
    "responseHeadersPolicyConfig": {
      "name": "dwfix-rhp",
      "securityHeadersConfig": {
        "xSSProtection": {
          "modeBlock": true,
          "override": true,
          "protection": true
        }
      }
    }
  },
  "responseElements": {
    "eTag": "E23ZP02F085DFQ",
    "location": "https://cloudfront.amazonaws.com/2020-05-31/response-header-policy/a1e2e6e4-dbf8-4207-b5c7-66eea52f2504",
    "responseHeadersPolicy": {
      "id": "a1e2e6e4-dbf8-4207-b5c7-66eea52f2504",
      "lastModifiedTime": "2026-06-29T20:04:37Z",
      "responseHeadersPolicyConfig": {
        "name": "dwfix-rhp",
        "securityHeadersConfig": {
          "contentSecurityPolicy": {},
          "contentTypeOptions": {},
          "frameOptions": {},
          "referrerPolicy": {},
          "strictTransportSecurity": {},
          "xSSProtection": {
            "modeBlock": true,
            "override": true,
            "protection": true
          }
        }
      }
    }
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,n,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreateStreamingDistribution

Service: cloudfront

Description

Create a new streaming distribution.

CreateStreamingDistributionWithTags

Service: cloudfront

Description

Create a new streaming distribution with tags.

CreateTrustStore

Service: cloudfront

Description

Creates a trust store.

CreateVpcOrigin

Service: cloudfront

Description

Create an Amazon CloudFront VPC origin.

DeleteAnycastIpList

Service: cloudfront

Description

Deletes an Anycast static IP list.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "InvalidIfMatchVersion",
  "errorMessage": "The If-Match version is missing or not valid for the resource.",
  "eventCategory": "Management",
  "eventID": "50a8061f-39af-4db2-9c99-f9ea9132afaa",
  "eventName": "DeleteAnycastIpList",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T19:21:55Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "16f039f1-6297-45c3-a93d-5ff910236906",
  "requestParameters": {
    "id": "dw-probe",
    "ifMatch": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteCachePolicy

Service: cloudfront

Description

Deletes a cache policy.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "InvalidIfMatchVersion",
  "errorMessage": "The If-Match version is missing or not valid for the resource.",
  "eventCategory": "Management",
  "eventID": "ba916354-861a-4c75-90af-30b8f87936f7",
  "eventName": "DeleteCachePolicy",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T19:21:55Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "5a849053-5253-4eea-9155-9de335ca98aa",
  "requestParameters": {
    "id": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteCloudFrontOriginAccessIdentity

Service: cloudfront

Description

Delete an origin access identity.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "NoSuchCloudFrontOriginAccessIdentity",
  "errorMessage": "The specified CloudFront origin access identity does not exist.",
  "eventCategory": "Management",
  "eventID": "0943a439-0cbc-44b9-af89-8fd1c4a237f7",
  "eventName": "DeleteCloudFrontOriginAccessIdentity",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T19:21:56Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "27495fb7-5841-4258-93b4-d357aaebab7e",
  "requestParameters": {
    "id": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteConnectionFunction

Service: cloudfront

Description

Deletes a connection function.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "InvalidIfMatchVersion",
  "errorMessage": "The If-Match version is missing or not valid for the resource.",
  "eventCategory": "Management",
  "eventID": "c17a4e44-bac6-4b9c-9fd5-69acbb9d04ed",
  "eventName": "DeleteConnectionFunction",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T19:21:56Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "922f925a-2cec-4fcc-966a-66ed1b292c84",
  "requestParameters": {
    "id": "ddddd",
    "ifMatch": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteConnectionGroup

Service: cloudfront

Description

Deletes a connection group.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "ResourceNotDisabled",
  "errorMessage": "You must disable the specified connection group before you can delete it.",
  "eventCategory": "Management",
  "eventID": "1072e6de-08f7-40df-8c9e-7b4fe6d92b30",
  "eventName": "DeleteConnectionGroup",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T20:59:49Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "8d29c6fc-9ef4-4ed5-82a4-c69871a848e7",
  "requestParameters": {
    "id": "cg_3FpKtxBfd0NlEcNmajQLoLbZUlq",
    "ifMatch": "ETVPDKIKX0DER"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,D,Z,n cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteContinuousDeploymentPolicy

Service: cloudfront

Description

Deletes a continuous deployment policy.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "InvalidIfMatchVersion",
  "errorMessage": "The If-Match version is missing or not valid for the resource.",
  "eventCategory": "Management",
  "eventID": "567976ed-acc8-4a14-895d-cf87c5fdb390",
  "eventName": "DeleteContinuousDeploymentPolicy",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T19:21:56Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "0a517d29-e9e7-435e-921c-1c47a1ff3a09",
  "requestParameters": {
    "id": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteDistribution

Service: cloudfront

Description

Delete a distribution.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "NoSuchDistribution",
  "errorMessage": "The specified distribution does not exist.",
  "eventCategory": "Management",
  "eventID": "97951b78-490c-4dea-9081-75d06e6b98f3",
  "eventName": "DeleteDistribution",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T19:21:57Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "45c16f23-63d1-4ee6-9598-4ad75d657db5",
  "requestParameters": {
    "id": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteDistributionTenant

Service: cloudfront

Description

Deletes a distribution tenant.

DeleteFieldLevelEncryptionConfig

Service: cloudfront

Description

Remove a field-level encryption configuration.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "NoSuchFieldLevelEncryptionConfig",
  "errorMessage": "The specified field level encryption config does not exist.",
  "eventCategory": "Management",
  "eventID": "d5079670-05e2-4e64-8520-7049ad7a5e06",
  "eventName": "DeleteFieldLevelEncryptionConfig",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T19:21:57Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "d4426603-d897-4036-b0e6-dc30a1ecab70",
  "requestParameters": {
    "id": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteFieldLevelEncryptionProfile

Service: cloudfront

Description

Remove a field-level encryption profile.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "NoSuchFieldLevelEncryptionProfile",
  "errorMessage": "The specified field level encryption profile does not exist.",
  "eventCategory": "Management",
  "eventID": "84ada2b7-f2c9-4ce2-95a4-dd86186edaab",
  "eventName": "DeleteFieldLevelEncryptionProfile",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T19:21:57Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "417b56b6-1606-4272-a376-8bb2c5468963",
  "requestParameters": {
    "id": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteFunction

Service: cloudfront

Description

Deletes a CloudFront function.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "InvalidIfMatchVersion",
  "errorMessage": "The If-Match version is missing or not valid for the resource.",
  "eventCategory": "Management",
  "eventID": "75d02222-6901-4b16-974b-32b09a88ef83",
  "eventName": "DeleteFunction",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T19:21:58Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "59bcad54-2126-460e-a44e-ec4685fd8599",
  "requestParameters": {
    "ifMatch": "dw-probe",
    "name": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteKeyGroup

Service: cloudfront

Description

Deletes a key group.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "InvalidIfMatchVersion",
  "errorMessage": "The If-Match version is missing or not valid for the resource.",
  "eventCategory": "Management",
  "eventID": "f468b06b-8020-4656-ac7f-8a6d0da407b6",
  "eventName": "DeleteKeyGroup",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T19:21:58Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "96409bdc-8292-48e3-b546-6533b03774cb",
  "requestParameters": {
    "id": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteKeyValueStore

Service: cloudfront

Description

Specifies the key value store to delete.

Example CloudTrail Event #

{
  "additionalEventData": {
    "arn": "arn:aws:cloudfront::123456789012:key-value-store/2c6216a2-4ea4-4e36-bb4e-7b8016ba4ae2"
  },
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "b548d7c9-b603-408b-bda6-67e57fa9807d",
  "eventName": "DeleteKeyValueStore",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T20:59:50Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "28dc305f-8a64-4e1f-8f45-fa810afde590",
  "requestParameters": {
    "ifMatch": "E3UN6WX5RRO2AG",
    "name": "dwfix-cf-kvs"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,D,Z,n cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteMonitoringSubscription

Service: cloudfront

Description

Disables additional CloudWatch metrics for the specified CloudFront distribution.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "NoSuchDistribution",
  "errorMessage": "The specified distribution does not exist.",
  "eventCategory": "Management",
  "eventID": "d9be80f1-2c9c-4372-8d47-a445ae32798a",
  "eventName": "DeleteMonitoringSubscription",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T19:21:58Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "05f97287-ec70-4788-88e7-bebcbf428952",
  "requestParameters": {
    "distributionId": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteOriginAccessControl

Service: cloudfront

Description

Deletes a CloudFront origin access control.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "NoSuchOriginAccessControl",
  "errorMessage": "The specified origin access control does not exist.",
  "eventCategory": "Management",
  "eventID": "8c0ad2f8-daee-4362-9c5e-2c7a56ae8a58",
  "eventName": "DeleteOriginAccessControl",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T19:21:59Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "fc993342-8532-4d98-8ac2-14167e8af116",
  "requestParameters": {
    "id": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteOriginRequestPolicy

Service: cloudfront

Description

Deletes an origin request policy.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "InvalidIfMatchVersion",
  "errorMessage": "The If-Match version is missing or not valid for the resource.",
  "eventCategory": "Management",
  "eventID": "5f7722e5-aa29-4675-8abf-ebbec2863f6f",
  "eventName": "DeleteOriginRequestPolicy",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T19:21:59Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "89e5513b-a2e7-404f-aaaf-5bc9ed8e5994",
  "requestParameters": {
    "id": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeletePublicKey

