DynamoDB

eventName	Description	Sample	Rule
any	Catch-all entry for DynamoDB rules that match the service but not a specific eventName.	N	N
ExportTableToPointInTime	Exports the contents of a DynamoDB table to an Amazon S3 bucket at a specified point in time.	N	Y
ListTables	Returns a paginated list of DynamoDB table names in the current AWS account and region.	Y	Y
Scan	Returns one or more items and item attributes from a DynamoDB table or secondary index by reading every item.	Y	Y
BatchExecuteStatement	This operation allows you to perform batch reads or writes on data stored in DynamoDB, using PartiQL.	Y	N
BatchGetItem	The BatchGetItem operation returns the attributes of one or more items from one or more tables.	N	N
BatchWriteItem	The BatchWriteItem operation puts or deletes multiple items in one or more tables.	Y	N
CreateBackup	Creates a backup for an existing table.	Y	N
CreateGlobalTable	Creates a global table from an existing table.	N	N
CreateTable	The CreateTable operation adds a new table to your account.	Y	N
DeleteBackup	Deletes an existing backup of a table.	Y	N
DeleteItem	Deletes a single item in a table by primary key.	Y	N
DeleteResourcePolicy	Deletes the resource-based policy attached to the resource, which can be a table or stream.	Y	N
DeleteTable	The DeleteTable operation deletes a table and all of its items.	Y	N
DescribeBackup	Describes an existing backup of a table.	N	N
DescribeContinuousBackups	Checks the status of continuous backups and point in time recovery on the specified table.	N	N
DescribeContributorInsights	Returns information about contributor insights for a given table or global secondary index.	N	N
DescribeEndpoints	Returns the regional endpoint information.	Y	N
DescribeExport	Describes an existing table export.	N	N
DescribeGlobalTable	Returns information about the specified global table.	Y	N
DescribeGlobalTableSettings	Describes Region-specific settings for a global table.	Y	N
DescribeImport	Represents the properties of the import.	N	N
DescribeKinesisStreamingDestination	Returns information about the status of Kinesis streaming.	N	N
DescribeLimits	Returns the current provisioned-capacity quotas for your Amazon Web Services account in a Region, both for the Region as a whole and for any one DynamoDB table that you create there.	Y	N
DescribeTable	Returns information about the table, including the current status of the table, when it was created, the primary key schema, and any indexes on the table.	Y	N
DescribeTableReplicaAutoScaling	Describes auto scaling settings across replicas of the global table at once.	N	N
DescribeTimeToLive	Gives a description of the Time to Live (TTL) status on the specified table.	N	N
DisableKinesisStreamingDestination	Stops replication from the DynamoDB table to the Kinesis data stream.	Y	N
EnableKinesisStreamingDestination	Starts table data replication to the specified Kinesis data stream at a timestamp chosen during the enable workflow.	Y	N
ExecuteStatement	This operation allows you to perform reads and singleton writes on data stored in DynamoDB, using PartiQL.	Y	N
ExecuteTransaction	This operation allows you to perform transactional reads or writes on data stored in DynamoDB, using PartiQL.	Y	N
GetItem	The GetItem operation returns a set of attributes for the item with the given primary key.	N	N
GetResourcePolicy	Returns the resource-based policy document attached to the resource, which can be a table or stream, in JSON format.	N	N
ImportTable	Imports table data from an S3 bucket.	N	N
ListBackups	List DynamoDB backups that are associated with an Amazon Web Services account and weren't made with Amazon Web Services Backup.	Y	N
ListContributorInsights	Returns a list of ContributorInsightsSummary for a table and all its global secondary indexes.	Y	N
ListExports	Lists completed exports within the past 90 days, in reverse alphanumeric order of ExportArn.	Y	N
ListGlobalTables	Lists all global tables that have a replica in the specified Region.	Y	N
ListImports	Lists completed imports within the past 90 days.	Y	N
ListTagsOfResource	List all tags on an Amazon DynamoDB resource.	N	N
PutItem	Creates a new item, or replaces an old item with a new item.	Y	N
PutResourcePolicy	Attaches a resource-based policy document to the resource, which can be a table or stream.	Y	N
Query	You must provide the name of the partition key attribute and a single value for that attribute.	N	N
RestoreTableFromBackup	Creates a new table from an existing backup.	Y	N
RestoreTableToPointInTime	Restores the specified table to the specified point in time within EarliestRestorableDateTime and LatestRestorableDateTime.	N	N
TagResource	Associate a set of tags with an Amazon DynamoDB resource.	Y	N
TransactGetItems	TransactGetItems is a synchronous operation that atomically retrieves multiple items from one or more tables (but not from indexes) in a single account and Region.	Y	N
TransactWriteItems	TransactWriteItems is a synchronous write operation that groups up to 100 action requests.	Y	N
UntagResource	Removes the association of tags from an Amazon DynamoDB resource.	Y	N
UpdateContinuousBackups	UpdateContinuousBackups enables or disables point in time recovery for the specified table.	Y	N
UpdateContributorInsights	Updates the status for contributor insights for a specific table or index.	Y	N
UpdateGlobalTable	Adds or removes replicas in the specified global table.	N	N
UpdateGlobalTableSettings	Updates settings for a global table.	Y	N
UpdateItem	Edits an existing item's attributes, or adds a new item to the table if it does not already exist.	Y	N
UpdateKinesisStreamingDestination	The command to update the Kinesis stream destination.	Y	N
UpdateTable	Modifies the provisioned throughput settings, global secondary indexes, or DynamoDB Streams settings for a given table.	Y	N
UpdateTableReplicaAutoScaling	Updates auto scaling settings on your global tables at once.	N	N
UpdateTimeToLive	The UpdateTimeToLive method enables or disables Time to Live (TTL) for the specified table.	Y	N
DescribeStream	DescribeStream recorded by CloudTrail for Amazon DynamoDB. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.	N	N
SearchVectors	Performs a vector similarity search on a vector index associated with an Amazon DynamoDB table, and returns the most similar items sorted by similarity score based on the distance function configured for the index.	N	N

any: DynamoDB (catch-all)

Service: dynamodb

Description

Catch-all entry for DynamoDB rules that match the service but not a specific eventName.

ExportTableToPointInTime

Service: dynamodb

Description

Exports the contents of a DynamoDB table to an Amazon S3 bucket at a specified point in time.

Example CloudTrail Event #

This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.

{
  "eventVersion": "1.11",
  "eventID": "604d149f-e4f1-46bc-bd27-b02a9ea1cb7b",
  "eventSource": "dynamodb.amazonaws.com",
  "eventName": "ExportTableToPointInTime",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "apiVersion": "2012-08-10",
  "readOnly": false,
  "managementEvent": true,
  "requestID": "P97E743DIVCIUT21DC599R3PI7VV4KQNSO5AEMVJF66Q9ASUAAJG",
  "userAgent": "Boto3/1.42.97 md/Botocore#1.42.97 ua/2.1 os/linux#5.10.255-259-299.1043.amzn2.x86_64 md/arch#x86_64 lang/python#3.12.13 md/pyimpl#CPython exec-env/AWS_Lambda_python3.12 m/D,b,P,Z,g cfg/retry-mode#legacy Botocore/1.42.97",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "123456789012.ddb.us-east-1.amazonaws.com"
  },
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::DynamoDB::Table",
      "ARN": "arn:aws:dynamodb:us-east-1:123456789012:table/EXAMPLE"
    }
  ]
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS DynamoDB Table Exported to S3 source high: Identifies when an AWS DynamoDB table is exported to S3. Adversaries may use the ExportTableToPointInTime operation to collect sensitive information or exfiltrate data from DynamoDB tables. This rule detects unusual user activity by monitoring for the ExportTableToPointInTime action in CloudTrail logs. This is a New Terms rule that only flags when this behavior is observed by a user or role for the first time.T1213, T1567, T1567.002

