Elastic Kubernetes Service
| eventName | Description | Sample | Rule |
|---|---|---|---|
| any | Catch-all entry for Elastic Kubernetes Service rules that match the service but not a specific eventName. | N | N |
| Associate | Associates an access policy with an EKS access entry, granting the specified Kubernetes permissions scoped to a cluster or namespace. | Y | Y |
| Create | Creates an access entry that maps an IAM principal to Kubernetes permissions within an EKS cluster. | Y | Y |
| Create | Creates a new Amazon EKS Kubernetes control plane cluster with the specified configuration. | Y | Y |
| Delete | Deletes an access entry, removing the associated IAM principal's Kubernetes access to the cluster. | Y | Y |
| Delete | Deletes an Amazon EKS cluster and its associated control plane resources. | Y | Y |
| Disassociate | Removes a previously associated access policy from an EKS access entry, revoking the corresponding Kubernetes permissions. | Y | Y |
| Update | Updates the Kubernetes groups or username associated with an existing EKS access entry. | Y | Y |
| Update | Updates the configuration of an existing EKS cluster, such as endpoint access settings, logging, or authentication mode. | Y | Y |
| Associate | Associates an encryption configuration to an existing cluster. | N | N |
| Associate | Associates an identity provider configuration to a cluster. | N | N |
| Create | Creates an Amazon EKS add-on. | Y | N |
| Create | Creates a managed capability resource for an Amazon EKS cluster. | N | N |
| Create | Creates an EKS Anywhere subscription. | N | N |
| Create | Creates an Fargate profile for your Amazon EKS cluster. | Y | N |
| Create | Creates a managed node group for an Amazon EKS cluster. | N | N |
| Create | Creates an EKS Pod Identity association between a service account in an Amazon EKS cluster and an IAM role with EKS Pod Identity. | Y | N |
| Delete | Deletes an Amazon EKS add-on. | Y | N |
| Delete | Deletes a managed capability from your Amazon EKS cluster. | Y | N |
| Delete | Deletes an expired or inactive subscription. | Y | N |
| Delete | Deletes an Fargate profile. | Y | N |
| Delete | Deletes a managed node group. | Y | N |
| Delete | Deletes a EKS Pod Identity association. | Y | N |
| Deregister | Deregisters a connected cluster to remove it from the Amazon EKS control plane. | Y | N |
| Describe | Describes an access entry. | Y | N |
| Describe | Describes an Amazon EKS add-on. | Y | N |
| Describe | Returns configuration options. | Y | N |
| Describe | Describes the versions for an add-on. | Y | N |
| Describe | Returns detailed information about a specific managed capability in your Amazon EKS cluster, including its current status, configuration, health information, and any issues that may be affecting its operation. | Y | N |
| Describe | Describes an Amazon EKS cluster. | Y | N |
| Describe | Lists available Kubernetes versions for Amazon EKS clusters. | Y | N |
| Describe | Returns descriptive information about a subscription. | Y | N |
| Describe | Describes an Fargate profile. | Y | N |
| Describe | Describes an identity provider configuration. | Y | N |
| Describe | Returns details about an insight that you specify using its ID. | Y | N |
| Describe | Returns the status of the latest on-demand cluster insights refresh operation. | Y | N |
| Describe | Describes a managed node group. | Y | N |
| Describe | Returns descriptive information about an EKS Pod Identity association. | Y | N |
| Describe | Describes an update to an Amazon EKS resource. | Y | N |
| Disassociate | Disassociates an identity provider configuration from a cluster. | Y | N |
| List | Lists the access entries for your cluster. | Y | N |
| List | Lists the available access policies. | Y | N |
| List | Lists the installed add-ons. | Y | N |
| List | Lists the access policies associated with an access entry. | Y | N |
| List | Lists all managed capabilities in your Amazon EKS cluster. | Y | N |
| List | Lists the Amazon EKS clusters in your Amazon Web Services account in the specified Amazon Web Services Region. | Y | N |
| List | Displays the full description of the subscription. | Y | N |
| List | Lists the Fargate profiles associated with the specified cluster in your Amazon Web Services account in the specified Amazon Web Services Region. | Y | N |
| List | Lists the identity provider configurations for your cluster. | Y | N |
| List | Returns a list of all insights checked for against the specified cluster. | Y | N |
| List | Lists the managed node groups associated with the specified cluster in your Amazon Web Services account in the specified Amazon Web Services Region. | Y | N |
| List | List the EKS Pod Identity associations in a cluster. | Y | N |
| List | List the tags for an Amazon EKS resource. | Y | N |
| List | Lists the updates associated with an Amazon EKS resource in your Amazon Web Services account, in the specified Amazon Web Services Region. | Y | N |
| Register | Connects a Kubernetes cluster to the Amazon EKS control plane. | Y | N |
| Start | Initiates an on-demand refresh operation for cluster insights, getting the latest analysis outside of the standard refresh schedule. | Y | N |
| Tag | Associates the specified tags to an Amazon EKS resource with the specified resourceArn. | Y | N |
| Untag | Deletes specified tags from an Amazon EKS resource. | Y | N |
| Update | Updates an Amazon EKS add-on. | Y | N |
| Update | Updates the configuration of a managed capability in your Amazon EKS cluster. | Y | N |
| Update | Updates an Amazon EKS cluster to the specified Kubernetes version. | Y | N |
| Update | Update an EKS Anywhere Subscription. | Y | N |
| Update | Updates an Amazon EKS managed node group configuration. | Y | N |
| Update | Updates the Kubernetes version or AMI version of an Amazon EKS managed node group. | Y | N |
| Update | Updates a EKS Pod Identity association. | Y | N |
| Access | AccessKubernetesApi recorded by CloudTrail for Amazon Elastic Kubernetes Service. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK. | N | N |
| Cancel | Cancels an in-progress update to an Amazon EKS cluster on a best-effort basis. | N | N |
any: Elastic Kubernetes Service (catch-all)
#Description
Catch-all entry for Elastic Kubernetes Service rules that match the service but not a specific eventName.
AssociateAccessPolicy
#Description
Associates an access policy with an EKS access entry, granting the specified Kubernetes permissions scoped to a cluster or namespace.
