AWS CodeBuild

eventName	Description	Sample	Rule
any	Catch-all entry for AWS CodeBuild rules that match the service but not a specific eventName.	N	N
BatchDeleteBuilds	Deletes one or more builds. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
BatchGetBuildBatches	Retrieves information about one or more batch builds. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
BatchGetBuilds	Gets information about one or more builds. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record.	N	N
BatchGetCommandExecutions	Gets information about the command executions. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
BatchGetFleets	Gets information about one or more compute fleets. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
BatchGetProjects	Gets information about one or more build projects. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record.	N	N
BatchGetReportGroups	Returns an array of report groups. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
BatchGetReports	Returns an array of reports. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
BatchGetSandboxes	Gets information about the sandbox status. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
CreateFleet	Creates a compute fleet. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
CreateProject	Creates a build project. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
CreateReportGroup	Creates a report group. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
CreateWebhook	For an existing CodeBuild build project that has its source code stored in a GitHub or Bitbucket repository, enables CodeBuild to start rebuilding the source code every time a code change is pushed to the repository. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
DeleteBuildBatch	Deletes a batch build. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
DeleteFleet	Deletes a compute fleet. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
DeleteProject	Deletes a build project. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
DeleteReport	Deletes a report. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
DeleteReportGroup	Deletes a report group. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
DeleteResourcePolicy	Deletes a resource policy that is identified by its resource ARN. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
DeleteSourceCredentials	Deletes a set of GitHub, GitHub Enterprise, or Bitbucket source credentials. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
DeleteWebhook	For an existing CodeBuild build project that has its source code stored in a GitHub or Bitbucket repository, stops CodeBuild from rebuilding the source code every time a code change is pushed to the repository. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
DescribeCodeCoverages	Retrieves one or more code coverage reports. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
DescribeTestCases	Returns a list of details about test cases for a report. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
GetReportGroupTrend	Analyzes and accumulates test report values for the specified test reports. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
GetResourcePolicy	Gets a resource policy that is identified by its resource ARN. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
ImportSourceCredentials	Imports the source repository credentials for an CodeBuild project that has its source code stored in a GitHub, GitHub Enterprise, GitLab, GitLab Self Managed, or Bitbucket repository. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
InvalidateProjectCache	Resets the cache for a project. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
ListBuildBatches	Retrieves the identifiers of your build batches in the current region. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record.	N	N
ListBuildBatchesForProject	Retrieves the identifiers of the build batches for a specific project. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
ListBuilds	Gets a list of build IDs, with each build ID representing a single build. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record.	N	N
ListBuildsForProject	Gets a list of build identifiers for the specified build project, with each build identifier representing a single build. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
ListCommandExecutionsForSandbox	Gets a list of command executions for a sandbox. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
ListCuratedEnvironmentImages	Gets information about Docker images that are managed by CodeBuild. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
ListFleets	Gets a list of compute fleet names with each compute fleet name representing a single compute fleet. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
ListProjects	Gets a list of build project names, with each build project name representing a single build project. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
ListReportGroups	Gets a list ARNs for the report groups in the current Amazon Web Services account. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record.	N	N
ListReports	Returns a list of ARNs for the reports in the current Amazon Web Services account. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record.	N	N
ListReportsForReportGroup	Returns a list of ARNs for the reports that belong to a ReportGroup. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
ListSandboxes	Gets a list of sandboxes. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
ListSandboxesForProject	Gets a list of sandboxes for a given project. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
ListSharedProjects	Gets a list of projects that are shared with other Amazon Web Services accounts or users. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
ListSharedReportGroups	Gets a list of report groups that are shared with other Amazon Web Services accounts or users. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
ListSourceCredentials	Returns a list of SourceCredentialsInfo objects. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record.	N	N
PutResourcePolicy	Stores a resource policy for the ARN of a Project or ReportGroup object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
RetryBuild	Restarts a build. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
RetryBuildBatch	Restarts a failed batch build. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
StartBuild	Starts running a build with the settings defined in the project. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record.	N	N
StartBuildBatch	Starts a batch build for a project. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
StartCommandExecution	Starts a command execution. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
StartSandbox	Starts a sandbox. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
StartSandboxConnection	Starts a sandbox connection. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
StopBuild	Attempts to stop running a build. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
StopBuildBatch	Stops a running batch build. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
StopSandbox	Stops a sandbox. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
UpdateFleet	Updates a compute fleet. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
UpdateProject	Changes the settings of a build project. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
UpdateProjectVisibility	Changes the public visibility for a project. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	Y
UpdateReportGroup	Updates a report group. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
UpdateWebhook	Updates the webhook associated with an CodeBuild build project. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
ProcessWebhook	ProcessWebhook recorded by CloudTrail for AWS CodeBuild. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record.	N	N