Service: cloudfront

Description

Remove a public key you previously added to CloudFront.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "NoSuchPublicKey",
  "errorMessage": "The specified CloudFront public key does not exist.",
  "eventCategory": "Management",
  "eventID": "b5be88bd-73d0-4e53-afba-65ed016ec138",
  "eventName": "DeletePublicKey",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T19:21:59Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "19be294b-bb7f-4522-bdad-e50593be34b6",
  "requestParameters": {
    "id": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteRealtimeLogConfig

Service: cloudfront

Description

Deletes a real-time log configuration.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "InvalidArgument",
  "errorMessage": "The parameter Name/ARN must be provided.",
  "eventCategory": "Management",
  "eventID": "e7255c03-6d14-41af-82ef-9cd8a02a81c2",
  "eventName": "DeleteRealtimeLogConfig",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T19:45:15Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "91ec35bb-645c-424a-abbf-ffff713724cc",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,Z,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteResourcePolicy

Service: cloudfront

Description

Deletes the resource policy attached to the CloudFront resource.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "InvalidArgument",
  "errorMessage": "The specified resource type isn't valid. Specify a VPC origin and try again.",
  "eventCategory": "Management",
  "eventID": "cf50e170-2343-49bd-a007-24a562532da9",
  "eventName": "DeleteResourcePolicy",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T20:59:48Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "87d17a62-5b8f-42f7-8437-b0166c440531",
  "requestParameters": {
    "resourceArn": "arn:aws:cloudfront::123456789012:key-value-store/2c6216a2-4ea4-4e36-bb4e-7b8016ba4ae2"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,D,Z,n cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteResponseHeadersPolicy

Service: cloudfront

Description

Deletes a response headers policy.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "InvalidIfMatchVersion",
  "errorMessage": "The If-Match version is missing or not valid for the resource.",
  "eventCategory": "Management",
  "eventID": "5ad73535-cd51-4ee9-ae0a-d7ece00e02c7",
  "eventName": "DeleteResponseHeadersPolicy",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T19:22:00Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "5a691203-e8d8-4564-8279-8c9dd23d4c6b",
  "requestParameters": {
    "id": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteStreamingDistribution

Service: cloudfront

Description

Delete a streaming distribution.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "NoSuchStreamingDistribution",
  "errorMessage": "The specified streaming distribution does not exist.",
  "eventCategory": "Management",
  "eventID": "bf31c038-1eef-49c4-ace5-47ab0cb4ef88",
  "eventName": "DeleteStreamingDistribution",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T19:22:00Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "47893a3d-6698-430c-a028-f9d94d611c72",
  "requestParameters": {
    "id": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteTrustStore

Service: cloudfront

Description

Deletes a trust store.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "InvalidIfMatchVersion",
  "errorMessage": "The If-Match version is missing or not valid for the resource.",
  "eventCategory": "Management",
  "eventID": "b4db15ea-764a-4139-9fc4-bdbf59945601",
  "eventName": "DeleteTrustStore",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T19:22:00Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "31cd9a57-fcea-4009-9374-08b0f980567a",
  "requestParameters": {
    "id": "ddddd",
    "ifMatch": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteVpcOrigin

Service: cloudfront

Description

Delete an Amazon CloudFront VPC origin.

DescribeConnectionFunction

Service: cloudfront

Description

Describes a connection function.

CloudTrail logs this operation under the eventName DescribeConnectionFunction2020_05_31; the catalog keys on the SDK operation name DescribeConnectionFunction. A detection rule may use either name.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "EntityNotFound",
  "errorMessage": "The specified connection function does not exist.",
  "eventCategory": "Management",
  "eventID": "a2c0e83f-f522-459c-aee7-9bdc40a8446a",
  "eventName": "DescribeConnectionFunction2020_05_31",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:52Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "a51371df-7406-46b2-842b-0060bbca3619",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DescribeFunction

Service: cloudfront

Description

Gets configuration information and metadata about a CloudFront function, but not the function's code.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "NoSuchFunctionExists",
  "errorMessage": "The specified function does not exist.",
  "eventCategory": "Management",
  "eventID": "bed42dd1-8e9e-4142-8bde-e100d60b3503",
  "eventName": "DescribeFunction",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:52Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "99360224-5410-4a87-bb41-e2ab372f090f",
  "requestParameters": {
    "name": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DescribeKeyValueStore

Service: cloudfront

Description

Specifies the key value store and its configuration.

CloudTrail logs this operation under the eventName DescribeKeyValueStore2020_05_31; the catalog keys on the SDK operation name DescribeKeyValueStore. A detection rule may use either name.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "EntityNotFound",
  "errorMessage": "The specified KeyValueStore does not exist.",
  "eventCategory": "Management",
  "eventID": "a31921e2-862d-4789-8c82-37b03b6df07b",
  "eventName": "DescribeKeyValueStore2020_05_31",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:52Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "5e737327-ed8b-46d7-b0e4-0fe7e663219f",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DisassociateDistributionTenantWebACL

Service: cloudfront

Description

Disassociates a distribution tenant from the WAF web ACL.

DisassociateDistributionWebACL

Service: cloudfront

Description

Disassociates a distribution from the WAF web ACL.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "InvalidIfMatchVersion",
  "errorMessage": "The If-Match version is missing or not valid for the resource.",
  "eventCategory": "Management",
  "eventID": "bb3b46d4-49fa-4e8a-ae23-46ea48b23f47",
  "eventName": "DisassociateDistributionWebACL",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T19:22:01Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "22ee01de-6510-4e0b-962b-d05fa3f7619c",
  "requestParameters": {
    "id": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetAnycastIpList

Service: cloudfront

Description

Gets an Anycast static IP list.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "EntityNotFound",
  "errorMessage": "The specified Anycast IP list does not exist",
  "eventCategory": "Management",
  "eventID": "285139e6-cc0c-441f-97d9-4ffc1766211b",
  "eventName": "GetAnycastIpList",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:52Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "1d23712d-d93e-4aac-9c7b-e0af6a3fa64e",
  "requestParameters": {
    "id": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetCachePolicy

Service: cloudfront

Description

Gets a cache policy, including the following metadata: The policy's identifier.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "NoSuchCachePolicy",
  "errorMessage": "The specified cache policy does not exist.",
  "eventCategory": "Management",
  "eventID": "d325c439-a991-45c9-ad37-d68087848cd9",
  "eventName": "GetCachePolicy",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:52Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "7ccef1c6-c4c9-46b8-bcb4-50daa0a94d53",
  "requestParameters": {
    "id": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetCachePolicyConfig

Service: cloudfront

Description

Gets a cache policy configuration.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "NoSuchCachePolicy",
  "errorMessage": "The specified cache policy does not exist.",
  "eventCategory": "Management",
  "eventID": "967cf841-4575-44da-b016-5e885bc20f36",
  "eventName": "GetCachePolicyConfig",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:53Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "5cc9a03a-a982-4689-9aa7-57dabaede509",
  "requestParameters": {
    "id": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetCloudFrontOriginAccessIdentity

Service: cloudfront

Description

Get the information about an origin access identity.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "NoSuchCloudFrontOriginAccessIdentity",
  "errorMessage": "The specified CloudFront origin access identity does not exist.",
  "eventCategory": "Management",
  "eventID": "6a03598c-dd3c-4c52-995c-5a075ec03372",
  "eventName": "GetCloudFrontOriginAccessIdentity",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:53Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "d8b954f9-5e26-40b3-98d4-3a37b345b02f",
  "requestParameters": {
    "id": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetCloudFrontOriginAccessIdentityConfig

Service: cloudfront

Description

Get the configuration information about an origin access identity.

Example CloudTrail Event #

{
  "apiVersion": "2016_09_29",
  "awsRegion": "us-east-1",
  "errorCode": "NoSuchCloudFrontOriginAccessIdentity",
  "errorMessage": "The specified CloudFront origin access identity does not exist.",
  "eventID": "5b57d093-1b6b-42ed-b656-ff005120ada1e",
  "eventName": "GetCloudFrontOriginAccessIdentityConfig",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2017-03-01T18:07:20Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.03",
  "recipientAccountId": "811596193553",
  "requestID": "e09983-fea9-11e6-ba50-ff7ba2e4c666",
  "requestParameters": {
    "id": "s33ppypa75"
  },
  "responseElements": null,
  "sourceIPAddress": "3.239.132.95",
  "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-34-generic botocore/1.4.70",
  "userIdentity": {
    "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/Level6",
    "principalId": "AIDADO2GQD0K8TEF7KW1V",
    "type": "IAMUser",
    "userName": "Level6"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

GetConnectionFunction

Service: cloudfront

Description

Gets a connection function.

CloudTrail logs this operation under the eventName GetConnectionFunction2020_05_31; the catalog keys on the SDK operation name GetConnectionFunction. A detection rule may use either name.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "EntityNotFound",
  "errorMessage": "The specified connection function does not exist.",
  "eventCategory": "Management",
  "eventID": "6daf8ef8-a90d-4e97-a794-1ce9bf7279f7",
  "eventName": "GetConnectionFunction2020_05_31",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:53Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "fb6b4fc1-e2ae-4e5d-ac62-da228bdc2148",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetConnectionGroup

Service: cloudfront

Description

Gets information about a connection group.