CloudTrail management event, logged by default. Full rule details for this event, including ATT&CK technique mappings and native queries →Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"eventCategory": "Management",
"eventID": "6a29a333-4101-43ca-8676-554fa5725093",
"eventName": "AssociateAccessPolicy",
"eventSource": "eks.amazonaws.com",
"eventTime": "2026-06-29T22:46:24Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "123456789012",
"requestID": "1e72e18f-cca5-41d2-9c0e-d89b4998681b",
"requestParameters": {
"accessScope": {
"type": "cluster"
},
"name": "dwfix-eks-heavy",
"policyArn": "arn:aws:eks::aws:cluster-access-policy/AmazonEKSClusterAdminPolicy",
"principalArn": "arn%3Aaws%3Aiam%3A%3A123456789012%3Arole%2Fdwfix-eks-podid-role"
},
"responseElements": {
"associatedAccessPolicy": {
"accessScope": {
"namespaces": [],
"type": "cluster"
},
"associatedAt": 1782773184.871,
"modifiedAt": 1782773184.871,
"policyArn": "arn:aws:eks::aws:cluster-access-policy/AmazonEKSClusterAdminPolicy"
},
"clusterName": "dwfix-eks-heavy",
"principalArn": "arn:aws:iam::123456789012:role/dwfix-eks-podid-role"
},
"sourceIPAddress": "203.0.113.5",
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
Detection Rules #
Elastic #
T1098, T1098.006↳ also matches CreateAccessEntry, DeleteAccessEntry, DisassociateAccessPolicy, UpdateAccessEntry T1098, T1098.006
CreateAccessEntry
#Description
Creates an access entry that maps an IAM principal to Kubernetes permissions within an EKS cluster.
CloudTrail management event, logged by default. Full rule details for this event, including ATT&CK technique mappings and native queries →Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"eventCategory": "Management",
"eventID": "070d93d5-208a-47f9-b0d6-9a4739a0d2b7",
"eventName": "CreateAccessEntry",
"eventSource": "eks.amazonaws.com",
"eventTime": "2026-06-29T22:46:24Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "123456789012",
"requestID": "a34bde6f-69bc-4ed2-8c02-29a6382a7de1",
"requestParameters": {
"clientRequestToken": "cbf8d3bb-302f-4dac-8536-6dbc3aa4ea37",
"name": "dwfix-eks-heavy",
"principalArn": "arn:aws:iam::123456789012:role/dwfix-eks-podid-role",
"tags": {
"project": "dwfix"
},
"type": "STANDARD"
},
"responseElements": {
"accessEntry": {
"accessEntryArn": "arn:aws:eks:us-west-1:123456789012:access-entry/dwfix-eks-heavy/role/123456789012/dwfix-eks-podid-role/94cf8ac7-fbdb-9a2b-d395-3a6a7cf5eb02",
"clusterName": "dwfix-eks-heavy",
"createdAt": 1782773184.575,
"kubernetesGroups": [],
"modifiedAt": 1782773184.575,
"principalArn": "arn:aws:iam::123456789012:role/dwfix-eks-podid-role",
"tags": {
"project": "dwfix"
},
"type": "STANDARD",
"username": "arn:aws:sts::123456789012:assumed-role/dwfix-eks-podid-role/{{SessionName}}"
}
},
"sourceIPAddress": "203.0.113.5",
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
Detection Rules #
Elastic #
T1098, T1098.006↳ also matches AssociateAccessPolicy, DeleteAccessEntry, DisassociateAccessPolicy, UpdateAccessEntry
CreateCluster
#Description
Creates a new Amazon EKS Kubernetes control plane cluster with the specified configuration.
CloudTrail management event, logged by default. Full rule details for this event, including ATT&CK technique mappings and native queries →Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"eventCategory": "Management",
"eventID": "23cd6bfd-4129-4e97-b315-638be44cbaf2",
"eventName": "CreateCluster",
"eventSource": "eks.amazonaws.com",
"eventTime": "2026-06-29T22:40:22Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "123456789012",
"requestID": "4ddc2e32-35ab-49e8-8037-3d18184f9fee",
"requestParameters": {
"accessConfig": {
"authenticationMode": "API",
"bootstrapClusterCreatorAdminPermissions": true
},
"bootstrapSelfManagedAddons": false,
"clientRequestToken": "342cce1b-800d-4831-956a-9267206eedc3",
"name": "dwfix-eks-heavy",
"resourcesVpcConfig": {
"endpointPrivateAccess": false,
"endpointPublicAccess": true,
"subnetIds": [
"subnet-0c9f719882f5c95ae",
"subnet-04caa2ba1250f8fb6"
]
},
"roleArn": "arn:aws:iam::123456789012:role/dwfix-eks-cluster-role",
"tags": {
"project": "dwfix"
}
},
"responseElements": {
"cluster": {
"accessConfig": {
"authenticationMode": "API",
"bootstrapClusterCreatorAdminPermissions": true
},
"arn": "arn:aws:eks:us-west-1:123456789012:cluster/dwfix-eks-heavy",
"certificateAuthority": {},
"controlPlaneScalingConfig": {
"tier": "standard"
},
"createdAt": 1782772822.414,
"deletionProtection": false,
"kubernetesNetworkConfig": {
"elasticLoadBalancing": {
"enabled": false
},
"ipFamily": "ipv4",
"serviceIpv4Cidr": "10.100.0.0/16"
},
"logging": {
"clusterLogging": [
{
"enabled": false,
"types": [
"api",
"audit",
"authenticator",
"controllerManager",
"scheduler"
]
}
]
},
"name": "dwfix-eks-heavy",
"platformVersion": "eks.4",
"resourcesVpcConfig": {
"controlPlaneEgressMode": "AWS_MANAGED",
"endpointPrivateAccess": false,
"endpointPublicAccess": true,
"publicAccessCidrs": [
"0.0.0.0/0"
],
"securityGroupIds": [],
"subnetIds": [
"subnet-0c9f719882f5c95ae",
"subnet-04caa2ba1250f8fb6"
],
"vpcId": "vpc-0cf63cfb072f7d61f"
},
"roleArn": "arn:aws:iam::123456789012:role/dwfix-eks-cluster-role",
"status": "CREATING",
"tags": {
"project": "dwfix"
},
"upgradePolicy": {
"supportType": "EXTENDED"
},
"vendedLogs": false,
"version": "1.36"
}
},
"sourceIPAddress": "203.0.113.5",
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
Detection Rules #
Sigma #
T1485↳ also matches DeleteCluster
DeleteAccessEntry
#Description
Deletes an access entry, removing the associated IAM principal's Kubernetes access to the cluster.