ListTables

Service: dynamodb

Description

Returns a paginated list of DynamoDB table names in the current AWS account and region.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "Root",
    "principalId": "123456789012",
    "arn": "arn:aws:iam::123456789012:root",
    "accountId": "123456789012",
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE"
  },
  "eventTime": "2026-07-28T21:00:05Z",
  "eventSource": "dynamodb.amazonaws.com",
  "eventName": "ListTables",
  "awsRegion": "us-west-1",
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "aws-cli/2.34.28 md/awscrt#0.31.2 ua/2.1 os/linux#6.1.0-51-amd64 md/arch#x86_64 lang/python#3.14.3 md/pyimpl#CPython m/n,Z,E,C,P,b cfg/retry-mode#standard md/installer#exe md/distrib#debian.12 md/prompt#off md/command#dynamodb.list-tables",
  "requestParameters": null,
  "responseElements": null,
  "requestID": "5IU9QGQ5JG6A0UGPJSBNJB0MHJVV4KQNSO5AEMVJF66Q9ASUAAJG",
  "eventID": "1a3e7d0c-e11b-40da-899c-a683d574c9df",
  "readOnly": true,
  "eventType": "AwsApiCall",
  "apiVersion": "2012-08-10",
  "managementEvent": true,
  "recipientAccountId": "123456789012",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "dynamodb.us-west-1.amazonaws.com"
  }
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`aws::userIdentity.arn` (elastic rule field)	is_not_null		1 rule	elastic
`source.as.number` (elastic rule field)	in	`9009`	1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Discovery API Calls from VPN ASN for the First Time by Identity source high: Flags the first time a given IAM principal invokes a narrow set of high-signal discovery APIs (credential check, account and IAM enumeration, bucket and compute inventory, logging introspection) from a source IP whose autonomous system number (ASN) matches a curated set commonly associated with consumer VPN brands, VPN-heavy hosting, and provider networks referenced in public reporting on TeamPCP activity (for example 31173 Services AB AS39351 and Oy Crea Nova Hosting Solution Ltd). Broad List*/Describe* patterns are intentionally omitted to reduce noise. Hosting ASNs are heavily dual-use; validate source.as.number in your data and extend event.action only when your baseline allows it.T1526, T1580

Scan

Service: dynamodb

Description

Returns one or more items and item attributes from a DynamoDB table or secondary index by reading every item.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "Root",
    "principalId": "123456789012",
    "arn": "arn:aws:iam::123456789012:root",
    "accountId": "123456789012",
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE"
  },
  "eventTime": "2026-07-28T21:00:08Z",
  "eventSource": "dynamodb.amazonaws.com",
  "eventName": "Scan",
  "awsRegion": "us-west-1",
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "aws-cli/2.34.28 md/awscrt#0.31.2 ua/2.1 os/linux#6.1.0-51-amd64 md/arch#x86_64 lang/python#3.14.3 md/pyimpl#CPython m/n,Z,E,P,b cfg/retry-mode#standard md/installer#exe md/distrib#debian.12 md/prompt#off md/command#dynamodb.scan",
  "requestParameters": {
    "tableName": "dw-harn-dynamodb-eb786637",
    "limit": 1,
    "consistentRead": false
  },
  "responseElements": null,
  "requestID": "H6HN9OL7KEDG7LV35BP6VRE667VV4KQNSO5AEMVJF66Q9ASUAAJG",
  "eventID": "7143ef19-7b07-48f0-89ca-dd36580cb258",
  "readOnly": true,
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::DynamoDB::Table",
      "ARN": "arn:aws:dynamodb:us-west-1:123456789012:table/dw-harn-dynamodb-eb786637"
    }
  ],
  "eventType": "AwsApiCall",
  "apiVersion": "2012-08-10",
  "managementEvent": false,
  "recipientAccountId": "123456789012",
  "eventCategory": "Data",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "dynamodb.us-west-1.amazonaws.com"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS DynamoDB Scan by Unusual User source low: Identifies when an AWS DynamoDB table is scanned by a user who does not typically perform this action. Adversaries may use the Scan operation to collect sensitive information or exfiltrate data from DynamoDB tables. This rule detects unusual user activity by monitoring for the Scan action in CloudTrail logs. This is a New Terms rule that only flags when this behavior is observed by a user or role for the first time.T1213, T1530, T1567

BatchExecuteStatement

Service: dynamodb

Description

This operation allows you to perform batch reads or writes on data stored in DynamoDB, using PartiQL.

Example CloudTrail Event #

{
  "apiVersion": "2012-08-10",
  "awsRegion": "us-west-1",
  "eventCategory": "Data",
  "eventID": "6e0c9acf-bb0b-4def-885c-a0c284ad56cb",
  "eventName": "BatchExecuteStatement",
  "eventSource": "dynamodb.amazonaws.com",
  "eventTime": "2026-06-29T20:53:39Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": false,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "TCSBH235EBS3F1AUASK2PBC7JJVV4KQNSO5AEMVJF66Q9ASUAAJG",
  "requestParameters": {
    "requestItems": [
      {
        "statement": "INSERT INTO \"dwfix-ddb-main\" VALUE {'pk': 'bes-item1', 'd': ***(Redacted)}"
      },
      {
        "statement": "INSERT INTO \"dwfix-ddb-main\" VALUE {'pk': 'bes-item2', 'd': ***(Redacted)}"
      }
    ],
    "returnConsumedCapacity": "NONE"
  },
  "resources": [
    {
      "ARN": "arn:aws:dynamodb:us-west-1:123456789012:table/dwfix-ddb-main",
      "accountId": "123456789012",
      "type": "AWS::DynamoDB::Table"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "dynamodb.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/P,D,b,Z,n cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

BatchGetItem

Service: dynamodb

Description

The BatchGetItem operation returns the attributes of one or more items from one or more tables.

BatchWriteItem

Service: dynamodb

Description

The BatchWriteItem operation puts or deletes multiple items in one or more tables.

Example CloudTrail Event #

{
  "apiVersion": "2012-08-10",
  "awsRegion": "us-west-1",
  "eventCategory": "Data",
  "eventID": "78476074-308c-4548-84cd-57157cb5ea07",
  "eventName": "BatchWriteItem",
  "eventSource": "dynamodb.amazonaws.com",
  "eventTime": "2026-06-29T20:53:39Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": false,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "UNH111RDUUITNAINDEM0EUJFHRVV4KQNSO5AEMVJF66Q9ASUAAJG",
  "requestParameters": {
    "requestItems": [
      {
        "items": [
          "d",
          "pk"
        ],
        "key": {
          "pk": "bw-item1"
        },
        "operation": "Put",
        "tableName": "dwfix-ddb-main"
      },
      {
        "items": [
          "d",
          "pk"
        ],
        "key": {
          "pk": "bw-item2"
        },
        "operation": "Put",
        "tableName": "dwfix-ddb-main"
      }
    ]
  },
  "resources": [
    {
      "ARN": "arn:aws:dynamodb:us-west-1:123456789012:table/dwfix-ddb-main",
      "accountId": "123456789012",
      "type": "AWS::DynamoDB::Table"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "dynamodb.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/P,D,b,Z,n cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreateBackup

Service: dynamodb

Description

Creates a backup for an existing table.

Example CloudTrail Event #

{
  "apiVersion": "2012-08-10",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "61a6de74-150d-4c0c-ae3c-f9b0038a728e",
  "eventName": "CreateBackup",
  "eventSource": "dynamodb.amazonaws.com",
  "eventTime": "2026-06-29T20:54:00Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "553DIFEV1IH1PNK1307M7GFBCBVV4KQNSO5AEMVJF66Q9ASUAAJG",
  "requestParameters": {
    "backupName": "dwfix-ddb-backup",
    "tableName": "dwfix-ddb-main"
  },
  "resources": [
    {
      "ARN": "arn:aws:dynamodb:us-west-1:123456789012:table/dwfix-ddb-main",
      "accountId": "123456789012",
      "type": "AWS::DynamoDB::Table"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "dynamodb.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/P,D,b,Z,n cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreateGlobalTable

Service: dynamodb

Description

Creates a global table from an existing table.