CloudTrail logs this operation under the eventName GetConnectionGroup2020_05_31; the catalog keys on the SDK operation name GetConnectionGroup. A detection rule may use either name.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "EntityNotFound",
  "errorMessage": "The specified connection group does not exist.",
  "eventCategory": "Management",
  "eventID": "c05e064b-06dc-45eb-9fe9-d166b2ac1d42",
  "eventName": "GetConnectionGroup2020_05_31",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:53Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "1a4cf877-dcaf-4566-b84d-8119f716241e",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetConnectionGroupByRoutingEndpoint

Service: cloudfront

Description

Gets information about a connection group by using the endpoint that you specify.

CloudTrail logs this operation under the eventName GetConnectionGroupByRoutingEndpoint2020_05_31; the catalog keys on the SDK operation name GetConnectionGroupByRoutingEndpoint. A detection rule may use either name.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "EntityNotFound",
  "errorMessage": "The specified connection group does not exist.",
  "eventCategory": "Management",
  "eventID": "afa28069-fe01-44f1-af00-5e50f8c5fb99",
  "eventName": "GetConnectionGroupByRoutingEndpoint2020_05_31",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:53Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "2ce62520-c103-45d3-b914-f8dc9e9f0eed",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetContinuousDeploymentPolicy

Service: cloudfront

Description

Gets a continuous deployment policy, including metadata (the policy's identifier and the date and time when the policy was last modified).

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "NoSuchContinuousDeploymentPolicy",
  "errorMessage": "The specified continuous deployment policy does not exist.",
  "eventCategory": "Management",
  "eventID": "7c58c465-ac4f-44b0-b0ad-fef72204813f",
  "eventName": "GetContinuousDeploymentPolicy",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:53Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "b842450d-f0ce-4ac5-91cc-ebc25bf2ded1",
  "requestParameters": {
    "id": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetContinuousDeploymentPolicyConfig

Service: cloudfront

Description

Gets configuration information about a continuous deployment policy.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "NoSuchContinuousDeploymentPolicy",
  "errorMessage": "The specified continuous deployment policy does not exist.",
  "eventCategory": "Management",
  "eventID": "67c65f5f-7ab5-4f84-9a6e-fca17f640ca3",
  "eventName": "GetContinuousDeploymentPolicyConfig",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:53Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "cbfbc448-8b76-43de-b0f1-145841219650",
  "requestParameters": {
    "id": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetDistribution

Service: cloudfront

Description

Get the information about a distribution.

Example CloudTrail Event #

{
  "apiVersion": "2016_11_25",
  "awsRegion": "us-east-1",
  "errorCode": "NoSuchDistribution",
  "errorMessage": "The specified distribution does not exist.",
  "eventID": "5d7f5d66-be7a-43bb-8edb-174f649cf90f",
  "eventName": "GetDistribution",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2017-05-21T23:12:43Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.03",
  "recipientAccountId": "811596193553",
  "requestID": "fe4dc0a2-3e7a-11e7-a02f-29e7a5b16cb8",
  "requestParameters": {
    "id": "E250LGPU0YOEUX"
  },
  "responseElements": null,
  "sourceIPAddress": "255.253.125.115",
  "userAgent": "aws-cli/1.11.47 Python/2.7.3 Linux/3.2.0-4-amd64 botocore/1.5.10",
  "userIdentity": {
    "accessKeyId": "AKIAKZ5DMM2L61KYGILK",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:root",
    "principalId": "811596193553",
    "type": "Root"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

GetDistributionConfig

Service: cloudfront

Description

Get the configuration information about a distribution.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "NoSuchDistribution",
  "errorMessage": "The specified distribution does not exist.",
  "eventCategory": "Management",
  "eventID": "cd021829-da9d-41d6-94ab-1ccaad6d79b2",
  "eventName": "GetDistributionConfig",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:53Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "83246f46-6d39-4cc0-ae55-9e42867b15a3",
  "requestParameters": {
    "id": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetDistributionTenant

Service: cloudfront

Description

Gets information about a distribution tenant.

CloudTrail logs this operation under the eventName GetDistributionTenant2020_05_31; the catalog keys on the SDK operation name GetDistributionTenant. A detection rule may use either name.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "EntityNotFound",
  "errorMessage": "The specified distribution tenant doesn't exist.",
  "eventCategory": "Management",
  "eventID": "9e2f3016-a493-4c34-b54a-37b28ebbded6",
  "eventName": "GetDistributionTenant2020_05_31",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:53Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "1d993ec1-4f2a-42d1-8a71-6ccc926dce1f",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetDistributionTenantByDomain

Service: cloudfront

Description

Gets information about a distribution tenant by the associated domain.

CloudTrail logs this operation under the eventName GetDistributionTenantByDomain2020_05_31; the catalog keys on the SDK operation name GetDistributionTenantByDomain. A detection rule may use either name.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "EntityNotFound",
  "errorMessage": "The specified distribution tenant doesn't exist.",
  "eventCategory": "Management",
  "eventID": "2ef59eba-4e78-4f14-ac47-e308c1f0a0fb",
  "eventName": "GetDistributionTenantByDomain2020_05_31",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:54Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "7e6a39cb-7285-4b26-9dd6-c8f09bd6df0e",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetFieldLevelEncryption

Service: cloudfront

Description

Get the field-level encryption configuration information.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "NoSuchFieldLevelEncryptionConfig",
  "errorMessage": "The specified field level encryption config does not exist.",
  "eventCategory": "Management",
  "eventID": "8ac4111c-2b18-412f-8b29-baac48d56311",
  "eventName": "GetFieldLevelEncryption",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:54Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "97802cae-127c-4f93-8eb8-21b1d748d086",
  "requestParameters": {
    "id": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetFieldLevelEncryptionConfig

Service: cloudfront

Description

Get the field-level encryption configuration information.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "NoSuchFieldLevelEncryptionConfig",
  "errorMessage": "The specified field level encryption config does not exist.",
  "eventCategory": "Management",
  "eventID": "792757c9-cd40-4634-b076-3859dc643d0e",
  "eventName": "GetFieldLevelEncryptionConfig",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:54Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "079a66eb-04bb-451e-90ff-d2bb3fe668d5",
  "requestParameters": {
    "id": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetFieldLevelEncryptionProfile

Service: cloudfront

Description

Get the field-level encryption profile information.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "NoSuchFieldLevelEncryptionProfile",
  "errorMessage": "The specified field level encryption profile does not exist.",
  "eventCategory": "Management",
  "eventID": "95e6cf23-365c-4918-aee9-e58c233e6cf4",
  "eventName": "GetFieldLevelEncryptionProfile",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:54Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "e021a89b-95ed-4fb0-98e7-f550582c30ee",
  "requestParameters": {
    "id": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetFieldLevelEncryptionProfileConfig

Service: cloudfront

Description

Get the field-level encryption profile configuration information.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "NoSuchFieldLevelEncryptionProfile",
  "errorMessage": "The specified field level encryption profile does not exist.",
  "eventCategory": "Management",
  "eventID": "ff21e270-0587-4147-8885-5a1f099b868c",
  "eventName": "GetFieldLevelEncryptionProfileConfig",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:54Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "ad483fb2-d65f-4c23-801a-0ede594e2c91",
  "requestParameters": {
    "id": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetFunction

Service: cloudfront

Description

Gets the code of a CloudFront function.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "NoSuchFunctionExists",
  "errorMessage": "The specified function does not exist.",
  "eventCategory": "Management",
  "eventID": "280ebe3a-d2f9-4ac8-a01a-fd19370992ea",
  "eventName": "GetFunction",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:54Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "e3c57c8e-9a99-4387-bf08-7aecd806b588",
  "requestParameters": {
    "name": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetInvalidation

Service: cloudfront

Description

Get the information about an invalidation.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "NoSuchDistribution",
  "errorMessage": "The specified distribution does not exist.",
  "eventCategory": "Management",
  "eventID": "4fca75b6-2c99-433f-90ad-900a974ac58e",
  "eventName": "GetInvalidation",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:54Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "0e46a82a-e08a-454d-94fb-d7a5449cb98e",
  "requestParameters": {
    "distributionId": "dw-probe",
    "id": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetInvalidationForDistributionTenant

Service: cloudfront

Description

Gets information about a specific invalidation for a distribution tenant.

CloudTrail logs this operation under the eventName GetInvalidationForDistributionTenant2020_05_31; the catalog keys on the SDK operation name GetInvalidationForDistributionTenant. A detection rule may use either name.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "EntityNotFound",
  "errorMessage": "DistributionTenantId format is invalid",
  "eventCategory": "Management",
  "eventID": "6737a9c8-ade3-40af-91b5-a31f1f961662",
  "eventName": "GetInvalidationForDistributionTenant2020_05_31",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:54Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "c553afff-0a6e-47b1-b8b6-e34a3a81ac48",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetKeyGroup

Service: cloudfront

Description

Gets a key group, including the date and time when the key group was last modified.