CloudTrail management event, logged by default. Full rule details for this event, including ATT&CK technique mappings and native queries →Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "InvalidParameterException",
"eventCategory": "Management",
"eventID": "162de8f8-a9fc-4b8d-ba3d-7bef1d698d14",
"eventName": "DeleteAccessEntry",
"eventSource": "eks.amazonaws.com",
"eventTime": "2026-06-29T19:23:15Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "123456789012",
"requestID": "513902ef-1096-4fee-9934-52341b747f37",
"requestParameters": {
"name": "dw-probe",
"principalArn": "dw-probe"
},
"responseElements": {
"message": "The principalArn parameter format is not valid"
},
"sourceIPAddress": "203.0.113.5",
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
Detection Rules #
Elastic #
T1098, T1098.006↳ also matches AssociateAccessPolicy, CreateAccessEntry, DisassociateAccessPolicy, UpdateAccessEntry
DeleteCluster
#Description
Deletes an Amazon EKS cluster and its associated control plane resources.
CloudTrail management event, logged by default. Full rule details for this event, including ATT&CK technique mappings and native queries →Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "ResourceNotFoundException",
"eventCategory": "Management",
"eventID": "e436556e-8a6f-4658-aa6b-e7ab4a86d724",
"eventName": "DeleteCluster",
"eventSource": "eks.amazonaws.com",
"eventTime": "2026-06-29T19:23:15Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "123456789012",
"requestID": "e929066a-5a66-414b-ab16-f6e0324e5336",
"requestParameters": {
"name": "dw-probe"
},
"responseElements": {
"clusterName": "dw-probe",
"message": "No cluster found for name: dw-probe."
},
"sourceIPAddress": "203.0.113.5",
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
Detection Rules #
Sigma #
T1485↳ also matches CreateCluster
DisassociateAccessPolicy
#Description
Removes a previously associated access policy from an EKS access entry, revoking the corresponding Kubernetes permissions.
CloudTrail management event, logged by default. Full rule details for this event, including ATT&CK technique mappings and native queries →Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "InvalidParameterException",
"eventCategory": "Management",
"eventID": "6dfd2fec-1b68-452b-b393-33c2da4b549b",
"eventName": "DisassociateAccessPolicy",
"eventSource": "eks.amazonaws.com",
"eventTime": "2026-06-29T19:23:15Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "123456789012",
"requestID": "eba0632d-c992-447e-bc8f-efdcdc61249e",
"requestParameters": {
"name": "dw-probe",
"policyArn": "dw-probe",
"principalArn": "dw-probe"
},
"responseElements": {
"message": "The principalArn parameter format is not valid"
},
"sourceIPAddress": "203.0.113.5",
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
Detection Rules #
Elastic #
T1098, T1098.006↳ also matches AssociateAccessPolicy, CreateAccessEntry, DeleteAccessEntry, UpdateAccessEntry
UpdateAccessEntry
#Description
Updates the Kubernetes groups or username associated with an existing EKS access entry.
CloudTrail management event, logged by default. Full rule details for this event, including ATT&CK technique mappings and native queries →Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "InvalidParameterException",
"eventCategory": "Management",
"eventID": "24c381c9-b349-4308-9606-9f7d8cf31b8c",
"eventName": "UpdateAccessEntry",
"eventSource": "eks.amazonaws.com",
"eventTime": "2026-06-29T19:23:15Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "123456789012",
"requestID": "d0490e97-87e2-4f38-add5-3db11fae4b11",
"requestParameters": {
"clientRequestToken": "cf4a42dd-871d-4073-95ad-091b5380a28a",
"name": "dw-probe",
"principalArn": "dw-probe"
},
"responseElements": {
"message": "The principalArn parameter format is not valid"
},
"sourceIPAddress": "203.0.113.5",
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
Detection Rules #
Elastic #
T1098, T1098.006↳ also matches AssociateAccessPolicy, CreateAccessEntry, DeleteAccessEntry, DisassociateAccessPolicy
UpdateClusterConfig
#Description
Updates the configuration of an existing EKS cluster, such as endpoint access settings, logging, or authentication mode.
CloudTrail management event, logged by default. Full rule details for this event, including ATT&CK technique mappings and native queries →Example CloudTrail Event #
{
"awsRegion": "us-east-2",
"eventCategory": "Management",
"eventID": "f2f29c3d-7227-4705-9d29-d8798c8e3b2e",
"eventName": "UpdateClusterConfig",
"eventSource": "eks.amazonaws.com",
"eventTime": "2021-07-07T18:46:10Z",
"eventType": "AwsApiCall",
"eventVersion": "1.08",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "797507667711",
"requestID": "f65ec21e-3cd1-4df1-8ee2-7a461dd23696",
"requestParameters": {
"clientRequestToken": "cf885cfe-b6b1-4c00-8b16-a778cd39b8a9",
"name": "Cluster_Galah",
"resourcesVpcConfig": {
"endpointPrivateAccess": true,
"endpointPublicAccess": false
}
},
"responseElements": {
"update": {
"createdAt": 1625683570.012,
"errors": [],
"id": "11417a7b-9a62-4e02-8ec9-9be159d3e527",
"params": [
{
"type": "EndpointPublicAccess",
"value": "false"
},
{
"type": "EndpointPrivateAccess",
"value": "true"
},
{
"type": "PublicAccessCidrs",
"value": [
"0.0.0.0/0"
]
}
],
"status": "InProgress",
"type": "EndpointAccessUpdate"
}
},
"sourceIPAddress": "213.205.197.211",
"userAgent": "aws-internal/3 aws-sdk-java/1.11.1030 Linux/5.4.109-57.182.amzn2int.x86_64 OpenJDK_64-Bit_Server_VM/25.292-b10 java/1.8.0_292 vendor/Oracle_Corporation cfg/retry-mode/legacy",
"userIdentity": {
"accessKeyId": "ASIA3TLZJI3732PVWTVV",
"accountId": "797507667711",
"arn": "arn:aws:iam::797507667711:user/bruce",
"principalId": "AIDA3TLZJI372XH6M2Q25",
"sessionContext": {
"attributes": {
"creationDate": "2021-07-07T11:45:11Z",
"mfaAuthenticated": "false"
},
"sessionIssuer": {},
"webIdFederationData": {}
},
"type": "IAMUser",
"userName": "bruce"
}
}
Detection Rules #
Elastic #
T1562, T1562.008References #
AssociateEncryptionConfig
#Description
Associates an encryption configuration to an existing cluster.