CreateTable

Service: dynamodb

Description

The CreateTable operation adds a new table to your account.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "Root",
    "principalId": "123456789012",
    "arn": "arn:aws:iam::123456789012:root",
    "accountId": "123456789012",
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE"
  },
  "eventTime": "2026-07-28T20:59:41Z",
  "eventSource": "dynamodb.amazonaws.com",
  "eventName": "CreateTable",
  "awsRegion": "us-west-1",
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "aws-cli/2.34.28 md/awscrt#0.31.2 ua/2.1 os/linux#6.1.0-51-amd64 md/arch#x86_64 lang/python#3.14.3 md/pyimpl#CPython m/n,Z,E,P,b cfg/retry-mode#standard md/installer#exe md/distrib#debian.12 md/prompt#off md/command#dynamodb.create-table",
  "requestParameters": {
    "attributeDefinitions": [
      {
        "attributeType": "S",
        "attributeName": "id"
      }
    ],
    "tableName": "dw-harn-dynamodb-eb786637",
    "keySchema": [
      {
        "keyType": "HASH",
        "attributeName": "id"
      }
    ],
    "billingMode": "PAY_PER_REQUEST"
  },
  "responseElements": {
    "tableDescription": {
      "tableId": "374c2f44-e259-4153-a9fc-c54bb4a4be4e",
      "attributeDefinitions": [
        {
          "attributeType": "S",
          "attributeName": "id"
        }
      ],
      "tableName": "dw-harn-dynamodb-eb786637",
      "tableThroughputModeSummary": {
        "tableThroughputMode": "PAY_PER_REQUEST"
      },
      "itemCount": 0,
      "creationDateTime": "2026-07-28T20:59:41Z",
      "provisionedThroughput": {
        "readCapacityUnits": 0,
        "writeCapacityUnits": 0,
        "numberOfDecreasesToday": 0
      },
      "billingModeSummary": {
        "billingMode": "PAY_PER_REQUEST"
      },
      "tableSizeBytes": 0,
      "tableStatus": "CREATING",
      "keySchema": [
        {
          "keyType": "HASH",
          "attributeName": "id"
        }
      ],
      "tableArn": "arn:aws:dynamodb:us-west-1:123456789012:table/dw-harn-dynamodb-eb786637",
      "deletionProtectionEnabled": false
    }
  },
  "requestID": "93NI0B8T7V9L5HITLGV5VNEDA3VV4KQNSO5AEMVJF66Q9ASUAAJG",
  "eventID": "07181033-81d9-4cac-a198-86681f8a2398",
  "readOnly": false,
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::DynamoDB::Table",
      "ARN": "arn:aws:dynamodb:us-west-1:123456789012:table/dw-harn-dynamodb-eb786637"
    }
  ],
  "eventType": "AwsApiCall",
  "apiVersion": "2012-08-10",
  "managementEvent": true,
  "recipientAccountId": "123456789012",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "dynamodb.us-west-1.amazonaws.com"
  }
}

DeleteBackup

Service: dynamodb

Description

Deletes an existing backup of a table.

Example CloudTrail Event #

{
  "apiVersion": "2012-08-10",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "ddaf11bb-db76-445b-bdc9-36ad506776af",
  "eventName": "DeleteBackup",
  "eventSource": "dynamodb.amazonaws.com",
  "eventTime": "2026-06-29T20:58:01Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "1HQFE3OB60GD956E957CIINC2NVV4KQNSO5AEMVJF66Q9ASUAAJG",
  "requestParameters": {
    "backupArn": "arn:aws:dynamodb:us-west-1:123456789012:table/dwfix-ddb-main/backup/01782766440207-2df07aec"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "123456789012.ddb.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/P,D,b,Z,n cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteItem

Service: dynamodb

Description

Deletes a single item in a table by primary key.

Example CloudTrail Event #

{
  "apiVersion": "2012-08-10",
  "awsRegion": "us-west-1",
  "eventCategory": "Data",
  "eventID": "a8442b78-f9b2-41a7-bdb8-2229bd188964",
  "eventName": "DeleteItem",
  "eventSource": "dynamodb.amazonaws.com",
  "eventTime": "2026-06-29T19:12:18Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": false,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "4KNKAFIK15HJ9DOKQA763E3KQBVV4KQNSO5AEMVJF66Q9ASUAAJG",
  "requestParameters": {
    "key": {
      "id": "1"
    },
    "tableName": "dwfix-t"
  },
  "resources": [
    {
      "ARN": "arn:aws:dynamodb:us-west-1:123456789012:table/dwfix-t",
      "accountId": "123456789012",
      "type": "AWS::DynamoDB::Table"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "dynamodb.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b,P cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteResourcePolicy

Service: dynamodb

Description

Deletes the resource-based policy attached to the resource, which can be a table or stream.

Example CloudTrail Event #

{
  "apiVersion": "2012-08-10",
  "awsRegion": "us-west-1",
  "errorCode": "ResourceInUseException",
  "errorMessage": "Attempt to change a resource which is still in use: Table is pending previous resource-based policy update: dwfix-ddb-main",
  "eventCategory": "Management",
  "eventID": "8a59a67c-602e-4985-826a-daaeda5cb846",
  "eventName": "DeleteResourcePolicy",
  "eventSource": "dynamodb.amazonaws.com",
  "eventTime": "2026-06-29T20:54:00Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "TVLDDEJS2B23TC90D4OT8GH1INVV4KQNSO5AEMVJF66Q9ASUAAJG",
  "requestParameters": {
    "expectedRevisionId": "1782766440504",
    "resourceArn": "arn:aws:dynamodb:us-west-1:123456789012:table/dwfix-ddb-main"
  },
  "resources": [
    {
      "ARN": "arn:aws:dynamodb:us-west-1:123456789012:table/dwfix-ddb-main",
      "accountId": "123456789012",
      "type": "AWS::DynamoDB::Table"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "123456789012.ddb.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/P,D,b,Z,n cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteTable

Service: dynamodb

Description

The DeleteTable operation deletes a table and all of its items.

Example CloudTrail Event #

{
  "apiVersion": "2012-08-10",
  "awsRegion": "us-west-1",
  "errorCode": "ResourceInUseException",
  "errorMessage": "Attempt to change a resource which is still in use: Table tags are being updated: dwfix-t",
  "eventCategory": "Management",
  "eventID": "afd9d4a1-907e-4dfc-86e1-52d2d8f3f22e",
  "eventName": "DeleteTable",
  "eventSource": "dynamodb.amazonaws.com",
  "eventTime": "2026-06-29T19:12:18Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "02Q1ITGGQU3O5SVSAJBIBK4EIFVV4KQNSO5AEMVJF66Q9ASUAAJG",
  "requestParameters": {
    "tableName": "dwfix-t"
  },
  "resources": [
    {
      "ARN": "arn:aws:dynamodb:us-west-1:123456789012:table/dwfix-t",
      "accountId": "123456789012",
      "type": "AWS::DynamoDB::Table"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "dynamodb.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b,P cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DescribeBackup

Service: dynamodb

Description

Describes an existing backup of a table.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "658a2753-aa7a-4a19-a763-ace791d00fec",
  "eventSource": "dynamodb.amazonaws.com",
  "eventName": "DescribeBackup",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "apiVersion": "2012-08-10",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "M5RQ8JEISBIGCMGIIQ0I0EM9D3VV4KQNSO5AEMVJF66Q9ASUAAJG",
  "userAgent": "aws-sdk-go-v2/1.38.1 ua/2.1 os/linux lang/go#1.25.0 md/GOOS#linux md/GOARCH#arm64 exec-env/AWS_ECS_FARGATE api/dynamodb#1.46.0 app/APN_1.1-pc_70z3wc9b95eq8x71w5uctkf9r$ m/E,P,i",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "123456789012.ddb.us-east-1.amazonaws.com"
  }
}

DescribeContinuousBackups

Service: dynamodb

Description

Checks the status of continuous backups and point in time recovery on the specified table.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "4ee50a29-410e-322d-949a-a660a0729c5c",
  "eventSource": "dynamodb.amazonaws.com",
  "eventName": "DescribeContinuousBackups",
  "awsRegion": "ca-central-1",
  "eventType": "AwsApiCall",
  "apiVersion": "2012-08-10",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "5QIH9HNONO7DV40VU5V2SLUFRBVV4KQNSO5AEMVJF66Q9ASUAAJG",
  "userAgent": "aws-sdk-go-v2/1.43.0 ua/2.1 os/linux lang/go#1.26.5 md/GOOS#linux md/GOARCH#arm64 api/dynamodb#1.56.2 m/E,P,i",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "123456789012.ddb.ca-central-1.amazonaws.com"
  },
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::DynamoDB::Table",
      "ARN": "arn:aws:dynamodb:ca-central-1:123456789012:table/EXAMPLE"
    }
  ]
}

DescribeContributorInsights

Service: dynamodb

Description

Returns information about contributor insights for a given table or global secondary index.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "82132cb4-0194-49aa-8100-ed0d5a1d2d8f",
  "eventSource": "dynamodb.amazonaws.com",
  "eventName": "DescribeContributorInsights",
  "awsRegion": "us-east-2",
  "eventType": "AwsApiCall",
  "apiVersion": "2012-08-10",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "95EDDUPI8RIBVEO2J1DHTUBIU3VV4KQNSO5AEMVJF66Q9ASUAAJG",
  "userAgent": "resource-explorer-2.amazonaws.com",
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::DynamoDB::Table",
      "ARN": "arn:aws:dynamodb:us-east-2:123456789012:table/EXAMPLE"
    }
  ]
}

DescribeEndpoints

Service: dynamodb

Description

Returns the regional endpoint information.