CloudTrail logs this operation under the eventName GetKeyGroup2020_05_31; the catalog keys on the SDK operation name GetKeyGroup. A detection rule may use either name.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "NoSuchResource",
  "errorMessage": "Id format is invalid",
  "eventCategory": "Management",
  "eventID": "15212c1e-9745-4fbf-b48d-db3c5afe6ebf",
  "eventName": "GetKeyGroup2020_05_31",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:54Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "3442824b-832d-4b46-ad67-a1244e4ff8e5",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetKeyGroupConfig

Service: cloudfront

Description

Gets a key group configuration.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "NoSuchResource",
  "errorMessage": "The specified key group does not exist.",
  "eventCategory": "Management",
  "eventID": "cdc30cd5-a823-4027-ad9f-415251bdcf23",
  "eventName": "GetKeyGroupConfig",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:54Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "07cf0e03-c7d8-4db1-bb50-bd07672a1280",
  "requestParameters": {
    "id": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetManagedCertificateDetails

Service: cloudfront

Description

Gets details about the CloudFront managed ACM certificate.

CloudTrail logs this operation under the eventName GetManagedCertificateDetails2020_05_31; the catalog keys on the SDK operation name GetManagedCertificateDetails. A detection rule may use either name.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "EntityNotFound",
  "errorMessage": "The specified distribution tenant doesn't exist.",
  "eventCategory": "Management",
  "eventID": "53733582-45e9-4c78-8347-9f53eadaf7dc",
  "eventName": "GetManagedCertificateDetails2020_05_31",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:55Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "4fb78db3-64b9-48cd-a8e6-8973e653cb98",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetMonitoringSubscription

Service: cloudfront

Description

Gets information about whether additional CloudWatch metrics are enabled for the specified CloudFront distribution.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "NoSuchDistribution",
  "errorMessage": "The specified distribution does not exist.",
  "eventCategory": "Management",
  "eventID": "2c8af643-d727-48c0-afc8-5a3e820dab9e",
  "eventName": "GetMonitoringSubscription",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:55Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "d12caa68-0d84-4c2c-9c7a-f75b7f2b22da",
  "requestParameters": {
    "distributionId": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetOriginAccessControl

Service: cloudfront

Description

Gets a CloudFront origin access control, including its unique identifier.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "NoSuchOriginAccessControl",
  "errorMessage": "The specified origin access control does not exist.",
  "eventCategory": "Management",
  "eventID": "70282c1f-ec74-4da6-b1d0-4899bc537876",
  "eventName": "GetOriginAccessControl",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:55Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "34a509e7-b023-474a-a56d-b0a3be6afe66",
  "requestParameters": {
    "id": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetOriginAccessControlConfig

Service: cloudfront

Description

Gets a CloudFront origin access control configuration.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "NoSuchOriginAccessControl",
  "errorMessage": "The specified origin access control does not exist.",
  "eventCategory": "Management",
  "eventID": "adecec41-a031-4380-86cb-9210df563d35",
  "eventName": "GetOriginAccessControlConfig",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:55Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "779dc12a-f58c-4f91-8e02-846de6d7c227",
  "requestParameters": {
    "id": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetOriginRequestPolicy

Service: cloudfront

Description

Gets an origin request policy, including the following metadata: The policy's identifier.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "NoSuchOriginRequestPolicy",
  "errorMessage": "The specified origin request policy does not exist.",
  "eventCategory": "Management",
  "eventID": "3be31610-495f-4070-8d22-94e5a4e7f222",
  "eventName": "GetOriginRequestPolicy",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:55Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "18197800-93c4-4a10-a5df-35932bf6c469",
  "requestParameters": {
    "id": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetOriginRequestPolicyConfig

Service: cloudfront

Description

Gets an origin request policy configuration.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "NoSuchOriginRequestPolicy",
  "errorMessage": "The specified origin request policy does not exist.",
  "eventCategory": "Management",
  "eventID": "2bc2346d-de7d-461f-b646-a61b1debf1a1",
  "eventName": "GetOriginRequestPolicyConfig",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:55Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "87d1120d-4c38-4248-ad5e-5f0dfac3aedf",
  "requestParameters": {
    "id": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetPublicKey

Service: cloudfront

Description

Get the public key information.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "NoSuchPublicKey",
  "errorMessage": "The specified CloudFront public key does not exist.",
  "eventCategory": "Management",
  "eventID": "ded53ec9-e1b4-4cad-8b4f-c116f5a97a4e",
  "eventName": "GetPublicKey",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:55Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "ed3474b3-2d19-42ae-a369-0d4451a3c8ea",
  "requestParameters": {
    "id": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetPublicKeyConfig

Service: cloudfront

Description

Return public key configuration informaation

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "NoSuchPublicKey",
  "errorMessage": "The specified CloudFront public key does not exist.",
  "eventCategory": "Management",
  "eventID": "68ce9b85-8bcd-4624-94fc-bed4c392f81a",
  "eventName": "GetPublicKeyConfig",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:55Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "8bb6efb8-06fc-424d-93a2-5a900535af83",
  "requestParameters": {
    "id": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetRealtimeLogConfig

Service: cloudfront

Description

Gets a real-time log configuration.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "InvalidArgument",
  "errorMessage": "The parameter Name/ARN must be provided.",
  "eventCategory": "Management",
  "eventID": "c65bb2c5-4c19-4309-9ebb-e743f8f8677a",
  "eventName": "GetRealtimeLogConfig",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:31:32Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "44363213-bfac-4171-a080-563a7e4774d4",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetResourcePolicy

Service: cloudfront

Description

Retrieves the resource policy for the specified CloudFront resource that you own and have shared.

CloudTrail logs this operation under the eventName GetResourcePolicy2020_05_31; the catalog keys on the SDK operation name GetResourcePolicy. A detection rule may use either name.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "InvalidArgument",
  "errorMessage": "ARNs must start with 'arn:'",
  "eventCategory": "Management",
  "eventID": "58282808-ebd1-4c57-b272-f036c02463e4",
  "eventName": "GetResourcePolicy2020_05_31",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:55Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "6f02c2a3-7c91-4c06-837f-60c8082d6301",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetResponseHeadersPolicy

Service: cloudfront

Description

Gets a response headers policy, including metadata (the policy's identifier and the date and time when the policy was last modified).

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "NoSuchResponseHeadersPolicy",
  "errorMessage": "The specified response headers policy does not exist.",
  "eventCategory": "Management",
  "eventID": "33e893ba-1513-4066-97e5-2048f570ef3a",
  "eventName": "GetResponseHeadersPolicy",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:56Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "6079cc23-9bc7-4d9c-b20e-1bfec39ae9a7",
  "requestParameters": {
    "id": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetResponseHeadersPolicyConfig

Service: cloudfront

Description

Gets a response headers policy configuration.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "NoSuchResponseHeadersPolicy",
  "errorMessage": "The specified response headers policy does not exist.",
  "eventCategory": "Management",
  "eventID": "c81ce3c7-233d-4abf-b5c3-97d2b75cff0a",
  "eventName": "GetResponseHeadersPolicyConfig",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:56Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "849ce6e5-bab8-42e3-b58a-336e830906ec",
  "requestParameters": {
    "id": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetStreamingDistribution

Service: cloudfront

Description

Get the information about a streaming distribution.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "NoSuchStreamingDistribution",
  "errorMessage": "The specified streaming distribution does not exist.",
  "eventCategory": "Management",
  "eventID": "93941c6c-2e47-42af-88c4-3637b14b526c",
  "eventName": "GetStreamingDistribution",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:56Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "4f34f8b9-a12f-4a11-9f4f-d02a576055df",
  "requestParameters": {
    "id": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetStreamingDistributionConfig

Service: cloudfront

Description

Get the configuration information about a streaming distribution.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "NoSuchStreamingDistribution",
  "errorMessage": "The specified streaming distribution does not exist.",
  "eventCategory": "Management",
  "eventID": "f3cc4c6f-248d-4e35-97f4-29813c764a11",
  "eventName": "GetStreamingDistributionConfig",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:56Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "75589f67-db30-4662-9d7a-13dd31ef7181",
  "requestParameters": {
    "id": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetTrustStore

Service: cloudfront

Description

Gets a trust store.

CloudTrail logs this operation under the eventName GetTrustStore2020_05_31; the catalog keys on the SDK operation name GetTrustStore. A detection rule may use either name.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "EntityNotFound",
  "errorMessage": "The specified trust store does not exist.",
  "eventCategory": "Management",
  "eventID": "d77140f0-f402-4168-ac7f-4ba9c943c54f",
  "eventName": "GetTrustStore2020_05_31",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:56Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "1e35e681-7853-4a3d-8576-aa539915c443",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetVpcOrigin

Service: cloudfront

Description

Get the details of an Amazon CloudFront VPC origin.

CloudTrail logs this operation under the eventName GetVpcOrigin2020_05_31; the catalog keys on the SDK operation name GetVpcOrigin. A detection rule may use either name.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "InvalidArgument",
  "errorMessage": "Id format is invalid",
  "eventCategory": "Management",
  "eventID": "87dc56b5-e30c-43b2-8919-71fee6885dbc",
  "eventName": "GetVpcOrigin2020_05_31",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:56Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "1cc95e5b-b4a5-4337-bf4b-e908aab1a657",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListAnycastIpLists

Service: cloudfront

Description

Lists your Anycast static IP lists.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "2389e176-f551-4e68-ac0d-a080e0b2a246",
  "eventName": "ListAnycastIpLists",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:31:33Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "b8ecc192-fe4f-4ce6-bd7f-190c8a5c0c8f",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListCachePolicies

Service: cloudfront

Description

Gets a list of cache policies.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "8233f22f-d2fe-4fd0-bf0c-30220a731c20",
  "eventName": "ListCachePolicies",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:31:33Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "2fd2d4f3-a7a5-4cb5-a703-dfc69dc16003",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListCloudFrontOriginAccessIdentities

Service: cloudfront

Description

List origin access identities.