AssociateIdentityProviderConfig
#Description
Associates an identity provider configuration to a cluster.
CloudTrail management event, logged by default.
CreateAddon
#Description
Creates an Amazon EKS add-on.
CloudTrail management event, logged by default.Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"eventCategory": "Management",
"eventID": "196c6c9c-dfb7-4291-9cec-fc9612cf8540",
"eventName": "CreateAddon",
"eventSource": "eks.amazonaws.com",
"eventTime": "2026-06-29T22:46:25Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "123456789012",
"requestID": "f416a254-cce9-4cbf-93ca-80e8870bd11e",
"requestParameters": {
"addonName": "kube-proxy",
"clientRequestToken": "959be12c-764e-4a54-ab49-f42f0444fe5c",
"name": "dwfix-eks-heavy",
"resolveConflicts": "OVERWRITE",
"tags": {
"project": "dwfix"
}
},
"responseElements": {
"addon": {
"addonArn": "arn:aws:eks:us-west-1:123456789012:addon/dwfix-eks-heavy/kube-proxy/26cf8ac7-fcdb-43dd-471c-57b46ef4b9f4",
"addonName": "kube-proxy",
"addonVersion": "v1.36.0-eksbuild.7",
"clusterName": "dwfix-eks-heavy",
"createdAt": 1782773185.167,
"health": {
"issues": []
},
"modifiedAt": 1782773185.185,
"namespaceConfig": {
"namespace": "kube-system"
},
"status": "CREATING",
"tags": {
"project": "dwfix"
}
}
},
"sourceIPAddress": "203.0.113.5",
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
CreateCapability
#Description
Creates a managed capability resource for an Amazon EKS cluster.
CreateEksAnywhereSubscription
#Description
Creates an EKS Anywhere subscription.
CreateFargateProfile
#Description
Creates an Fargate profile for your Amazon EKS cluster.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "InvalidParameterException",
"eventCategory": "Management",
"eventID": "1e3d99d6-2e99-4fb0-a184-e55bcd027543",
"eventName": "CreateFargateProfile",
"eventSource": "eks.amazonaws.com",
"eventTime": "2026-06-29T22:47:47Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "123456789012",
"requestID": "4b6e342e-3bac-4bce-9264-5d82cd2a47eb",
"requestParameters": {
"clientRequestToken": "1c0f9647-be8a-47d4-9486-85bcb2517bce",
"fargateProfileName": "dwfix-fargate-profile",
"name": "dwfix-eks-heavy",
"podExecutionRoleArn": "arn:aws:iam::123456789012:role/dwfix-eks-fargate-role",
"selectors": [
{
"namespace": "dwfix-ns"
}
],
"subnets": [
"subnet-0c9f719882f5c95ae",
"subnet-04caa2ba1250f8fb6"
],
"tags": {
"project": "dwfix"
}
},
"responseElements": {
"message": "Subnet subnet-0c9f719882f5c95ae provided in Fargate Profile is not a private subnet"
},
"sourceIPAddress": "203.0.113.5",
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
CreateNodegroup
#Description
Creates a managed node group for an Amazon EKS cluster.
CloudTrail management event, logged by default.
CreatePodIdentityAssociation
#Description
Creates an EKS Pod Identity association between a service account in an Amazon EKS cluster and an IAM role with EKS Pod Identity.
CloudTrail management event, logged by default.Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"eventCategory": "Management",
"eventID": "30df1ece-a9ca-41e4-aa47-360cd4ffe4b7",
"eventName": "CreatePodIdentityAssociation",
"eventSource": "eks.amazonaws.com",
"eventTime": "2026-06-29T22:47:46Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "123456789012",
"requestID": "0bd1197e-de91-4ad0-bdb6-221fa5ba1070",
"requestParameters": {
"clientRequestToken": "879d207d-761c-4443-b426-dcc178d27757",
"name": "dwfix-eks-heavy",
"namespace": "dwfix-ns",
"roleArn": "arn:aws:iam::123456789012:role/dwfix-eks-podid-role",
"serviceAccount": "dwfix-sa",
"tags": {
"project": "dwfix"
}
},
"responseElements": {
"association": {
"associationArn": "arn:aws:eks:us-west-1:123456789012:podidentityassociation/dwfix-eks-heavy/a-jws8vn29ylunpduqa",
"associationId": "a-jws8vn29ylunpduqa",
"clusterName": "dwfix-eks-heavy",
"createdAt": 1782773266.874,
"disableSessionTags": false,
"modifiedAt": 1782773266.874,
"namespace": "dwfix-ns",
"roleArn": "arn:aws:iam::123456789012:role/dwfix-eks-podid-role",
"serviceAccount": "dwfix-sa",
"tags": {
"project": "dwfix"
}
}
},
"sourceIPAddress": "203.0.113.5",
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
DeleteAddon
#Description
Deletes an Amazon EKS add-on.
CloudTrail management event, logged by default.Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "ResourceNotFoundException",
"eventCategory": "Management",
"eventID": "adaf1d1c-6b80-46d7-b350-3623ea0b610e",
"eventName": "DeleteAddon",
"eventSource": "eks.amazonaws.com",
"eventTime": "2026-06-29T19:23:15Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "123456789012",
"requestID": "707a515f-f65b-45a5-9b45-93e906aae6b9",
"requestParameters": {
"addonName": "dw-probe",
"name": "ddddd"
},
"responseElements": {
"clusterName": "ddddd",
"message": "No cluster found for name: ddddd."
},
"sourceIPAddress": "203.0.113.5",
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
DeleteCapability
#Description
Deletes a managed capability from your Amazon EKS cluster.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "ResourceNotFoundException",
"eventCategory": "Management",
"eventID": "07e97bcd-721a-40f6-9d65-aceda962e32e",
"eventName": "DeleteCapability",
"eventSource": "eks.amazonaws.com",
"eventTime": "2026-06-29T19:23:15Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "123456789012",
"requestID": "a2f4fc12-a4bf-46dd-bad5-8609e2238eed",
"requestParameters": {
"capabilityName": "dw-probe",
"name": "dw-probe"
},
"resources": [
{
"ARN": "arn:aws:eks:us-west-1:123456789012:capability/dw-probe/dw-probe/*",
"accountId": "123456789012",
"type": "AWS::EKS::Capability"
}
],
"responseElements": {
"clusterName": "dw-probe",
"message": "No cluster found for name: dw-probe."