Example CloudTrail Event #

{
  "apiVersion": "2012-08-10",
  "awsRegion": "us-east-1",
  "eventID": "56649-fe10-4093-abc7-47ecf8b680bc",
  "eventName": "DescribeEndpoints",
  "eventSource": "dynamodb.amazonaws.com",
  "eventTime": "2018-10-17T20:04:54Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.06",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "811596193553",
  "requestID": "LSTPDT3N15DF0L1C9ILGLNK1UBVV4KQNSO5AEMVJF66Q9ASUAAJG",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "9.245.1.85",
  "userAgent": "Botocore/1.12.25 Python/2.7.15 Linux/4.16.0-kali2-amd64",
  "userIdentity": {
    "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/Level6",
    "principalId": "AIDADO2GQD0K8TEF7KW1V",
    "type": "IAMUser",
    "userName": "Level6"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

DescribeExport

Service: dynamodb

Description

Describes an existing table export.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "22e989d4-5572-44e0-906c-0e5b8c1fb58e",
  "eventSource": "dynamodb.amazonaws.com",
  "eventName": "DescribeExport",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "apiVersion": "2012-08-10",
  "readOnly": false,
  "managementEvent": true,
  "requestID": "I8G32QJ6SC4679CVHVUQCRQ6GJVV4KQNSO5AEMVJF66Q9ASUAAJG",
  "userAgent": "aws-sdk-go-v2/1.43.0 ua/2.1 os/linux lang/go#1.26.5 md/GOOS#linux md/GOARCH#arm64 api/dynamodb#1.56.2 m/E,P,i",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "123456789012.ddb.us-east-1.amazonaws.com"
  }
}

DescribeGlobalTable

Service: dynamodb

Description

Returns information about the specified global table.

Example CloudTrail Event #

{
  "apiVersion": "2012-08-10",
  "awsRegion": "us-west-1",
  "errorCode": "GlobalTableNotFoundException",
  "errorMessage": "Global table not found: Global table with name: 'ddddd' does not exist.",
  "eventCategory": "Management",
  "eventID": "0779b3f1-a84b-484e-9ab9-2124d762ec42",
  "eventName": "DescribeGlobalTable",
  "eventSource": "dynamodb.amazonaws.com",
  "eventTime": "2026-06-29T18:43:09Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "ITI5SGR1880U04ESV7P2E4NGI3VV4KQNSO5AEMVJF66Q9ASUAAJG",
  "requestParameters": {
    "globalTableName": "ddddd"
  },
  "resources": [
    {
      "ARN": "arn:aws:dynamodb:us-west-1:123456789012:table/ddddd",
      "accountId": "123456789012",
      "type": "AWS::DynamoDB::Table"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "dynamodb.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,P,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DescribeGlobalTableSettings

Service: dynamodb

Description

Describes Region-specific settings for a global table.

Example CloudTrail Event #

{
  "apiVersion": "2012-08-10",
  "awsRegion": "us-west-1",
  "errorCode": "GlobalTableNotFoundException",
  "errorMessage": "Global table with name: 'ddddd' does not exist.",
  "eventCategory": "Management",
  "eventID": "6f3fb4fc-8504-4938-9198-2b1ea674edc7",
  "eventName": "DescribeGlobalTableSettings",
  "eventSource": "dynamodb.amazonaws.com",
  "eventTime": "2026-06-29T18:43:09Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "4PH7VGROE54UL7E5KAFU1UPVHNVV4KQNSO5AEMVJF66Q9ASUAAJG",
  "requestParameters": {
    "globalTableName": "ddddd"
  },
  "resources": [
    {
      "ARN": "arn:aws:dynamodb:us-west-1:123456789012:table/ddddd",
      "accountId": "123456789012",
      "type": "AWS::DynamoDB::Table"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "dynamodb.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,P,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DescribeImport

Service: dynamodb

Description

Represents the properties of the import.

DescribeKinesisStreamingDestination

Service: dynamodb

Description

Returns information about the status of Kinesis streaming.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "330d9ec5-615e-4bc1-8867-f0d365c54726",
  "eventSource": "dynamodb.amazonaws.com",
  "eventName": "DescribeKinesisStreamingDestination",
  "awsRegion": "eu-west-1",
  "eventType": "AwsApiCall",
  "apiVersion": "2012-08-10",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "FS7UF5QOJ0SMLRAQ1I5SL6H02NVV4KQNSO5AEMVJF66Q9ASUAAJG",
  "userAgent": "aws-sdk-go-v2/1.43.0 ua/2.1 os/linux lang/go#1.26.5 md/GOOS#linux md/GOARCH#arm64 api/dynamodb#1.56.2 m/E,P,i",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "123456789012.ddb.eu-west-1.amazonaws.com"
  },
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::DynamoDB::Table",
      "ARN": "arn:aws:dynamodb:eu-west-1:123456789012:table/EXAMPLE"
    }
  ]
}

DescribeLimits

Service: dynamodb

Description

Returns the current provisioned-capacity quotas for your Amazon Web Services account in a Region, both for the Region as a whole and for any one DynamoDB table that you create there.

Example CloudTrail Event #

{
  "apiVersion": "2012-08-10",
  "awsRegion": "ap-northeast-1",
  "eventID": "c97494ed-1579-48ae-962c-eb4b63af3fca",
  "eventName": "DescribeLimits",
  "eventSource": "dynamodb.amazonaws.com",
  "eventTime": "2018-10-16T20:30:20Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.06",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "811596193553",
  "requestID": "MR3BRKCNI36185K8KVSVLPEBJVV4KQNSO5AEMVJF66Q9ASUAAJG",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "support.amazonaws.com",
  "userAgent": "support.amazonaws.com",
  "userIdentity": {
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:root",
    "invokedBy": "support.amazonaws.com",
    "principalId": "811596193553",
    "type": "Root",
    "userName": "flaws"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

DescribeTable

Service: dynamodb

Description

Returns information about the table, including the current status of the table, when it was created, the primary key schema, and any indexes on the table.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "AssumedRole",
    "principalId": "AROAEXAMPLE00000000:resource-explorer-2",
    "arn": "arn:aws:sts::123456789012:assumed-role/AWSServiceRoleForResourceExplorer/resource-explorer-2",
    "accountId": "123456789012",
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "sessionContext": {
      "sessionIssuer": {
        "type": "Role",
        "principalId": "AROAEXAMPLE00000000",
        "arn": "arn:aws:iam::123456789012:role/aws-service-role/resource-explorer-2.amazonaws.com/AWSServiceRoleForResourceExplorer",
        "accountId": "123456789012",
        "userName": "AWSServiceRoleForResourceExplorer"
      },
      "attributes": {
        "creationDate": "2026-07-28T21:01:18Z",
        "mfaAuthenticated": "false"
      }
    },
    "invokedBy": "resource-explorer-2.amazonaws.com"
  },
  "eventTime": "2026-07-28T21:01:18Z",
  "eventSource": "dynamodb.amazonaws.com",
  "eventName": "DescribeTable",
  "awsRegion": "us-west-1",
  "sourceIPAddress": "resource-explorer-2.amazonaws.com",
  "userAgent": "resource-explorer-2.amazonaws.com",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "Requested resource not found: Table: dw-harn-dynamodb-eb786637 not found",
  "requestParameters": {
    "tableName": "arn:aws:dynamodb:us-west-1:123456789012:table/dw-harn-dynamodb-eb786637"
  },
  "responseElements": null,
  "requestID": "B13E7BB06633U60QKIMR8S0GEBVV4KQNSO5AEMVJF66Q9ASUAAJG",
  "eventID": "3ccca318-b9e8-4cc8-830e-498d009d6eee",
  "readOnly": true,
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::DynamoDB::Table",
      "ARN": "arn:aws:dynamodb:us-west-1:123456789012:table/dw-harn-dynamodb-eb786637"
    }
  ],
  "eventType": "AwsApiCall",
  "apiVersion": "2012-08-10",
  "managementEvent": true,
  "recipientAccountId": "123456789012",
  "eventCategory": "Management"
}

DescribeTableReplicaAutoScaling

Service: dynamodb

Description

Describes auto scaling settings across replicas of the global table at once.