Example CloudTrail Event #

{
  "apiVersion": "2016_11_25",
  "awsRegion": "us-east-1",
  "eventID": "68a4c5c5-77ac-43d7-8507-8a19303b6080",
  "eventName": "ListCloudFrontOriginAccessIdentities",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2017-02-20T00:28:05Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.03",
  "recipientAccountId": "811596193553",
  "requestID": "65928-f703-11e6-b121-7ba1e752738a",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "255.253.125.115",
  "userAgent": "console.amazonaws.com",
  "userIdentity": {
    "accessKeyId": "ASIAJMSH5T0Q30UARNB7",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:root",
    "principalId": "811596193553",
    "sessionContext": {
      "attributes": {
        "creationDate": "2017-02-19T15:37:15Z",
        "mfaAuthenticated": "true"
      }
    },
    "type": "Root"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

ListConflictingAliases

Service: cloudfront

Description

The ListConflictingAliases API operation only supports standard distributions.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "NoSuchDistribution",
  "errorMessage": "The specified distribution does not exist.",
  "eventCategory": "Management",
  "eventID": "824b6578-cbe2-4bac-905b-fff55d2c45a6",
  "eventName": "ListConflictingAliases",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:57Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "f3515337-304b-4024-a647-6825bd7a30e5",
  "requestParameters": {
    "alias": "dw-probe",
    "distributionId": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListConnectionFunctions

Service: cloudfront

Description

Lists connection functions.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "c53f11d6-5c5c-4811-bf02-e826b3b3bd7b",
  "eventName": "ListConnectionFunctions",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:31:33Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "ffb0beba-cc6a-4981-a1d7-5211b23124b1",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListConnectionGroups

Service: cloudfront

Description

Lists the connection groups in your Amazon Web Services account.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "ae35004a-d950-4934-8ee2-95172c839a2d",
  "eventName": "ListConnectionGroups",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:31:33Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "2a0292d4-1816-4df2-b561-a241db30dc4f",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListContinuousDeploymentPolicies

Service: cloudfront

Description

Gets a list of the continuous deployment policies in your Amazon Web Services account.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "a373e837-c20f-4029-8308-9df05385376a",
  "eventName": "ListContinuousDeploymentPolicies",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:31:33Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "ba29882c-5e22-4e7b-9d18-ce32b156dbbd",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListDistributions

Service: cloudfront

Description

List distributions.

CloudTrail logs this operation under the eventName ListDistributions2020_05_31; the catalog keys on the SDK operation name ListDistributions. A detection rule may use either name.

Example CloudTrail Event #

{
  "apiVersion": "2019_03_26",
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "172d9a90-87a0-4f27-9b82-5e2dbb65707f",
  "eventName": "ListDistributions",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2021-04-13T13:24:52Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "760111141337",
  "requestID": "a398a476-d7b5-48df-920d-c7af5bca17bb",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "95.9.125.40",
  "userAgent": "Boto3/1.14.6 Python/3.9.4 Darwin/20.3.0 Botocore/1.17.6",
  "userIdentity": {
    "accessKeyId": "AKIAYTOGP2RLIXX7QSZR",
    "accountId": "760111141337",
    "arn": "arn:aws:iam::760111141337:user/cloudmapper",
    "principalId": "AIDAYTOGP2RLK32EB7QZV",
    "type": "IAMUser",
    "userName": "cloudmapper"
  }
}

References #

Sample log: splunk/attack_data

ListDistributionsByAnycastIpListId

Service: cloudfront

Description

Lists the distributions in your account that are associated with the specified AnycastIpListId.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "EntityNotFound",
  "errorMessage": "The specified Anycast IP list does not exist",
  "eventCategory": "Management",
  "eventID": "b632d847-433a-4de7-a23a-5edb70584e8f",
  "eventName": "ListDistributionsByAnycastIpListId",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:57Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "22b17d90-5a10-487a-800f-82ff087af4b7",
  "requestParameters": {
    "anycastIpListId": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListDistributionsByCachePolicyId

Service: cloudfront

Description

Gets a list of distribution IDs for distributions that have a cache behavior that's associated with the specified cache policy.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "NoSuchCachePolicy",
  "errorMessage": "The specified cache policy does not exist.",
  "eventCategory": "Management",
  "eventID": "0c8c010b-e4fe-4d3b-85c0-31a8a712fd87",
  "eventName": "ListDistributionsByCachePolicyId",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:57Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "19615265-4095-46f6-9356-0dfbe02d8c84",
  "requestParameters": {
    "cachePolicyId": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListDistributionsByConnectionFunction

Service: cloudfront

Description

Lists distributions by connection function.

CloudTrail logs this operation under the eventName ListDistributionsByConnectionFunction2020_05_31; the catalog keys on the SDK operation name ListDistributionsByConnectionFunction. A detection rule may use either name.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "EntityNotFound",
  "errorMessage": "The specified connection function does not exist.",
  "eventCategory": "Management",
  "eventID": "530f5049-3898-49d4-a7da-d980d83ffb15",
  "eventName": "ListDistributionsByConnectionFunction2020_05_31",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:57Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "648102c2-97af-49c1-8fad-b9d1fee6b357",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListDistributionsByConnectionMode

Service: cloudfront

Description

Lists the distributions by the connection mode that you specify.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "b6e23b83-0912-428b-a7e2-f9efac2488ba",
  "eventName": "ListDistributionsByConnectionMode",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:57Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "3886fbed-9b94-40f7-b718-ee89f34e2617",
  "requestParameters": {
    "connectionMode": "direct"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListDistributionsByKeyGroup

Service: cloudfront

Description

Gets a list of distribution IDs for distributions that have a cache behavior that references the specified key group.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "NoSuchResource",
  "errorMessage": "The specified key group does not exist.",
  "eventCategory": "Management",
  "eventID": "b7b6bf07-157b-4fe0-b4d3-5c150ef010ed",
  "eventName": "ListDistributionsByKeyGroup",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:57Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "0c1de901-341b-414b-95e3-d9d1006e39f1",
  "requestParameters": {
    "keyGroupId": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListDistributionsByOriginRequestPolicyId

Service: cloudfront

Description

Gets a list of distribution IDs for distributions that have a cache behavior that's associated with the specified origin request policy.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "NoSuchOriginRequestPolicy",
  "errorMessage": "The specified origin request policy does not exist.",
  "eventCategory": "Management",
  "eventID": "f75a1efb-bc73-45d2-a963-4fa26d8b7840",
  "eventName": "ListDistributionsByOriginRequestPolicyId",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:58Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "e378413f-2818-488a-b93d-82b6cd6bd5b5",
  "requestParameters": {
    "originRequestPolicyId": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListDistributionsByOwnedResource

Service: cloudfront

Description

Lists the CloudFront distributions that are associated with the specified resource that you own.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "InvalidArgument",
  "errorMessage": "Resource has invalid syntax: ARNs must start with 'arn:': dw-probe",
  "eventCategory": "Management",
  "eventID": "7112eacd-d1a7-42e5-b4e2-abe316a01d3f",
  "eventName": "ListDistributionsByOwnedResource",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:58Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "d8635a4c-b170-4ae7-8b6c-e520563fece5",
  "requestParameters": {
    "resourceArn": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListDistributionsByRealtimeLogConfig

Service: cloudfront

Description

Gets a list of distributions that have a cache behavior that's associated with the specified real-time log configuration.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "InvalidArgument",
  "errorMessage": "Name or ARN must be provided.",
  "eventCategory": "Management",
  "eventID": "0999cbea-8d24-4625-a419-6380b43db1d1",
  "eventName": "ListDistributionsByRealtimeLogConfig",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:31:33Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "be92ba26-17de-45e5-816e-83c303d38f15",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListDistributionsByResponseHeadersPolicyId

Service: cloudfront

Description

Gets a list of distribution IDs for distributions that have a cache behavior that's associated with the specified response headers policy.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "NoSuchResponseHeadersPolicy",
  "errorMessage": "The specified response headers policy does not exist.",
  "eventCategory": "Management",
  "eventID": "d8b844da-d95f-43c7-a419-7a678861aacc",
  "eventName": "ListDistributionsByResponseHeadersPolicyId",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:58Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "c0ca5bc6-a8e0-4aa5-bdad-bc9e98cfc8a9",
  "requestParameters": {
    "responseHeadersPolicyId": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListDistributionsByTrustStore

Service: cloudfront

Description

Lists distributions by trust store.