},
"sourceIPAddress": "203.0.113.5",
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
DeleteEksAnywhereSubscription
#Description
Deletes an expired or inactive subscription.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "ResourceNotFoundException",
"eventCategory": "Management",
"eventID": "12571a6e-63f4-4149-a6b8-dca01edefb5c",
"eventName": "DeleteEksAnywhereSubscription",
"eventSource": "eks.amazonaws.com",
"eventTime": "2026-06-29T19:23:15Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "123456789012",
"requestID": "770abab5-afbd-4bcc-a6ea-3ae745de5ff8",
"requestParameters": {
"id": "dw-probe"
},
"responseElements": {
"message": "subscription not found."
},
"sourceIPAddress": "203.0.113.5",
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
DeleteFargateProfile
#Description
Deletes an Fargate profile.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "ResourceNotFoundException",
"eventCategory": "Management",
"eventID": "673e1cca-23c5-4470-b3a0-cee25fafe0a9",
"eventName": "DeleteFargateProfile",
"eventSource": "eks.amazonaws.com",
"eventTime": "2026-06-29T19:23:16Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "123456789012",
"requestID": "e9a88488-f616-4099-b965-2b866825a733",
"requestParameters": {
"fargateProfileName": "dw-probe",
"name": "dw-probe"
},
"responseElements": {
"clusterName": "dw-probe",
"message": "No cluster found for name: dw-probe."
},
"sourceIPAddress": "203.0.113.5",
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
DeleteNodegroup
#Description
Deletes a managed node group.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "ResourceNotFoundException",
"eventCategory": "Management",
"eventID": "f256a626-f8a0-4d18-9933-a8dd13d9df98",
"eventName": "DeleteNodegroup",
"eventSource": "eks.amazonaws.com",
"eventTime": "2026-06-29T19:23:16Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "123456789012",
"requestID": "8d2245c7-878b-4680-b434-90eb5949427a",
"requestParameters": {
"name": "dw-probe",
"nodegroupName": "dw-probe"
},
"responseElements": {
"clusterName": "dw-probe",
"message": "No cluster found for name: dw-probe."
},
"sourceIPAddress": "203.0.113.5",
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
DeletePodIdentityAssociation
#Description
Deletes a EKS Pod Identity association.
CloudTrail management event, logged by default.Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "InvalidParameterException",
"eventCategory": "Management",
"eventID": "373a905a-fb4b-4997-afda-d26ecba38050",
"eventName": "DeletePodIdentityAssociation",
"eventSource": "eks.amazonaws.com",
"eventTime": "2026-06-29T19:23:16Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "123456789012",
"requestID": "3542945a-c89d-495a-9eb6-12f47abdabe7",
"requestParameters": {
"associationId": "dw-probe",
"name": "dw-probe"
},
"responseElements": {
"clusterName": "dw-probe",
"message": "The parameter associationId should be 19 characters long."
},
"sourceIPAddress": "203.0.113.5",
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
DeregisterCluster
#Description
Deregisters a connected cluster to remove it from the Amazon EKS control plane.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "ResourceNotFoundException",
"eventCategory": "Management",
"eventID": "9c97704c-722c-4c4a-8870-74608c3f10f2",
"eventName": "DeregisterCluster",
"eventSource": "eks.amazonaws.com",
"eventTime": "2026-06-29T19:23:16Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "123456789012",
"requestID": "e69f00b0-c08e-4a40-b12a-733f6a8d3a90",
"requestParameters": {
"name": "dw-probe"
},
"responseElements": {
"clusterName": "dw-probe",
"message": "No cluster found for name: dw-probe."
},
"sourceIPAddress": "203.0.113.5",
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
DescribeAccessEntry
#Description
Describes an access entry.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "InvalidParameterException",
"eventCategory": "Management",
"eventID": "68c41ce5-f759-4db4-bc1f-7894379630f8",
"eventName": "DescribeAccessEntry",
"eventSource": "eks.amazonaws.com",
"eventTime": "2026-06-29T18:43:24Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "123456789012",
"requestID": "33ba14b5-76e2-4dce-8de9-19a0ca48b69d",
"requestParameters": {
"name": "dw-probe",
"principalArn": "dw-probe"
},
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
DescribeAddon
#Description
Describes an Amazon EKS add-on.
Example CloudTrail Event #
{
"awsRegion": "us-east-2",
"eventCategory": "Management",
"eventID": "576bbb62-6973-493e-b067-8780c2ddfd04",
"eventName": "DescribeAddon",
"eventSource": "eks.amazonaws.com",
"eventTime": "2021-07-07T18:46:13Z",
"eventType": "AwsApiCall",
"eventVersion": "1.08",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "797507667711",
"requestID": "cce343da-5834-474f-a641-570bcb53ad95",
"requestParameters": {
"addonName": "kube-proxy",
"name": "Cluster_Galah"
},
"responseElements": null,
"sourceIPAddress": "213.205.197.211",
"userAgent": "aws-internal/3 aws-sdk-java/1.11.1030 Linux/5.4.109-57.182.amzn2int.x86_64 OpenJDK_64-Bit_Server_VM/25.292-b10 java/1.8.0_292 vendor/Oracle_Corporation cfg/retry-mode/legacy",
"userIdentity": {
"accessKeyId": "ASIA3TLZJI3732PVWTVV",
"accountId": "797507667711",
"arn": "arn:aws:iam::797507667711:user/bruce",
"principalId": "AIDA3TLZJI372XH6M2Q25",
"sessionContext": {
"attributes": {
"creationDate": "2021-07-07T11:45:11Z",
"mfaAuthenticated": "false"
},
"sessionIssuer": {},
"webIdFederationData": {}
},
"type": "IAMUser",
"userName": "bruce"
}
}
References #
DescribeAddonConfiguration
#Description
Returns configuration options.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "ResourceNotFoundException",
"eventCategory": "Management",
"eventID": "1a213213-858e-4bb6-b377-c43643712fc3",
"eventName": "DescribeAddonConfiguration",
"eventSource": "eks.amazonaws.com",
"eventTime": "2026-06-29T18:43:24Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "123456789012",
"requestID": "b599549b-ee54-4906-b220-1f4885b51e31",
"requestParameters": {
"addonName": "dw-probe",
"addonVersion": "dw-probe"
},
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
DescribeAddonVersions
#Description
Describes the versions for an add-on.