DescribeTimeToLive

Service: dynamodb

Description

Gives a description of the Time to Live (TTL) status on the specified table.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "d9df24d7-32ee-375f-846a-546cb690eb6e",
  "eventSource": "dynamodb.amazonaws.com",
  "eventName": "DescribeTimeToLive",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "apiVersion": "2012-08-10",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "PV1424PK4T22KLR0EBUBFNTU73VV4KQNSO5AEMVJF66Q9ASUAAJG",
  "userAgent": "aws-sdk-java/2.46.17 md/io#sync md/http#UrlConnection ua/2.1 api/DynamoDB#2.46.x os/Linux#5.10.255-259-299.1043.amzn2.aarch64 lang/java#21.0.11 md/OpenJDK_64-Bit_Server_VM#21.0.11+10-LTS md/vendor#Amazon.com_Inc. md/en_US exec-env/AWS_Lambda_java21 m/D,P,AK,g",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "dynamodb.us-east-1.amazonaws.com"
  },
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::DynamoDB::Table",
      "ARN": "arn:aws:dynamodb:us-east-1:123456789012:table/EXAMPLE"
    }
  ]
}

DisableKinesisStreamingDestination

Service: dynamodb

Description

Stops replication from the DynamoDB table to the Kinesis data stream.

Example CloudTrail Event #

{
  "apiVersion": "2012-08-10",
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "Table is not in a valid state to enable Kinesis Streaming Destination: KinesisStreamingDestination must be ACTIVE to perform DISABLE operation.",
  "eventCategory": "Management",
  "eventID": "bdf713cb-b4aa-4728-a7b9-c7c9a08b4ac5",
  "eventName": "DisableKinesisStreamingDestination",
  "eventSource": "dynamodb.amazonaws.com",
  "eventTime": "2026-06-29T20:54:00Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "V62FA12CITDCP2E44TJDUDG2CRVV4KQNSO5AEMVJF66Q9ASUAAJG",
  "requestParameters": {
    "streamArn": "arn:aws:kinesis:us-west-1:123456789012:stream/dwfix-kinesis-ddb",
    "tableName": "dwfix-ddb-main"
  },
  "resources": [
    {
      "ARN": "arn:aws:dynamodb:us-west-1:123456789012:table/dwfix-ddb-main",
      "accountId": "123456789012",
      "type": "AWS::DynamoDB::Table"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "dynamodb.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/P,D,b,Z,n cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

EnableKinesisStreamingDestination

Service: dynamodb

Description

Starts table data replication to the specified Kinesis data stream at a timestamp chosen during the enable workflow.

Example CloudTrail Event #

{
  "apiVersion": "2012-08-10",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "2a7c7325-42cd-479e-9d27-6a4964d166b2",
  "eventName": "EnableKinesisStreamingDestination",
  "eventSource": "dynamodb.amazonaws.com",
  "eventTime": "2026-06-29T20:54:00Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "5RL3LEOLVD9FJ47K9Q63171R5BVV4KQNSO5AEMVJF66Q9ASUAAJG",
  "requestParameters": {
    "enableKinesisStreamingConfiguration": {
      "approximateCreationDateTimePrecision": "MILLISECOND"
    },
    "streamArn": "arn:aws:kinesis:us-west-1:123456789012:stream/dwfix-kinesis-ddb",
    "tableName": "dwfix-ddb-main"
  },
  "resources": [
    {
      "ARN": "arn:aws:dynamodb:us-west-1:123456789012:table/dwfix-ddb-main",
      "accountId": "123456789012",
      "type": "AWS::DynamoDB::Table"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "dynamodb.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/P,D,b,Z,n cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ExecuteStatement

Service: dynamodb

Description

This operation allows you to perform reads and singleton writes on data stored in DynamoDB, using PartiQL.

Example CloudTrail Event #

{
  "apiVersion": "2012-08-10",
  "awsRegion": "us-west-1",
  "eventCategory": "Data",
  "eventID": "7de3dfc0-d0a0-48ad-8582-c29d12c7b8a3",
  "eventName": "ExecuteStatement",
  "eventSource": "dynamodb.amazonaws.com",
  "eventTime": "2026-06-29T20:53:39Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": false,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "1V2VHUAUT2A8EU59BB9UQFBFF7VV4KQNSO5AEMVJF66Q9ASUAAJG",
  "requestParameters": {
    "statement": "INSERT INTO \"dwfix-ddb-main\" VALUE {'pk': 'es-item1', 'd': ***(Redacted)}"
  },
  "resources": [
    {
      "ARN": "arn:aws:dynamodb:us-west-1:123456789012:table/dwfix-ddb-main",
      "accountId": "123456789012",
      "type": "AWS::DynamoDB::Table"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "dynamodb.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/P,D,b,Z,n cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ExecuteTransaction

Service: dynamodb

Description

This operation allows you to perform transactional reads or writes on data stored in DynamoDB, using PartiQL.

Example CloudTrail Event #

{
  "apiVersion": "2012-08-10",
  "awsRegion": "us-west-1",
  "eventCategory": "Data",
  "eventID": "7d0d8d55-2220-47de-963a-2d018778928e",
  "eventName": "ExecuteTransaction",
  "eventSource": "dynamodb.amazonaws.com",
  "eventTime": "2026-06-29T20:53:39Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": false,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "1T6794I93657JILP92MPMVMMG3VV4KQNSO5AEMVJF66Q9ASUAAJG",
  "requestParameters": {
    "requestItems": [
      {
        "statement": "INSERT INTO \"dwfix-ddb-main\" VALUE {'pk': 'et-item1', 'd': ***(Redacted)}"
      }
    ]
  },
  "resources": [
    {
      "ARN": "arn:aws:dynamodb:us-west-1:123456789012:table/dwfix-ddb-main",
      "accountId": "123456789012",
      "type": "AWS::DynamoDB::Table"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "dynamodb.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/P,D,b,Z,n cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetItem

Service: dynamodb

Description

The GetItem operation returns a set of attributes for the item with the given primary key.

GetResourcePolicy

Service: dynamodb

Description

Returns the resource-based policy document attached to the resource, which can be a table or stream, in JSON format.

ImportTable

Service: dynamodb

Description

Imports table data from an S3 bucket.

ListBackups

Service: dynamodb

Description

List DynamoDB backups that are associated with an Amazon Web Services account and weren't made with Amazon Web Services Backup.

Example CloudTrail Event #

{
  "apiVersion": "2012-08-10",
  "awsRegion": "us-east-1",
  "eventID": "e8267c64-29c7-46ed-8dd7-e185d498095fe",
  "eventName": "ListBackups",
  "eventSource": "dynamodb.amazonaws.com",
  "eventTime": "2018-11-24T21:10:07Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.06",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "811596193553",
  "requestID": "ILTDPNCVTEN3AI09L20TBVA53JVV4KQNSO5AEMVJF66Q9ASUAAJG",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "16.12.99.2",
  "userAgent": "Boto3/1.7.4 Python/3.6.5 Linux/4.15.0-39-generic Botocore/1.10.4",
  "userIdentity": {
    "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/Level6",
    "principalId": "AIDADO2GQD0K8TEF7KW1V",
    "type": "IAMUser",
    "userName": "Level6"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

ListContributorInsights

Service: dynamodb

Description

Returns a list of ContributorInsightsSummary for a table and all its global secondary indexes.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: dynamodb:ListContributorInsights on resource: arn:aws:dynamodb:us-east-1:811596193553:table/*",
  "eventCategory": "Management",
  "eventID": "b52697ac-b290-4fc8-97d5-904ff7b208105",
  "eventName": "ListContributorInsights",
  "eventSource": "dynamodb.amazonaws.com",
  "eventTime": "2020-06-10T05:30:35Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.07",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "811596193553",
  "requestID": "BPMGH7A7QT6EMGG2BLD3K8QUHRVV4KQNSO5AEMVJF66Q9ASUAAJG",
  "requestParameters": null,
  "resources": [],
  "responseElements": null,
  "sourceIPAddress": "251.105.254.1",
  "userAgent": "Botocore/1.16.26 Python/2.7.18 Linux/5.4.0-2-amd64",
  "userIdentity": {
    "accessKeyId": "AKIA01U43UX3RBRDXF4Q",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/backup",
    "principalId": "AIDA9BO36HFBHKGJAO9C1",
    "type": "IAMUser",
    "userName": "backup"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

ListExports

Service: dynamodb

Description

Lists completed exports within the past 90 days, in reverse alphanumeric order of ExportArn.