CloudTrail logs this operation under the eventName ListDistributionsByTrustStore2020_05_31; the catalog keys on the SDK operation name ListDistributionsByTrustStore. A detection rule may use either name.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "EntityNotFound",
  "errorMessage": "The specified trust store does not exist.",
  "eventCategory": "Management",
  "eventID": "1a18876c-6a49-47e2-92f6-dd28e87267ef",
  "eventName": "ListDistributionsByTrustStore2020_05_31",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:58Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "29ff51e3-bfd2-4207-9cff-d073f94500b6",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListDistributionsByVpcOriginId

Service: cloudfront

Description

List CloudFront distributions by their VPC origin ID.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "EntityNotFound",
  "errorMessage": "The specified vpc origin does not exist",
  "eventCategory": "Management",
  "eventID": "86c3ffe5-4043-4cef-bacd-9a94804fef29",
  "eventName": "ListDistributionsByVpcOriginId",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:58Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "9e4f8507-0c66-4e6d-9b30-3e22fb122baf",
  "requestParameters": {
    "vpcOriginId": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListDistributionsByWebACLId

Service: cloudfront

Description

List the distributions that are associated with a specified AWS WAF web ACL.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "95f86d9a-4e06-4b68-af3f-b52fb9b45453",
  "eventName": "ListDistributionsByWebACLId",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:58Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "e0147770-5fa0-462d-b7cc-868b749b309c",
  "requestParameters": {
    "webACLId": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListDistributionTenants

Service: cloudfront

Description

Lists the distribution tenants in your Amazon Web Services account.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "dd2d4049-451c-4d24-a27c-bd334f52cb47",
  "eventName": "ListDistributionTenants",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:31:34Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "66aa05ff-f10c-4516-8368-8eb7e34281b7",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListDistributionTenantsByCustomization

Service: cloudfront

Description

Lists distribution tenants by the customization that you specify.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "InvalidArgument",
  "errorMessage": "Exactly one customization filter must be set.",
  "eventCategory": "Management",
  "eventID": "f1854f77-4c33-47f8-9fc6-107408a34880",
  "eventName": "ListDistributionTenantsByCustomization",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:31:34Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "62658336-61de-4147-b2a8-69f21b75d8c2",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListDomainConflicts

Service: cloudfront

Description

We recommend that you use the ListDomainConflicts API operation to check for domain conflicts, as it supports both standard distributions and distribution tenants.

CloudTrail logs this operation under the eventName ListDomainConflicts2020_05_31; the catalog keys on the SDK operation name ListDomainConflicts. A detection rule may use either name.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "InvalidArgument",
  "errorMessage": "Your request must specify all required parameters.",
  "eventCategory": "Management",
  "eventID": "e21b1011-5ecd-4e29-b9a5-9069948c449b",
  "eventName": "ListDomainConflicts2020_05_31",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:58Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "0e1bcaad-ec8c-4c09-9003-97e958ab87eb",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListFieldLevelEncryptionConfigs

Service: cloudfront

Description

List all field-level encryption configurations that have been created in CloudFront for this account.

Example CloudTrail Event #

{
  "apiVersion": "2019_03_26",
  "awsRegion": "us-east-1",
  "eventID": "70626d-19a2-4a7d-90f3-e3729b6fdc3d",
  "eventName": "ListFieldLevelEncryptionConfigs",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2020-03-06T14:33:24Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "dd53885-b8e7-432e-a870-492269e2c179f",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "0.35.92.20",
  "userAgent": "Boto3/1.12.15 Python/2.7.17 Linux/4.4.0-039049-Microsoft Botocore/1.15.15",
  "userIdentity": {
    "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/Level6",
    "principalId": "AIDADO2GQD0K8TEF7KW1V",
    "type": "IAMUser",
    "userName": "Level6"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

ListFieldLevelEncryptionProfiles

Service: cloudfront

Description

Request a list of field-level encryption profiles that have been created in CloudFront for this account.

Example CloudTrail Event #

{
  "apiVersion": "2019_03_26",
  "awsRegion": "us-east-1",
  "eventID": "31a366036-fbbe-4b13-a379-7cbf5b0ded71",
  "eventName": "ListFieldLevelEncryptionProfiles",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2020-03-06T14:33:23Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "931b579b-4d75-4d8f-9cc6-45e4e7624f15",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "0.35.92.20",
  "userAgent": "Boto3/1.12.15 Python/2.7.17 Linux/4.4.0-039049-Microsoft Botocore/1.15.15",
  "userIdentity": {
    "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/Level6",
    "principalId": "AIDADO2GQD0K8TEF7KW1V",
    "type": "IAMUser",
    "userName": "Level6"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

ListFunctions

Service: cloudfront

Description

Gets a list of all CloudFront functions in your Amazon Web Services account.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "406753c8-aa15-4ba3-9aae-816cd2fdfb96",
  "eventName": "ListFunctions",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:31:34Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "7c09fe16-e502-4a73-9b79-380bb29c754a",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListInvalidations

Service: cloudfront

Description

List invalidation batches.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "NoSuchDistribution",
  "errorMessage": "The specified distribution does not exist.",
  "eventCategory": "Management",
  "eventID": "56e83e6b-1a2e-4a87-836c-996cd6f34307",
  "eventName": "ListInvalidations",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:59Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "7a3a1a33-3b4e-43c5-b9fd-d8dcec1afbfd",
  "requestParameters": {
    "distributionId": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListInvalidationsForDistributionTenant

Service: cloudfront

Description

Lists the invalidations for a distribution tenant.

CloudTrail logs this operation under the eventName ListInvalidationsForDistributionTenant2020_05_31; the catalog keys on the SDK operation name ListInvalidationsForDistributionTenant. A detection rule may use either name.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "InvalidArgument",
  "errorMessage": "Id format is invalid",
  "eventCategory": "Management",
  "eventID": "c0126647-1ebb-4b1a-9cfe-255938a0799f",
  "eventName": "ListInvalidationsForDistributionTenant2020_05_31",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:42:59Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "4054438f-6416-4701-aadc-a7fb1028dbf7",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListKeyGroups

Service: cloudfront

Description

Gets a list of key groups.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "334b0fab-7fe5-4313-a2ad-89723eb0d892",
  "eventName": "ListKeyGroups",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:31:35Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "e578dc56-62d0-4ccf-bf28-0542ebf5ec6e",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListKeyValueStores

Service: cloudfront

Description

Specifies the key value stores to list.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "a37bf84e-8e0e-496c-af68-b5264d56dc79",
  "eventName": "ListKeyValueStores",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:31:35Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "7905dd01-198d-49d9-a2eb-1e1428fbfbc0",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListOriginAccessControls

Service: cloudfront

Description

Gets the list of CloudFront origin access controls (OACs) in this Amazon Web Services account.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "48d6461b-9740-43d6-ac80-0ed70609b76f",
  "eventName": "ListOriginAccessControls",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:31:35Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "3c9ed270-dcad-4947-a14d-f86ca5423c5d",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListOriginRequestPolicies

Service: cloudfront

Description

Gets a list of origin request policies.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "7e6968de-c90f-451c-80c8-a584485fd8fe",
  "eventName": "ListOriginRequestPolicies",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:31:35Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "ca4376d6-11fa-4e16-aa5c-f40e2b1eb39e",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListPublicKeys

Service: cloudfront

Description

List all public keys that have been added to CloudFront for this account.

Example CloudTrail Event #

{
  "apiVersion": "2019_03_26",
  "awsRegion": "us-east-1",
  "eventID": "b7b310a3-c0f7-4b2b-95ca-a39b116f9640",
  "eventName": "ListPublicKeys",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2020-04-07T14:43:59Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "ca700875e-827e-4841-9769-bc8afd646903a",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "7.254.2.234",
  "userAgent": "aws-cli/2.0.6 Python/3.8.2 Darwin/18.7.0 botocore/2.0.0dev10",
  "userIdentity": {
    "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/Level6",
    "principalId": "AIDADO2GQD0K8TEF7KW1V",
    "type": "IAMUser",
    "userName": "Level6"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

ListRealtimeLogConfigs

Service: cloudfront

Description

Gets a list of real-time log configurations.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "1ab6b534-7e28-4fcb-a7c3-b7a22bf05e66",
  "eventName": "ListRealtimeLogConfigs",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:31:35Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "08878bc3-c5f2-4086-b48e-bc9c73cdd6b9",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListResponseHeadersPolicies

Service: cloudfront

Description

Gets a list of response headers policies.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "4732dcdc-8826-4884-ab83-1a3dedac8b62",
  "eventName": "ListResponseHeadersPolicies",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:31:35Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "86ab3ab5-debe-45a3-8af2-53bc14e13dfc",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListStreamingDistributions

Service: cloudfront

Description

List streaming distributions.

Example CloudTrail Event #

{
  "apiVersion": "2016_11_25",
  "awsRegion": "us-east-1",
  "eventID": "9ac226548-3a3e-4248-b713-e45d20a204a9",
  "eventName": "ListStreamingDistributions",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2017-02-20T00:27:18Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.03",
  "recipientAccountId": "811596193553",
  "requestID": "5651e8f8-f703-11e6-bfc4-271e0a81248d",
  "requestParameters": {
    "maxItems": "100"
  },
  "responseElements": null,
  "sourceIPAddress": "255.253.125.115",
  "userAgent": "console.amazonaws.com",
  "userIdentity": {
    "accessKeyId": "ASIAJMSH5T0Q30UARNB7",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:root",
    "principalId": "811596193553",
    "sessionContext": {
      "attributes": {
        "creationDate": "2017-02-19T15:37:15Z",
        "mfaAuthenticated": "true"
      }
    },
    "type": "Root"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

ListTagsForResource

Service: cloudfront

Description

List tags for a CloudFront resource.