Example CloudTrail Event #
{
"awsRegion": "us-east-2",
"eventCategory": "Management",
"eventID": "d05a9f4f-0d74-4a64-a6d3-7911abde696d",
"eventName": "DescribeAddonVersions",
"eventSource": "eks.amazonaws.com",
"eventTime": "2021-07-07T18:46:13Z",
"eventType": "AwsApiCall",
"eventVersion": "1.08",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "797507667711",
"requestID": "b3bdeb9f-d1ca-42ba-bb29-91ee003fa2e9",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "213.205.197.211",
"userAgent": "aws-internal/3 aws-sdk-java/1.11.1030 Linux/5.4.109-57.182.amzn2int.x86_64 OpenJDK_64-Bit_Server_VM/25.292-b10 java/1.8.0_292 vendor/Oracle_Corporation cfg/retry-mode/legacy",
"userIdentity": {
"accessKeyId": "ASIA3TLZJI3732PVWTVV",
"accountId": "797507667711",
"arn": "arn:aws:iam::797507667711:user/bruce",
"principalId": "AIDA3TLZJI372XH6M2Q25",
"sessionContext": {
"attributes": {
"creationDate": "2021-07-07T11:45:11Z",
"mfaAuthenticated": "false"
},
"sessionIssuer": {},
"webIdFederationData": {}
},
"type": "IAMUser",
"userName": "bruce"
}
}
References #
DescribeCapability
#Description
Returns detailed information about a specific managed capability in your Amazon EKS cluster, including its current status, configuration, health information, and any issues that may be affecting its operation.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "ResourceNotFoundException",
"eventCategory": "Management",
"eventID": "a094dcad-21fb-4e9a-9298-efeb6333fad1",
"eventName": "DescribeCapability",
"eventSource": "eks.amazonaws.com",
"eventTime": "2026-06-29T18:43:24Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "123456789012",
"requestID": "6a97edaa-5895-4c7c-a5b6-995d85502e65",
"requestParameters": {
"capabilityName": "dw-probe",
"name": "dw-probe"
},
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
DescribeCluster
#Description
Describes an Amazon EKS cluster.
Example CloudTrail Event #
{
"awsRegion": "us-east-2",
"eventCategory": "Management",
"eventID": "703b58af-009a-465a-9bae-e4381e82a8d1",
"eventName": "DescribeCluster",
"eventSource": "eks.amazonaws.com",
"eventTime": "2021-07-07T18:46:33Z",
"eventType": "AwsApiCall",
"eventVersion": "1.08",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "797507667711",
"requestID": "41e98497-76cd-4099-b1b4-06620dddebe9",
"requestParameters": {
"name": "Cluster_Galah"
},
"responseElements": null,
"sourceIPAddress": "213.205.197.211",
"userAgent": "aws-internal/3 aws-sdk-java/1.11.1030 Linux/5.4.109-57.182.amzn2int.x86_64 OpenJDK_64-Bit_Server_VM/25.292-b10 java/1.8.0_292 vendor/Oracle_Corporation cfg/retry-mode/legacy",
"userIdentity": {
"accessKeyId": "ASIA3TLZJI3732PVWTVV",
"accountId": "797507667711",
"arn": "arn:aws:iam::797507667711:user/bruce",
"principalId": "AIDA3TLZJI372XH6M2Q25",
"sessionContext": {
"attributes": {
"creationDate": "2021-07-07T11:45:11Z",
"mfaAuthenticated": "false"
},
"sessionIssuer": {},
"webIdFederationData": {}
},
"type": "IAMUser",
"userName": "bruce"
}
}
References #
DescribeClusterVersions
#Description
Lists available Kubernetes versions for Amazon EKS clusters.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"eventCategory": "Management",
"eventID": "6a55d90b-4421-46bc-98cc-b9c9eea72f2a",
"eventName": "DescribeClusterVersions",
"eventSource": "eks.amazonaws.com",
"eventTime": "2026-06-29T18:31:55Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "123456789012",
"requestID": "c28de985-d9d4-499e-9c44-40f2080f6f2a",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
DescribeEksAnywhereSubscription
#Description
Returns descriptive information about a subscription.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "ResourceNotFoundException",
"eventCategory": "Management",
"eventID": "20daf8fa-ff17-4141-a0d4-f006cf0fd4a7",
"eventName": "DescribeEksAnywhereSubscription",
"eventSource": "eks.amazonaws.com",
"eventTime": "2026-06-29T18:43:25Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "123456789012",
"requestID": "48289e74-af9b-44ce-8455-89584ddfb6d5",
"requestParameters": {
"id": "dw-probe"
},
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
DescribeFargateProfile
#Description
Describes an Fargate profile.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "ResourceNotFoundException",
"eventCategory": "Management",
"eventID": "3c99b0b1-c092-4415-a9c7-7651b35f58ae",
"eventName": "DescribeFargateProfile",
"eventSource": "eks.amazonaws.com",
"eventTime": "2026-06-29T18:43:25Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "123456789012",
"requestID": "b6668fe8-060f-4dc1-9d84-56507182a798",
"requestParameters": {
"fargateProfileName": "dw-probe",
"name": "dw-probe"
},
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
DescribeIdentityProviderConfig
#Description
Describes an identity provider configuration.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "InvalidParameterException",
"eventCategory": "Management",
"eventID": "50a61a78-8d52-4590-854f-d7ab24cc36b4",
"eventName": "DescribeIdentityProviderConfig",
"eventSource": "eks.amazonaws.com",
"eventTime": "2026-06-29T18:43:25Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "123456789012",
"requestID": "401e6714-a76f-40e3-ae13-826fcafc4de4",
"requestParameters": {
"identityProviderConfig": {
"name": "dw-probe",
"type": "dw-probe"
},
"name": "dw-probe"
},
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
DescribeInsight
#Description
Returns details about an insight that you specify using its ID.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "ResourceNotFoundException",
"eventCategory": "Management",
"eventID": "152b67aa-bb85-4c61-8ffd-9dcd1552e9d4",
"eventName": "DescribeInsight",
"eventSource": "eks.amazonaws.com",
"eventTime": "2026-06-29T18:43:25Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "123456789012",
"requestID": "f1ff6c1b-4d8c-43d7-8863-6743c66f8811",
"requestParameters": {
"id": "dw-probe",
"name": "dw-probe"
},
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
DescribeInsightsRefresh
#Description
Returns the status of the latest on-demand cluster insights refresh operation.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "ResourceNotFoundException",
"eventCategory": "Management",
"eventID": "69492bee-e79a-4766-8c88-68adfd8e945f",
"eventName": "DescribeInsightsRefresh",
"eventSource": "eks.amazonaws.com",
"eventTime": "2026-06-29T18:43:25Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "123456789012",
"requestID": "50c5b768-3b3b-4cf7-a98a-8c4d07769925",
"requestParameters": {
"name": "dw-probe"
},
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
DescribeNodegroup
#Description
Describes a managed node group.