Example CloudTrail Event #

{
  "apiVersion": "2012-08-10",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "f9083c90-5cb5-4503-a991-957ed6ec23bc",
  "eventName": "ListExports",
  "eventSource": "dynamodb.amazonaws.com",
  "eventTime": "2026-06-29T18:31:45Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "7EQMPHL85R0LOQS20R86C7SAM3VV4KQNSO5AEMVJF66Q9ASUAAJG",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "dynamodb.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b,P cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListGlobalTables

Service: dynamodb

Description

Lists all global tables that have a replica in the specified Region.

Example CloudTrail Event #

{
  "apiVersion": "2012-08-10",
  "awsRegion": "us-east-1",
  "eventID": "fb43d3b2-b32a-4b7e-b146-32ab803438df",
  "eventName": "ListGlobalTables",
  "eventSource": "dynamodb.amazonaws.com",
  "eventTime": "2018-11-24T21:10:07Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.06",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "811596193553",
  "requestID": "TA2TG26R8CAT55L0OLLKIUUNM3VV4KQNSO5AEMVJF66Q9ASUAAJG",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "16.12.99.2",
  "userAgent": "Boto3/1.7.4 Python/3.6.5 Linux/4.15.0-39-generic Botocore/1.10.4",
  "userIdentity": {
    "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/Level6",
    "principalId": "AIDADO2GQD0K8TEF7KW1V",
    "type": "IAMUser",
    "userName": "Level6"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

ListImports

Service: dynamodb

Description

Lists completed imports within the past 90 days.

Example CloudTrail Event #

{
  "apiVersion": "2012-08-10",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "230529ab-9bd7-4053-ab23-11b69f71e4e8",
  "eventName": "ListImports",
  "eventSource": "dynamodb.amazonaws.com",
  "eventTime": "2026-06-29T18:31:45Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "RAVBTU3M7H0PRBHGBQQCRJJFGNVV4KQNSO5AEMVJF66Q9ASUAAJG",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "dynamodb.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b,P cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListTagsOfResource

Service: dynamodb

Description

List all tags on an Amazon DynamoDB resource.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "fd72d3c9-247a-4273-a546-4e0dfdead476",
  "eventSource": "dynamodb.amazonaws.com",
  "eventName": "ListTagsOfResource",
  "awsRegion": "ap-southeast-2",
  "eventType": "AwsApiCall",
  "apiVersion": "2012-08-10",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "BN4MI6UAJ0N9G33HABATHDAODBVV4KQNSO5AEMVJF66Q9ASUAAJG",
  "userAgent": "aws-sdk-go-v2/1.38.1 ua/2.1 os/linux lang/go#1.25.0 md/GOOS#linux md/GOARCH#arm64 exec-env/AWS_ECS_FARGATE api/dynamodb#1.46.0 app/APN_1.1-pc_70z3wc9b95eq8x71w5uctkf9r$ m/E,P,i",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "123456789012.ddb.ap-southeast-2.amazonaws.com"
  },
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::DynamoDB::Table",
      "ARN": "arn:aws:dynamodb:ap-southeast-2:123456789012:table/EXAMPLE"
    }
  ]
}

PutItem

Service: dynamodb

Description

Creates a new item, or replaces an old item with a new item.

Example CloudTrail Event #

{
  "apiVersion": "2012-08-10",
  "awsRegion": "us-west-1",
  "eventCategory": "Data",
  "eventID": "f05c87ca-da84-4348-9e5a-e7866f460f31",
  "eventName": "PutItem",
  "eventSource": "dynamodb.amazonaws.com",
  "eventTime": "2026-06-29T19:12:18Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": false,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "VRE0ALN809V715KRDEO2RFA8D3VV4KQNSO5AEMVJF66Q9ASUAAJG",
  "requestParameters": {
    "items": [
      "id"
    ],
    "key": {
      "id": "1"
    },
    "tableName": "dwfix-t"
  },
  "resources": [
    {
      "ARN": "arn:aws:dynamodb:us-west-1:123456789012:table/dwfix-t",
      "accountId": "123456789012",
      "type": "AWS::DynamoDB::Table"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "dynamodb.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b,P cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

PutResourcePolicy

Service: dynamodb

Description

Attaches a resource-based policy document to the resource, which can be a table or stream.

Example CloudTrail Event #

{
  "apiVersion": "2012-08-10",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "5378cd26-9389-4ff4-80b2-465bcb5b4487",
  "eventName": "PutResourcePolicy",
  "eventSource": "dynamodb.amazonaws.com",
  "eventTime": "2026-06-29T20:54:00Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "NIKNG68NM7ND25K3E5EGAGFNMNVV4KQNSO5AEMVJF66Q9ASUAAJG",
  "requestParameters": {
    "confirmRemoveSelfResourceAccess": false,
    "policy": {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Sid": "DwSampleCollector",
          "Effect": "Allow",
          "Principal": {
            "AWS": "arn:aws:iam::123456789012:root"
          },
          "Action": [
            "dynamodb:GetItem",
            "dynamodb:PutItem"
          ],
          "Resource": "arn:aws:dynamodb:us-west-1:123456789012:table/dwfix-ddb-main"
        }
      ]
    },
    "resourceArn": "arn:aws:dynamodb:us-west-1:123456789012:table/dwfix-ddb-main"
  },
  "resources": [
    {
      "ARN": "arn:aws:dynamodb:us-west-1:123456789012:table/dwfix-ddb-main",
      "accountId": "123456789012",
      "type": "AWS::DynamoDB::Table"
    }
  ],
  "responseElements": {
    "revisionId": "1782766440504"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "123456789012.ddb.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/P,D,b,Z,n cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Query

Service: dynamodb

Description

You must provide the name of the partition key attribute and a single value for that attribute.

RestoreTableFromBackup

Service: dynamodb

Description

Creates a new table from an existing backup.

Example CloudTrail Event #

{
  "apiVersion": "2012-08-10",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "0ab48b5e-386d-420a-a108-739f3c209127",
  "eventName": "RestoreTableFromBackup",
  "eventSource": "dynamodb.amazonaws.com",
  "eventTime": "2026-06-29T20:54:00Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "DBLH7ACI9O82R3T69TMRBBM2LRVV4KQNSO5AEMVJF66Q9ASUAAJG",
  "requestParameters": {
    "backupArn": "arn:aws:dynamodb:us-west-1:123456789012:table/dwfix-ddb-main/backup/01782766440207-2df07aec",
    "billingModeOverride": "PAY_PER_REQUEST",
    "targetTableName": "dwfix-ddb-restored"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "dynamodb.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/P,D,b,Z,n cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

RestoreTableToPointInTime

Service: dynamodb

Description

Restores the specified table to the specified point in time within EarliestRestorableDateTime and LatestRestorableDateTime.

TagResource

Service: dynamodb

Description

Associate a set of tags with an Amazon DynamoDB resource.

Example CloudTrail Event #

{
  "apiVersion": "2012-08-10",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "16609622-aea1-47d8-833e-9affdbf52caa",
  "eventName": "TagResource",
  "eventSource": "dynamodb.amazonaws.com",
  "eventTime": "2026-06-29T19:12:17Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "LRAFN10G2ENVJGE2JLGJR47RQFVV4KQNSO5AEMVJF66Q9ASUAAJG",
  "requestParameters": {
    "resourceArn": "arn:aws:dynamodb:us-west-1:123456789012:table/dwfix-t",
    "tags": [
      {
        "key": "dw",
        "value": "f"
      }
    ]
  },
  "resources": [
    {
      "ARN": "arn:aws:dynamodb:us-west-1:123456789012:table/dwfix-t",
      "accountId": "123456789012",
      "type": "AWS::DynamoDB::Table"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "123456789012.ddb.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b,P cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

TransactGetItems

Service: dynamodb

Description

TransactGetItems is a synchronous operation that atomically retrieves multiple items from one or more tables (but not from indexes) in a single account and Region.