CloudTrail logs this operation under the eventName ListTagsForResource2020_05_31; the catalog keys on the SDK operation name ListTagsForResource. A detection rule may use either name.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "InvalidArgument",
  "errorMessage": "Invalid vendor (received: iam, expected: cloudfront)",
  "eventCategory": "Management",
  "eventID": "a7706ce3-2355-4993-87a5-63efd854bff5",
  "eventName": "ListTagsForResource2020_05_31",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:43:00Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "085e5f01-3a9a-4476-a010-f1c7edbaf8bf",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListTrustStores

Service: cloudfront

Description

Lists trust stores.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "5de0ec63-027e-4f59-bbd8-a244c5aeb5a7",
  "eventName": "ListTrustStores",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:31:35Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "6d916f72-bbf1-4b1e-8731-64b1e8a7cb3a",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListVpcOrigins

Service: cloudfront

Description

List the CloudFront VPC origins in your account.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "822a206f-0133-42a7-a664-6a6560452fb9",
  "eventName": "ListVpcOrigins",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T18:31:35Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "c33dceac-9652-4ca5-b474-fae50712a38f",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

PublishConnectionFunction

Service: cloudfront

Description

Publishes a connection function.

PublishFunction

Service: cloudfront

Description

Publishes a CloudFront function by copying the function code from the DEVELOPMENT stage to LIVE.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "57ef78b2-8d2f-4e6b-8832-f2c407a6c858",
  "eventName": "PublishFunction",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T20:59:45Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "93c90df8-fb51-41ae-90f7-6d53c0d97271",
  "requestParameters": {
    "ifMatch": "E3UN6WX5RRO2AG",
    "name": "dwfix-cf-fn"
  },
  "responseElements": {
    "functionSummary": {
      "functionConfig": {
        "comment": "dwfix test CF function - updated comment",
        "runtime": "cloudfront-js-2.0"
      },
      "functionMetadata": {
        "createdTime": "2026-06-29T20:59:45Z",
        "functionARN": "arn:aws:cloudfront::123456789012:function/dwfix-cf-fn",
        "lastModifiedTime": "2026-06-29T20:59:45Z",
        "stage": "LIVE"
      },
      "name": "dwfix-cf-fn",
      "status": "UNASSOCIATED"
    }
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,D,Z,n cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

PutResourcePolicy

Service: cloudfront

Description

Creates a resource control policy for a given CloudFront resource.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "InvalidArgument",
  "errorMessage": "The specified resource type isn't valid. Specify a VPC origin and try again.",
  "eventCategory": "Management",
  "eventID": "292a54eb-91a5-4195-87b3-5cb37f360d60",
  "eventName": "PutResourcePolicy",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T20:59:47Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "6b6e18d0-35e9-4d7d-837b-6094c82fcb3d",
  "requestParameters": {
    "policyDocument": {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Principal": {
            "Service": "cloudfront.amazonaws.com"
          },
          "Action": [
            "cloudfront-keyvaluestore:DescribeKeyValueStore"
          ],
          "Resource": "arn:aws:cloudfront::123456789012:key-value-store/2c6216a2-4ea4-4e36-bb4e-7b8016ba4ae2"
        }
      ]
    },
    "resourceArn": "arn:aws:cloudfront::123456789012:key-value-store/2c6216a2-4ea4-4e36-bb4e-7b8016ba4ae2"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,D,Z,n cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

TagResource

Service: cloudfront

Description

Add tags to a CloudFront resource.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "5cc499f5-1de6-4927-b2b0-b2db46ae3095",
  "eventName": "TagResource",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T20:59:47Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "6f9cc105-9b70-4cd2-b00e-472ffa58829d",
  "requestParameters": {
    "resource": "arn:aws:cloudfront::123456789012:key-value-store/2c6216a2-4ea4-4e36-bb4e-7b8016ba4ae2",
    "tags": {
      "items": [
        {
          "key": "dwfix",
          "value": "cf-kvs-test"
        },
        {
          "key": "tier",
          "value": "test"
        }
      ]
    }
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,D,Z,n cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

TestConnectionFunction

Service: cloudfront

Description

Tests a connection function.

TestFunction

Service: cloudfront

Description

Tests a CloudFront function.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "TestFunctionFailed",
  "errorMessage": "The test returned an unexpected result.",
  "eventCategory": "Management",
  "eventID": "b9b1efb7-cc2b-4066-b618-3160bc4cf542",
  "eventName": "TestFunction",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T20:59:43Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "8b005121-eabe-4896-b674-852066787893",
  "requestParameters": {
    "eventObject": "HIDDEN_DUE_TO_SECURITY_REASONS",
    "ifMatch": "ETVPDKIKX0DER",
    "name": "dwfix-cf-fn",
    "stage": "DEVELOPMENT"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,D,Z,n cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UntagResource

Service: cloudfront

Description

Remove tags from a CloudFront resource.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "8c6d596f-5904-468c-9a3c-2735cff25570",
  "eventName": "UntagResource",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T20:59:48Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "55e926cd-ef44-4765-bc0f-8e9c778ca198",
  "requestParameters": {
    "resource": "arn:aws:cloudfront::123456789012:key-value-store/2c6216a2-4ea4-4e36-bb4e-7b8016ba4ae2",
    "tagKeys": {
      "items": [
        "tier"
      ]
    }
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,D,Z,n cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateAnycastIpList

Service: cloudfront

Description

Updates an Anycast static IP list.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "InvalidIfMatchVersion",
  "errorMessage": "The If-Match version is missing or not valid for the resource.",
  "eventCategory": "Management",
  "eventID": "963f6660-e1c7-4b64-9ebd-b1b243e4e2da",
  "eventName": "UpdateAnycastIpList",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T19:22:02Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "d701f277-75c5-4593-8e11-23121a11844f",
  "requestParameters": {
    "id": "dw-probe",
    "ifMatch": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateCachePolicy

Service: cloudfront

Description

Updates a cache policy configuration.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "InvalidIfMatchVersion",
  "errorMessage": "The If-Match version is missing or not valid for the resource.",
  "eventCategory": "Management",
  "eventID": "dddd6ccc-da13-449b-bb8d-bd88f4571b9b",
  "eventName": "UpdateCachePolicy",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T19:22:03Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "9fc65099-ada0-4fe4-aa09-dcd450a570df",
  "requestParameters": {
    "cachePolicyConfig": {
      "minTTL": 1,
      "name": "dw-probe"
    },
    "id": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateCloudFrontOriginAccessIdentity

Service: cloudfront

Description

Update an origin access identity.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "InvalidIfMatchVersion",
  "errorMessage": "The If-Match version is missing or not valid for the resource.",
  "eventCategory": "Management",
  "eventID": "0504e8f0-e421-4904-ab22-1ffb62f69f1f",
  "eventName": "UpdateCloudFrontOriginAccessIdentity",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T19:22:03Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "58c5c5c3-7e87-4582-9fd4-b62a28cf2c9c",
  "requestParameters": {
    "cloudFrontOriginAccessIdentityConfig": {
      "callerReference": "dw-probe",
      "comment": "dw-probe"
    },
    "id": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateConnectionFunction

Service: cloudfront

Description

Updates a connection function.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "InvalidIfMatchVersion",
  "errorMessage": "The If-Match version is missing or not valid for the resource.",
  "eventCategory": "Management",
  "eventID": "c25d72da-594e-42ea-be72-d7bdd2dbbfd8",
  "eventName": "UpdateConnectionFunction",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T19:22:03Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "615d6828-37c6-4d01-be1b-cbbe79256c04",
  "requestParameters": {
    "connectionFunctionCode": "HIDDEN_DUE_TO_SECURITY_REASONS",
    "connectionFunctionConfig": {
      "comment": "dw-probe",
      "runtime": "cloudfront-js-1.0"
    },
    "id": "ddddd",
    "ifMatch": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateConnectionGroup

Service: cloudfront

Description

Updates a connection group.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "6e9cdf05-36fe-4485-9cbc-8c1495494a32",
  "eventName": "UpdateConnectionGroup",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T20:59:49Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "a4d2f899-118b-4888-9da2-773614d76888",
  "requestParameters": {
    "enabled": true,
    "id": "cg_3FpKtxBfd0NlEcNmajQLoLbZUlq",
    "ifMatch": "E23ZP02F085DFQ",
    "ipv6Enabled": true
  },
  "responseElements": {
    "connectionGroup": {
      "arn": "arn:aws:cloudfront::123456789012:connection-group/cg_3FpKtxBfd0NlEcNmajQLoLbZUlq",
      "createdTime": "2026-06-29T20:59:49Z",
      "enabled": true,
      "id": "cg_3FpKtxBfd0NlEcNmajQLoLbZUlq",
      "ipv6Enabled": true,
      "isDefault": false,
      "lastModifiedTime": "2026-06-29T20:59:49Z",
      "name": "dwfix-cf-cg",
      "routingEndpoint": "d33kykkl2rz74j.cloudfront.net",
      "status": "InProgress"
    },
    "eTag": "ETVPDKIKX0DER"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,D,Z,n cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateContinuousDeploymentPolicy

Service: cloudfront

Description

Updates a continuous deployment policy.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "InvalidIfMatchVersion",
  "errorMessage": "The If-Match version is missing or not valid for the resource.",
  "eventCategory": "Management",
  "eventID": "ab5f80c2-dc6a-42b3-980d-7dda0be56644",
  "eventName": "UpdateContinuousDeploymentPolicy",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T19:22:04Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "a1bdf831-ffe2-410c-bc76-69d0527f1f04",
  "requestParameters": {
    "continuousDeploymentPolicyConfig": {
      "enabled": false,
      "stagingDistributionDnsNames": {
        "quantity": 1
      }
    },
    "id": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateDistributionTenant

Service: cloudfront

Description

Updates a distribution tenant.