any: AWS CodeBuild (catch-all)

Service: codebuild

Description

Catch-all entry for AWS CodeBuild rules that match the service but not a specific eventName.

BatchDeleteBuilds

Service: codebuild

Description

Deletes one or more builds. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

BatchGetBuildBatches

Service: codebuild

Description

Retrieves information about one or more batch builds. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

BatchGetBuilds

Service: codebuild

Description

Gets information about one or more builds. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record.

Example CloudTrail Event #

This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.

{
  "eventVersion": "1.11",
  "eventID": "49a27bf4-c5bb-4d66-b435-ed960125ef33",
  "eventSource": "codebuild.amazonaws.com",
  "eventName": "BatchGetBuilds",
  "awsRegion": "ca-central-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "ab58c9aa-0a21-486e-9369-506300904311",
  "userAgent": "states, aws-internal/3 aws-sdk-java/1.12.797 Linux/4.14.355-284.740.amzn2.x86_64 OpenJDK_64-Bit_Server_VM/21.0.12+8-LTS java/21.0.12 kotlin/2.3.21 vendor/Amazon.com_Inc. cfg/retry-mode/standard cfg/auth-source#unknown m/P",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "codebuild.ca-central-1.amazonaws.com"
  }
}

BatchGetCommandExecutions

Service: codebuild

Description

Gets information about the command executions. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

BatchGetFleets

Service: codebuild

Description

Gets information about one or more compute fleets. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

BatchGetProjects

Service: codebuild

Description

Gets information about one or more build projects. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "1fe2365d-15fd-43b2-8e80-50429ea71de9",
  "eventSource": "codebuild.amazonaws.com",
  "eventName": "BatchGetProjects",
  "awsRegion": "ca-central-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "b66774f5-5b69-4f5c-9f5c-469bfeddcb42",
  "userAgent": "aws-sdk-go-v2/1.43.0 ua/2.1 os/linux lang/go#1.26.5 md/GOOS#linux md/GOARCH#arm64 api/codebuild#1.61.2 m/E,i",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "codebuild.ca-central-1.amazonaws.com"
  },
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::CodeBuild::Project",
      "ARN": "arn:aws:codebuild:ca-central-1:123456789012:project/EXAMPLE"
    }
  ]
}

BatchGetReportGroups

Service: codebuild

Description

Returns an array of report groups. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

BatchGetReports

Service: codebuild

Description

Returns an array of reports. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

BatchGetSandboxes

Service: codebuild

Description

Gets information about the sandbox status. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

CreateFleet

Service: codebuild

Description

Creates a compute fleet. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

CreateProject

Service: codebuild

Description

Creates a build project. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

CreateReportGroup

Service: codebuild

Description

Creates a report group. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

CreateWebhook

Service: codebuild

Description

For an existing CodeBuild build project that has its source code stored in a GitHub or Bitbucket repository, enables CodeBuild to start rebuilding the source code every time a code change is pushed to the repository. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