Example CloudTrail Event #

{
  "apiVersion": "2012-08-10",
  "awsRegion": "us-west-1",
  "eventCategory": "Data",
  "eventID": "49a58b43-ab7e-4993-b22c-4df0c6089d2d",
  "eventName": "TransactGetItems",
  "eventSource": "dynamodb.amazonaws.com",
  "eventTime": "2026-06-29T20:53:39Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": false,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "AC2496P2K2OSR949N3HM025O57VV4KQNSO5AEMVJF66Q9ASUAAJG",
  "requestParameters": {
    "requestItems": [
      {
        "key": {
          "pk": "bw-item1"
        },
        "operation": "Get",
        "tableName": "dwfix-ddb-main"
      },
      {
        "key": {
          "pk": "tw-item1"
        },
        "operation": "Get",
        "tableName": "dwfix-ddb-main"
      }
    ]
  },
  "resources": [
    {
      "ARN": "arn:aws:dynamodb:us-west-1:123456789012:table/dwfix-ddb-main",
      "accountId": "123456789012",
      "type": "AWS::DynamoDB::Table"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "dynamodb.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/P,D,b,Z,n cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

TransactWriteItems

Service: dynamodb

Description

TransactWriteItems is a synchronous write operation that groups up to 100 action requests.

Example CloudTrail Event #

{
  "apiVersion": "2012-08-10",
  "awsRegion": "us-west-1",
  "eventCategory": "Data",
  "eventID": "43d70d94-9aca-4715-a106-f2181468dc27",
  "eventName": "TransactWriteItems",
  "eventSource": "dynamodb.amazonaws.com",
  "eventTime": "2026-06-29T20:53:39Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": false,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "6HS55RP77MAFR3DKC1RA08ITNJVV4KQNSO5AEMVJF66Q9ASUAAJG",
  "requestParameters": {
    "requestItems": [
      {
        "items": [
          "d",
          "pk"
        ],
        "key": {
          "pk": "tw-item1"
        },
        "operation": "Put",
        "tableName": "dwfix-ddb-main"
      },
      {
        "items": [
          "d",
          "pk"
        ],
        "key": {
          "pk": "tw-item2"
        },
        "operation": "Put",
        "tableName": "dwfix-ddb-main"
      }
    ]
  },
  "resources": [
    {
      "ARN": "arn:aws:dynamodb:us-west-1:123456789012:table/dwfix-ddb-main",
      "accountId": "123456789012",
      "type": "AWS::DynamoDB::Table"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "dynamodb.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/P,D,b,Z,n cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UntagResource

Service: dynamodb

Description

Removes the association of tags from an Amazon DynamoDB resource.

Example CloudTrail Event #

{
  "apiVersion": "2012-08-10",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "0ef56b25-a56e-4275-bd52-0eaa703413d3",
  "eventName": "UntagResource",
  "eventSource": "dynamodb.amazonaws.com",
  "eventTime": "2026-06-29T19:12:18Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "04TNS5E79MTVQL1DIMFNERE2VVVV4KQNSO5AEMVJF66Q9ASUAAJG",
  "requestParameters": {
    "resourceArn": "arn:aws:dynamodb:us-west-1:123456789012:table/dwfix-t",
    "tagKeys": [
      "dw"
    ]
  },
  "resources": [
    {
      "ARN": "arn:aws:dynamodb:us-west-1:123456789012:table/dwfix-t",
      "accountId": "123456789012",
      "type": "AWS::DynamoDB::Table"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "123456789012.ddb.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b,P cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateContinuousBackups

Service: dynamodb

Description

UpdateContinuousBackups enables or disables point in time recovery for the specified table.

Example CloudTrail Event #

{
  "apiVersion": "2012-08-10",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "7d2d4288-f308-48ea-981e-c559f009a6f6",
  "eventName": "UpdateContinuousBackups",
  "eventSource": "dynamodb.amazonaws.com",
  "eventTime": "2026-06-29T19:12:18Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "VLU62UQ3M18U5VAVMMOL8JVBFVVV4KQNSO5AEMVJF66Q9ASUAAJG",
  "requestParameters": {
    "pointInTimeRecoverySpecification": {
      "pointInTimeRecoveryEnabled": true
    },
    "tableName": "dwfix-t"
  },
  "resources": [
    {
      "ARN": "arn:aws:dynamodb:us-west-1:123456789012:table/dwfix-t",
      "accountId": "123456789012",
      "type": "AWS::DynamoDB::Table"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "dynamodb.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b,P cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateContributorInsights

Service: dynamodb

Description

Updates the status for contributor insights for a specific table or index.

Example CloudTrail Event #

{
  "apiVersion": "2012-08-10",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "4e677ebc-a6ce-4a02-b5b9-37213383885b",
  "eventName": "UpdateContributorInsights",
  "eventSource": "dynamodb.amazonaws.com",
  "eventTime": "2026-06-29T20:53:59Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "R16HI8UQLBCJMI9NFJRJGAQB63VV4KQNSO5AEMVJF66Q9ASUAAJG",
  "requestParameters": {
    "contributorInsightsAction": "ENABLE",
    "tableName": "dwfix-ddb-main"
  },
  "resources": [
    {
      "ARN": "arn:aws:dynamodb:us-west-1:123456789012:table/dwfix-ddb-main",
      "accountId": "123456789012",
      "type": "AWS::DynamoDB::Table"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "dynamodb.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/P,D,b,Z,n cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateGlobalTable

Service: dynamodb

Description

Adds or removes replicas in the specified global table.

UpdateGlobalTableSettings

Service: dynamodb

Description

Updates settings for a global table.

Example CloudTrail Event #

{
  "apiVersion": "2012-08-10",
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "One or more parameter values were invalid: Failed to update settings for global table with name: ‘ddddd’ because at least one update parameter must be specified.",
  "eventCategory": "Management",
  "eventID": "1b312b56-6c13-49f4-bea6-6d81364dc213",
  "eventName": "UpdateGlobalTableSettings",
  "eventSource": "dynamodb.amazonaws.com",
  "eventTime": "2026-06-29T19:22:20Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "SGDM2J9QGSR12JT9GEONLPBD53VV4KQNSO5AEMVJF66Q9ASUAAJG",
  "requestParameters": {
    "globalTableName": "ddddd"
  },
  "resources": [
    {
      "ARN": "arn:aws:dynamodb:us-west-1:123456789012:table/ddddd",
      "accountId": "123456789012",
      "type": "AWS::DynamoDB::Table"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "dynamodb.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,P,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateItem

Service: dynamodb

Description

Edits an existing item's attributes, or adds a new item to the table if it does not already exist.

Example CloudTrail Event #

{
  "apiVersion": "2012-08-10",
  "awsRegion": "us-west-1",
  "eventCategory": "Data",
  "eventID": "97599a32-71bc-4302-a8a1-388f6921e441",
  "eventName": "UpdateItem",
  "eventSource": "dynamodb.amazonaws.com",
  "eventTime": "2026-06-29T19:12:18Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": false,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "NI643D3V5FG33E5QVUO351OJT3VV4KQNSO5AEMVJF66Q9ASUAAJG",
  "requestParameters": {
    "attributeUpdates": {
      "v": {
        "action": "PUT"
      }
    },
    "key": {
      "id": "1"
    },
    "tableName": "dwfix-t"
  },
  "resources": [
    {
      "ARN": "arn:aws:dynamodb:us-west-1:123456789012:table/dwfix-t",
      "accountId": "123456789012",
      "type": "AWS::DynamoDB::Table"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "dynamodb.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b,P cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateKinesisStreamingDestination

Service: dynamodb

Description

The command to update the Kinesis stream destination.