Example CloudTrail Event #
{
"awsRegion": "us-east-2",
"eventCategory": "Management",
"eventID": "6ac21ae9-8d05-4beb-8fcf-05427d2c83a6",
"eventName": "DescribeNodegroup",
"eventSource": "eks.amazonaws.com",
"eventTime": "2021-07-07T18:46:11Z",
"eventType": "AwsApiCall",
"eventVersion": "1.08",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "797507667711",
"requestID": "87e4b0fd-f88a-4137-b7dd-bd676ff6fbea",
"requestParameters": {
"name": "Cluster_Galah",
"nodegroupName": "EKS_Node1"
},
"responseElements": null,
"sourceIPAddress": "213.205.197.211",
"userAgent": "aws-internal/3 aws-sdk-java/1.11.1030 Linux/5.4.109-57.182.amzn2int.x86_64 OpenJDK_64-Bit_Server_VM/25.292-b10 java/1.8.0_292 vendor/Oracle_Corporation cfg/retry-mode/legacy",
"userIdentity": {
"accessKeyId": "ASIA3TLZJI3732PVWTVV",
"accountId": "797507667711",
"arn": "arn:aws:iam::797507667711:user/bruce",
"principalId": "AIDA3TLZJI372XH6M2Q25",
"sessionContext": {
"attributes": {
"creationDate": "2021-07-07T11:45:11Z",
"mfaAuthenticated": "false"
},
"sessionIssuer": {},
"webIdFederationData": {}
},
"type": "IAMUser",
"userName": "bruce"
}
}
References #
DescribePodIdentityAssociation
#Description
Returns descriptive information about an EKS Pod Identity association.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "InvalidParameterException",
"eventCategory": "Management",
"eventID": "29a11af2-1f19-4c72-a675-1ab79098c958",
"eventName": "DescribePodIdentityAssociation",
"eventSource": "eks.amazonaws.com",
"eventTime": "2026-06-29T18:43:25Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "123456789012",
"requestID": "9c4e7a23-1ecc-4d49-86be-20a7d854247b",
"requestParameters": {
"associationId": "dw-probe",
"name": "dw-probe"
},
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
DescribeUpdate
#Description
Describes an update to an Amazon EKS resource.
Example CloudTrail Event #
{
"awsRegion": "us-east-2",
"eventCategory": "Management",
"eventID": "11b53d72-4d37-480d-9e95-6e0dae75d68b",
"eventName": "DescribeUpdate",
"eventSource": "eks.amazonaws.com",
"eventTime": "2021-07-07T18:46:11Z",
"eventType": "AwsApiCall",
"eventVersion": "1.08",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "797507667711",
"requestID": "0656058b-7193-4a1f-9b3a-44ba94bc446c",
"requestParameters": {
"name": "Cluster_Galah",
"updateId": "11417a7b-9a62-4e02-8ec9-9be159d3e527"
},
"responseElements": null,
"sourceIPAddress": "213.205.197.211",
"userAgent": "aws-internal/3 aws-sdk-java/1.11.1030 Linux/5.4.109-57.182.amzn2int.x86_64 OpenJDK_64-Bit_Server_VM/25.292-b10 java/1.8.0_292 vendor/Oracle_Corporation cfg/retry-mode/legacy",
"userIdentity": {
"accessKeyId": "ASIA3TLZJI3732PVWTVV",
"accountId": "797507667711",
"arn": "arn:aws:iam::797507667711:user/bruce",
"principalId": "AIDA3TLZJI372XH6M2Q25",
"sessionContext": {
"attributes": {
"creationDate": "2021-07-07T11:45:11Z",
"mfaAuthenticated": "false"
},
"sessionIssuer": {},
"webIdFederationData": {}
},
"type": "IAMUser",
"userName": "bruce"
}
}
References #
DisassociateIdentityProviderConfig
#Description
Disassociates an identity provider configuration from a cluster.
CloudTrail management event, logged by default.Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "InvalidParameterException",
"eventCategory": "Management",
"eventID": "a88709bc-b2fb-4bc5-855b-b158fc99194f",
"eventName": "DisassociateIdentityProviderConfig",
"eventSource": "eks.amazonaws.com",
"eventTime": "2026-06-29T19:23:16Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "123456789012",
"requestID": "676e2ba3-2f5b-4ac0-a210-f1f3d32a0994",
"requestParameters": {
"clientRequestToken": "c1dc2858-5d5f-4aa0-adb1-7b4a802661ae",
"identityProviderConfig": {
"name": "dw-probe",
"type": "dw-probe"
},
"name": "dw-probe"
},
"responseElements": {
"message": "Unsupported Identity provider config type."
},
"sourceIPAddress": "203.0.113.5",
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
ListAccessEntries
#Description
Lists the access entries for your cluster.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "ResourceNotFoundException",
"eventCategory": "Management",
"eventID": "4c02dcec-aa21-475c-adaa-ab3a1f82e298",
"eventName": "ListAccessEntries",
"eventSource": "eks.amazonaws.com",
"eventTime": "2026-06-29T18:43:25Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "123456789012",
"requestID": "96e443b4-138a-4094-aeba-6ec06ed9f2a3",
"requestParameters": {
"name": "dw-probe"
},
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
ListAccessPolicies
#Description
Lists the available access policies.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"eventCategory": "Management",
"eventID": "674cd228-d950-4baf-ab32-d40404452755",
"eventName": "ListAccessPolicies",
"eventSource": "eks.amazonaws.com",
"eventTime": "2026-06-29T18:31:55Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "123456789012",
"requestID": "9017a3f6-6f6e-49c6-85aa-3bb937abc502",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
ListAddons
#Description
Lists the installed add-ons.