DeleteBuildBatch

Service: codebuild

Description

Deletes a batch build. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

DeleteFleet

Service: codebuild

Description

Deletes a compute fleet. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

DeleteProject

Service: codebuild

Description

Deletes a build project. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

DeleteReport

Service: codebuild

Description

Deletes a report. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

DeleteReportGroup

Service: codebuild

Description

Deletes a report group. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

DeleteResourcePolicy

Service: codebuild

Description

Deletes a resource policy that is identified by its resource ARN. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

DeleteSourceCredentials

Service: codebuild

Description

Deletes a set of GitHub, GitHub Enterprise, or Bitbucket source credentials. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

DeleteWebhook

Service: codebuild

Description

For an existing CodeBuild build project that has its source code stored in a GitHub or Bitbucket repository, stops CodeBuild from rebuilding the source code every time a code change is pushed to the repository. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

DescribeCodeCoverages

Service: codebuild

Description

Retrieves one or more code coverage reports. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

DescribeTestCases

Service: codebuild

Description

Returns a list of details about test cases for a report. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

GetReportGroupTrend

Service: codebuild

Description

Analyzes and accumulates test report values for the specified test reports. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

GetResourcePolicy

Service: codebuild

Description

Gets a resource policy that is identified by its resource ARN. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

ImportSourceCredentials

Service: codebuild

Description

Imports the source repository credentials for an CodeBuild project that has its source code stored in a GitHub, GitHub Enterprise, GitLab, GitLab Self Managed, or Bitbucket repository. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

InvalidateProjectCache

Service: codebuild

Description

Resets the cache for a project. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

ListBuildBatches

Service: codebuild

Description

Retrieves the identifiers of your build batches in the current region. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "9a9f8eee-63e8-4bf7-9fcd-2525008974d7",
  "eventSource": "codebuild.amazonaws.com",
  "eventName": "ListBuildBatches",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "e1c1af78-bed0-4465-8a67-6686561a0ffa",
  "userAgent": "aws-sdk-go/1.54.20 (go1.21.13; linux; amd64)",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "codebuild.us-east-1.amazonaws.com"
  }
}

ListBuildBatchesForProject

Service: codebuild

Description

Retrieves the identifiers of the build batches for a specific project. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

ListBuilds

Service: codebuild

Description

Gets a list of build IDs, with each build ID representing a single build. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "bf31b41a-e295-4990-b279-ca980375ec0f",
  "eventSource": "codebuild.amazonaws.com",
  "eventName": "ListBuilds",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "2c957422-b6b3-4834-ae13-bb0740c79711",
  "userAgent": "Botocore/1.35.95 ua/2.0 os/linux#5.10.245-245.983.amzn2.x86_64 md/arch#x86_64 lang/python#3.9.23 md/pyimpl#CPython cfg/retry-mode#standard",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "codebuild.us-east-1.amazonaws.com"
  }
}

ListBuildsForProject

Service: codebuild

Description

Gets a list of build identifiers for the specified build project, with each build identifier representing a single build. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

ListCommandExecutionsForSandbox

Service: codebuild

Description

Gets a list of command executions for a sandbox. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

ListCuratedEnvironmentImages

Service: codebuild

Description

Gets information about Docker images that are managed by CodeBuild. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

ListFleets

Service: codebuild

Description

Gets a list of compute fleet names with each compute fleet name representing a single compute fleet. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

ListProjects

Service: codebuild

Description

Gets a list of build project names, with each build project name representing a single build project. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

ListReportGroups

Service: codebuild

Description

Gets a list ARNs for the report groups in the current Amazon Web Services account. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "eca26a3f-6797-475c-a313-b6619cda489d",
  "eventSource": "codebuild.amazonaws.com",
  "eventName": "ListReportGroups",
  "awsRegion": "ca-central-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "ac05550b-4b9b-46f8-ad1d-adc6bbc5e05e",
  "userAgent": "config.amazonaws.com"
}