Example CloudTrail Event #

{
  "apiVersion": "2012-08-10",
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "Table is not in a valid state to enable Kinesis Streaming Destination: Kinesis streaming is not in ACTIVE state. Updates are only allowed in ACTIVE state. TableName: dwfix-ddb-main, kdsArn: arn:aws:kinesis:us-west-1:123456789012:stream/dwfix-kinesis-ddb",
  "eventCategory": "Management",
  "eventID": "f3ea1775-09dd-47e0-ac45-66080c200fe0",
  "eventName": "UpdateKinesisStreamingDestination",
  "eventSource": "dynamodb.amazonaws.com",
  "eventTime": "2026-06-29T20:54:00Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "IBBSQJB69UCKMMJG8AH0IN3NOJVV4KQNSO5AEMVJF66Q9ASUAAJG",
  "requestParameters": {
    "streamArn": "arn:aws:kinesis:us-west-1:123456789012:stream/dwfix-kinesis-ddb",
    "tableName": "dwfix-ddb-main",
    "updateKinesisStreamingConfiguration": {
      "approximateCreationDateTimePrecision": "MICROSECOND"
    }
  },
  "resources": [
    {
      "ARN": "arn:aws:dynamodb:us-west-1:123456789012:table/dwfix-ddb-main",
      "accountId": "123456789012",
      "type": "AWS::DynamoDB::Table"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "dynamodb.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/P,D,b,Z,n cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateTable

Service: dynamodb

Description

Modifies the provisioned throughput settings, global secondary indexes, or DynamoDB Streams settings for a given table.

Example CloudTrail Event #

{
  "apiVersion": "2012-08-10",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "304b635a-4015-448d-9d6d-44d9b4a8e020",
  "eventName": "UpdateTable",
  "eventSource": "dynamodb.amazonaws.com",
  "eventTime": "2026-06-29T20:53:39Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "1GBDI6SPC88MOPO8BCUFJUKFSJVV4KQNSO5AEMVJF66Q9ASUAAJG",
  "requestParameters": {
    "streamSpecification": {
      "streamEnabled": true,
      "streamViewType": "NEW_AND_OLD_IMAGES"
    },
    "tableName": "dwfix-ddb-main"
  },
  "resources": [
    {
      "ARN": "arn:aws:dynamodb:us-west-1:123456789012:table/dwfix-ddb-main",
      "accountId": "123456789012",
      "type": "AWS::DynamoDB::Table"
    }
  ],
  "responseElements": {
    "tableDescription": {
      "attributeDefinitions": [
        {
          "attributeName": "pk",
          "attributeType": "S"
        }
      ],
      "billingModeSummary": {
        "billingMode": "PAY_PER_REQUEST",
        "lastUpdateToPayPerRequestDateTime": "2026-06-29T20:53:19Z"
      },
      "creationDateTime": "2026-06-29T20:53:19Z",
      "deletionProtectionEnabled": false,
      "itemCount": 0,
      "keySchema": [
        {
          "attributeName": "pk",
          "keyType": "HASH"
        }
      ],
      "latestStreamArn": "arn:aws:dynamodb:us-west-1:123456789012:table/dwfix-ddb-main/stream/2026-06-29T20:53:39.764",
      "latestStreamLabel": "2026-06-29T20:53:39.764",
      "provisionedThroughput": {
        "numberOfDecreasesToday": 0,
        "readCapacityUnits": 0,
        "writeCapacityUnits": 0
      },
      "streamSpecification": {
        "streamEnabled": true,
        "streamViewType": "NEW_AND_OLD_IMAGES"
      },
      "tableArn": "arn:aws:dynamodb:us-west-1:123456789012:table/dwfix-ddb-main",
      "tableId": "95909ecb-e515-4ef5-b07e-4ed9eb84b43c",
      "tableName": "dwfix-ddb-main",
      "tableSizeBytes": 0,
      "tableStatus": "UPDATING",
      "tableThroughputModeSummary": {
        "lastUpdateToPayPerRequestDateTime": "2026-06-29T20:53:19Z",
        "tableThroughputMode": "PAY_PER_REQUEST"
      },
      "warmThroughput": {
        "readUnitsPerSecond": 12000,
        "status": "ACTIVE",
        "writeUnitsPerSecond": 4000
      }
    }
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "dynamodb.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/P,D,b,Z,n cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateTableReplicaAutoScaling

Service: dynamodb

Description

Updates auto scaling settings on your global tables at once.

UpdateTimeToLive

Service: dynamodb

Description

The UpdateTimeToLive method enables or disables Time to Live (TTL) for the specified table.

Example CloudTrail Event #

{
  "apiVersion": "2012-08-10",
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "TimeToLive is already disabled",
  "eventCategory": "Management",
  "eventID": "e1655917-6cd0-4d30-9a82-01ecfd3ae6ce",
  "eventName": "UpdateTimeToLive",
  "eventSource": "dynamodb.amazonaws.com",
  "eventTime": "2026-06-29T19:12:17Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "GQVAE4BG6OKED0FJ96HSHTGLM3VV4KQNSO5AEMVJF66Q9ASUAAJG",
  "requestParameters": {
    "tableName": "dwfix-t",
    "timeToLiveSpecification": {
      "attributeName": "ttl",
      "enabled": false
    }
  },
  "resources": [
    {
      "ARN": "arn:aws:dynamodb:us-west-1:123456789012:table/dwfix-t",
      "accountId": "123456789012",
      "type": "AWS::DynamoDB::Table"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "dynamodb.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b,P cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DescribeStream

Service: dynamodb

Description

DescribeStream recorded by CloudTrail for Amazon DynamoDB. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "7ebedaf1-84c8-430f-acc6-886e4c4f802e",
  "eventSource": "dynamodb.amazonaws.com",
  "eventName": "DescribeStream",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "apiVersion": "2012-08-10",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "TTOS89OI71PQ90JES3O096JC2NVV4KQNSO5AEMVJF66Q9ASUAAJG",
  "userAgent": "leb-kcl-eab2bf4f-3230-46ff-9b15-abf7c7b38dfc,amazon-kinesis-client-library-java-lambda_1.2.1, aws-internal/3 aws-sdk-java/1.12.797 Linux/4.14.355-284.740.amzn2.x86_64 OpenJDK_64-Bit_Server_VM/25.0.3+13-LTS java/25.0.3 kotlin/2.3.21 vendor/Amazon.com_Inc. cfg/retry-mode/standard cfg/auth-source#unknown m/P",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "example.dynamodb.us-east-1.amazonaws.com",
    "keyExchange": "secp256r1"
  },
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::DynamoDB::Table",
      "ARN": "arn:aws:dynamodb:us-east-1:123456789012:table/EXAMPLE"
    },
    {
      "accountId": "123456789012",
      "type": "AWS::DynamoDB::Stream",
      "ARN": "arn:aws:dynamodb:us-east-1:123456789012:table/EXAMPLE"
    }
  ]
}

SearchVectors

Service: dynamodb

Description

Performs a vector similarity search on a vector index associated with an Amazon DynamoDB table, and returns the most similar items sorted by similarity score based on the distance function configured for the index.

DynamoDB

any: DynamoDB (catch-all)

Description

ExportTableToPointInTime

Description

Example CloudTrail Event #

Detection Rules #

Elastic #

ListTables

Description

Example CloudTrail Event #

Common Indicators #

Related events #

Detection Rules #

Elastic #

Scan

Description

Example CloudTrail Event #

Detection Rules #

Elastic #

BatchExecuteStatement

Description

Example CloudTrail Event #

BatchGetItem

Description

BatchWriteItem

Description

Example CloudTrail Event #

CreateBackup

Description

Example CloudTrail Event #

CreateGlobalTable

Description

CreateTable

Description

Example CloudTrail Event #

DeleteBackup

Description

Example CloudTrail Event #

DeleteItem

Description

Example CloudTrail Event #

DeleteResourcePolicy

Description

Example CloudTrail Event #

DeleteTable

Description

Example CloudTrail Event #

DescribeBackup

Description

Example CloudTrail Event #

DescribeContinuousBackups

Description

Example CloudTrail Event #

DescribeContributorInsights

Description

Example CloudTrail Event #

DescribeEndpoints

Description

Example CloudTrail Event #

References #

DescribeExport

Description

Example CloudTrail Event #

DescribeGlobalTable

Description

Example CloudTrail Event #

DescribeGlobalTableSettings

Description

Example CloudTrail Event #

DescribeImport

Description

DescribeKinesisStreamingDestination

Description

Example CloudTrail Event #

DescribeLimits

Description

Example CloudTrail Event #

References #

DescribeTable