UpdateDistributionWithStagingConfig

Service: cloudfront

Description

Copies the staging distribution's configuration to its corresponding primary distribution.

UpdateDomainAssociation

Service: cloudfront

Description

We recommend that you use the UpdateDomainAssociation API operation to move a domain association, as it supports both standard distributions and distribution tenants.

UpdateFieldLevelEncryptionConfig

Service: cloudfront

Description

Update a field-level encryption configuration.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "InvalidArgument",
  "errorMessage": "The specified field level encryption config does not exist.",
  "eventCategory": "Management",
  "eventID": "9739334c-76ef-4bbe-a4c6-2ed8ccb4d24b",
  "eventName": "UpdateFieldLevelEncryptionConfig",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T19:22:05Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "6bb3b620-c9e0-4383-81d5-6a39fafe3bca",
  "requestParameters": {
    "fieldLevelEncryptionConfig": {
      "callerReference": "dw-probe"
    },
    "id": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateFieldLevelEncryptionProfile

Service: cloudfront

Description

Update a field-level encryption profile.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "InvalidArgument",
  "errorMessage": "The specified field level encryption profile does not exist.",
  "eventCategory": "Management",
  "eventID": "338f5959-9eb4-4a80-8d99-969678b73365",
  "eventName": "UpdateFieldLevelEncryptionProfile",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T19:22:06Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "144771e4-2089-4f7e-97cd-a8ddc25f8855",
  "requestParameters": {
    "fieldLevelEncryptionProfileConfig": {
      "callerReference": "dw-probe",
      "encryptionEntities": {
        "quantity": 1
      },
      "name": "dw-probe"
    },
    "id": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateFunction

Service: cloudfront

Description

Updates a CloudFront function.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "InvalidIfMatchVersion",
  "errorMessage": "The If-Match version is missing or not valid for the resource.",
  "eventCategory": "Management",
  "eventID": "986cea6c-a38d-4efe-8b51-160188ba0b2e",
  "eventName": "UpdateFunction",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T19:22:06Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "865977c3-b9f1-4eeb-91f5-3018f1c3c476",
  "requestParameters": {
    "functionCode": "HIDDEN_DUE_TO_SECURITY_REASONS",
    "functionConfig": {
      "comment": "dw-probe",
      "runtime": "cloudfront-js-1.0"
    },
    "ifMatch": "dw-probe",
    "name": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateKeyGroup

Service: cloudfront

Description

Updates a key group.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "InvalidIfMatchVersion",
  "errorMessage": "The If-Match version is missing or not valid for the resource.",
  "eventCategory": "Management",
  "eventID": "45cb50e9-5212-4a8e-9414-a59c19bd13de",
  "eventName": "UpdateKeyGroup",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T19:22:07Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "182c6d13-b542-46b7-9e24-6802103bdcf8",
  "requestParameters": {
    "id": "dw-probe",
    "keyGroupConfig": {
      "items": [
        "dw-probe"
      ],
      "name": "dw-probe"
    }
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateKeyValueStore

Service: cloudfront

Description

Specifies the key value store to update.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "23406b23-e5b8-4c2f-a878-dd481408be09",
  "eventName": "UpdateKeyValueStore",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T20:59:47Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "3c21bbdb-ea60-4a53-a331-fce8be3d280d",
  "requestParameters": {
    "comment": "dwfix test KV store - updated comment",
    "ifMatch": "ETVPDKIKX0DER",
    "name": "dwfix-cf-kvs"
  },
  "responseElements": {
    "eTag": "E3UN6WX5RRO2AG",
    "keyValueStore": {
      "aRN": "arn:aws:cloudfront::123456789012:key-value-store/2c6216a2-4ea4-4e36-bb4e-7b8016ba4ae2",
      "comment": "dwfix test KV store - updated comment",
      "id": "2c6216a2-4ea4-4e36-bb4e-7b8016ba4ae2",
      "lastModifiedTime": "2026-06-29T20:59:47Z",
      "name": "dwfix-cf-kvs",
      "status": "PROVISIONING"
    }
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,D,Z,n cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateOriginAccessControl

Service: cloudfront

Description

Updates a CloudFront origin access control.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "InvalidIfMatchVersion",
  "errorMessage": "The If-Match version is missing or not valid for the resource.",
  "eventCategory": "Management",
  "eventID": "f690b92a-e45b-491a-80f1-78de85fbbe96",
  "eventName": "UpdateOriginAccessControl",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T19:22:07Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "abc02e2b-c7c8-4012-ab15-71efaba47d1c",
  "requestParameters": {
    "id": "dw-probe",
    "originAccessControlConfig": {
      "name": "dw-probe",
      "originAccessControlOriginType": "s3",
      "signingBehavior": "never",
      "signingProtocol": "sigv4"
    }
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateOriginRequestPolicy

Service: cloudfront

Description

Updates an origin request policy configuration.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "InvalidIfMatchVersion",
  "errorMessage": "The If-Match version is missing or not valid for the resource.",
  "eventCategory": "Management",
  "eventID": "6a3e298d-720f-4fbc-804b-346f960db4ff",
  "eventName": "UpdateOriginRequestPolicy",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T19:22:08Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "d7b5b740-1b3f-4673-bea8-bc8210a75111",
  "requestParameters": {
    "id": "dw-probe",
    "originRequestPolicyConfig": {
      "cookiesConfig": {
        "cookieBehavior": "none"
      },
      "headersConfig": {
        "headerBehavior": "none"
      },
      "name": "dw-probe",
      "queryStringsConfig": {
        "queryStringBehavior": "none"
      }
    }
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdatePublicKey

Service: cloudfront

Description

Update public key information.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "InvalidArgument",
  "errorMessage": "The specified CloudFront public key does not exist.",
  "eventCategory": "Management",
  "eventID": "69cd4b99-b3cb-4c43-b873-7d2a92891d1e",
  "eventName": "UpdatePublicKey",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T19:22:08Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "43f60e10-e27c-44a7-be88-ac66c4e9e568",
  "requestParameters": {
    "id": "dw-probe",
    "publicKeyConfig": {
      "callerReference": "dw-probe",
      "encodedKey": "dw-probe",
      "name": "dw-probe"
    }
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateRealtimeLogConfig

Service: cloudfront

Description

Updates a real-time log configuration.

UpdateResponseHeadersPolicy

Service: cloudfront

Description

Updates a response headers policy.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "InvalidIfMatchVersion",
  "errorMessage": "The If-Match version is missing or not valid for the resource.",
  "eventCategory": "Management",
  "eventID": "6982c81c-eaa5-4cd4-b706-12d488922b9f",
  "eventName": "UpdateResponseHeadersPolicy",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T19:22:08Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "97ec78fd-28a6-4398-b234-8ecb160863b0",
  "requestParameters": {
    "id": "dw-probe",
    "responseHeadersPolicyConfig": {
      "name": "dw-probe"
    }
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateStreamingDistribution

Service: cloudfront

Description

Update a streaming distribution.

UpdateTrustStore

Service: cloudfront

Description

Updates a trust store.

Example CloudTrail Event #

{
  "apiVersion": "2020_05_31",
  "awsRegion": "us-east-1",
  "errorCode": "InvalidIfMatchVersion",
  "errorMessage": "The If-Match version is missing or not valid for the resource.",
  "eventCategory": "Management",
  "eventID": "9c0ed854-29a0-4005-8457-0d93d8568a0c",
  "eventName": "UpdateTrustStore",
  "eventSource": "cloudfront.amazonaws.com",
  "eventTime": "2026-06-29T19:22:13Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "9a1c21b6-f8f7-454c-a788-5f6bcf36c4c3",
  "requestParameters": {
    "id": "ddddd",
    "ifMatch": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cloudfront.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateVpcOrigin

Service: cloudfront

Description

Update an Amazon CloudFront VPC origin in your account.

VerifyDnsConfiguration

Service: cloudfront

Description

Verify the DNS configuration for your domain names.

ListDistributionsByLambdaFunction

Service: cloudfront

Description

ListDistributionsByLambdaFunction recorded by CloudTrail for Amazon CloudFront. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "c72a9693-32b4-4677-ad34-8a68ceb2ee64",
  "eventSource": "cloudfront.amazonaws.com",
  "eventName": "ListDistributionsByLambdaFunction",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "apiVersion": "2020_05_31",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "1ef4eb5d-0594-496f-922b-973d87e02ef4",
  "userAgent": "replicator.lambda.amazonaws.com"
}