ListReports

Service: codebuild

Description

Returns a list of ARNs for the reports in the current Amazon Web Services account. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "e6c69504-9b75-47a2-891a-ab7d1adb20f5",
  "eventSource": "codebuild.amazonaws.com",
  "eventName": "ListReports",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "bb7e1222-2bd7-4fbc-bf9b-118bfe4e76f1",
  "userAgent": "aws-sdk-go/1.54.20 (go1.21.13; linux; amd64)",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "codebuild.us-east-1.amazonaws.com"
  }
}

ListReportsForReportGroup

Service: codebuild

Description

Returns a list of ARNs for the reports that belong to a ReportGroup. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

ListSandboxes

Service: codebuild

Description

Gets a list of sandboxes. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

ListSandboxesForProject

Service: codebuild

Description

Gets a list of sandboxes for a given project. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

ListSharedProjects

Service: codebuild

Description

Gets a list of projects that are shared with other Amazon Web Services accounts or users. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

ListSharedReportGroups

Service: codebuild

Description

Gets a list of report groups that are shared with other Amazon Web Services accounts or users. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

ListSourceCredentials

Service: codebuild

Description

Returns a list of SourceCredentialsInfo objects. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "b73c34d1-9ede-4b63-ac1c-113935d46064",
  "eventSource": "codebuild.amazonaws.com",
  "eventName": "ListSourceCredentials",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "39c6a954-36ed-4755-87c9-26f9eba2ce5d",
  "userAgent": "aws-sdk-go/1.54.20 (go1.21.13; linux; amd64)",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "codebuild.us-east-1.amazonaws.com"
  }
}

PutResourcePolicy

Service: codebuild

Description

Stores a resource policy for the ARN of a Project or ReportGroup object. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

RetryBuild

Service: codebuild

Description

Restarts a build. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

RetryBuildBatch

Service: codebuild

Description

Restarts a failed batch build. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

StartBuild

Service: codebuild

Description

Starts running a build with the settings defined in the project. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "5cf4af90-8025-4e09-8bfd-8df628d4aca4",
  "eventSource": "codebuild.amazonaws.com",
  "eventName": "StartBuild",
  "awsRegion": "eu-west-1",
  "eventType": "AwsApiCall",
  "readOnly": false,
  "managementEvent": true,
  "requestID": "7bd1c3d5-80e2-437b-869f-a2c2d639369c",
  "userAgent": "states/arn:aws:states:eu-west-1:123456789012:execution:EXAMPLE",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "codebuild.eu-west-1.amazonaws.com"
  }
}

StartBuildBatch

Service: codebuild

Description

Starts a batch build for a project. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

StartCommandExecution

Service: codebuild

Description

Starts a command execution. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

StartSandbox

Service: codebuild

Description

Starts a sandbox. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

StartSandboxConnection

Service: codebuild

Description

Starts a sandbox connection. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

StopBuild

Service: codebuild

Description

Attempts to stop running a build. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

StopBuildBatch

Service: codebuild

Description

Stops a running batch build. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

StopSandbox

Service: codebuild

Description

Stops a sandbox. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

UpdateFleet

Service: codebuild

Description

Updates a compute fleet. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

UpdateProject

Service: codebuild

Description

Changes the settings of a build project. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

UpdateProjectVisibility

Service: codebuild

Description

Changes the public visibility for a project. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

CodeBuild Project made Public source high: An AWS CodeBuild Project was made publicly accessibleT1567

UpdateReportGroup

Service: codebuild

Description

Updates a report group. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

UpdateWebhook

Service: codebuild

Description

Updates the webhook associated with an CodeBuild build project. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

ProcessWebhook

Service: codebuild

Description

ProcessWebhook recorded by CloudTrail for AWS CodeBuild. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "4b0ef682-1b31-442a-8b43-34a7fbc21506",
  "eventSource": "codebuild.amazonaws.com",
  "eventName": "ProcessWebhook",
  "awsRegion": "us-east-1",
  "eventType": "AwsServiceEvent",
  "readOnly": false,
  "managementEvent": true,
  "userAgent": "codebuild.amazonaws.com"
}