Example CloudTrail Event #
{
"awsRegion": "us-east-2",
"eventCategory": "Management",
"eventID": "04a509df-d503-490f-ac17-405048c03fde",
"eventName": "ListAddons",
"eventSource": "eks.amazonaws.com",
"eventTime": "2021-07-07T18:46:52Z",
"eventType": "AwsApiCall",
"eventVersion": "1.08",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "797507667711",
"requestID": "23e9a4e5-72d9-444c-b226-e8d9dab76888",
"requestParameters": {
"name": "Cluster_Galah"
},
"responseElements": null,
"sourceIPAddress": "213.205.197.211",
"userAgent": "aws-internal/3 aws-sdk-java/1.11.1030 Linux/5.4.109-57.182.amzn2int.x86_64 OpenJDK_64-Bit_Server_VM/25.292-b10 java/1.8.0_292 vendor/Oracle_Corporation cfg/retry-mode/legacy",
"userIdentity": {
"accessKeyId": "ASIA3TLZJI3732PVWTVV",
"accountId": "797507667711",
"arn": "arn:aws:iam::797507667711:user/bruce",
"principalId": "AIDA3TLZJI372XH6M2Q25",
"sessionContext": {
"attributes": {
"creationDate": "2021-07-07T11:45:11Z",
"mfaAuthenticated": "false"
},
"sessionIssuer": {},
"webIdFederationData": {}
},
"type": "IAMUser",
"userName": "bruce"
}
}
References #
ListAssociatedAccessPolicies
#Description
Lists the access policies associated with an access entry.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "InvalidParameterException",
"eventCategory": "Management",
"eventID": "838aac24-4149-435a-bab2-9ebf5622931a",
"eventName": "ListAssociatedAccessPolicies",
"eventSource": "eks.amazonaws.com",
"eventTime": "2026-06-29T18:43:25Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "123456789012",
"requestID": "fa91eafa-a44e-4d56-9a89-5197e8d5034c",
"requestParameters": {
"name": "dw-probe",
"principalArn": "dw-probe"
},
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
ListCapabilities
#Description
Lists all managed capabilities in your Amazon EKS cluster.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "ResourceNotFoundException",
"eventCategory": "Management",
"eventID": "b2d7c775-15e1-4e73-8690-fbd770d1f625",
"eventName": "ListCapabilities",
"eventSource": "eks.amazonaws.com",
"eventTime": "2026-06-29T18:43:25Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "123456789012",
"requestID": "13708037-8cc8-4f93-a776-5ee143aa5418",
"requestParameters": {
"name": "dw-probe"
},
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
ListClusters
#Description
Lists the Amazon EKS clusters in your Amazon Web Services account in the specified Amazon Web Services Region.
Example CloudTrail Event #
{
"awsRegion": "us-east-2",
"eventCategory": "Management",
"eventID": "fa00f475-3280-4a03-8e4c-c094f65dfcbf",
"eventName": "ListClusters",
"eventSource": "eks.amazonaws.com",
"eventTime": "2021-07-07T18:45:14Z",
"eventType": "AwsApiCall",
"eventVersion": "1.08",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "797507667711",
"requestID": "20c8e226-debf-45e0-82d0-704f74d3ba6c",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "213.205.197.211",
"userAgent": "aws-internal/3 aws-sdk-java/1.11.1030 Linux/5.4.109-57.182.amzn2int.x86_64 OpenJDK_64-Bit_Server_VM/25.292-b10 java/1.8.0_292 vendor/Oracle_Corporation cfg/retry-mode/legacy",
"userIdentity": {
"accessKeyId": "ASIA3TLZJI3732PVWTVV",
"accountId": "797507667711",
"arn": "arn:aws:iam::797507667711:user/bruce",
"principalId": "AIDA3TLZJI372XH6M2Q25",
"sessionContext": {
"attributes": {
"creationDate": "2021-07-07T11:45:11Z",
"mfaAuthenticated": "false"
},
"sessionIssuer": {},
"webIdFederationData": {}
},
"type": "IAMUser",
"userName": "bruce"
}
}
References #
ListEksAnywhereSubscriptions
#Description
Displays the full description of the subscription.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"eventCategory": "Management",
"eventID": "a073823f-5884-4bd2-8b5c-3e8716df7b29",
"eventName": "ListEksAnywhereSubscriptions",
"eventSource": "eks.amazonaws.com",
"eventTime": "2026-06-29T18:31:56Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "123456789012",
"requestID": "52958960-7ceb-498e-aea8-fb1c21cea70e",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
ListFargateProfiles
#Description
Lists the Fargate profiles associated with the specified cluster in your Amazon Web Services account in the specified Amazon Web Services Region.
Example CloudTrail Event #
{
"awsRegion": "us-east-2",
"eventCategory": "Management",
"eventID": "e78e8174-6720-487b-83f9-b01652c967c9",
"eventName": "ListFargateProfiles",
"eventSource": "eks.amazonaws.com",
"eventTime": "2021-07-07T18:45:17Z",
"eventType": "AwsApiCall",
"eventVersion": "1.08",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "797507667711",
"requestID": "0002a071-90ac-4756-83ad-743c740ff3ef",
"requestParameters": {
"name": "Cluster_Galah"
},
"responseElements": null,
"sourceIPAddress": "213.205.197.211",
"userAgent": "aws-internal/3 aws-sdk-java/1.11.1030 Linux/5.4.109-57.182.amzn2int.x86_64 OpenJDK_64-Bit_Server_VM/25.292-b10 java/1.8.0_292 vendor/Oracle_Corporation cfg/retry-mode/legacy",
"userIdentity": {
"accessKeyId": "ASIA3TLZJI3732PVWTVV",
"accountId": "797507667711",
"arn": "arn:aws:iam::797507667711:user/bruce",
"principalId": "AIDA3TLZJI372XH6M2Q25",
"sessionContext": {
"attributes": {
"creationDate": "2021-07-07T11:45:11Z",
"mfaAuthenticated": "false"
},
"sessionIssuer": {},
"webIdFederationData": {}
},
"type": "IAMUser",
"userName": "bruce"
}
}
References #
ListIdentityProviderConfigs
#Description
Lists the identity provider configurations for your cluster.
Example CloudTrail Event #
{
"awsRegion": "us-east-2",
"eventCategory": "Management",
"eventID": "d3c5546e-6cc7-4154-bfcb-ff3024b09f44",
"eventName": "ListIdentityProviderConfigs",
"eventSource": "eks.amazonaws.com",
"eventTime": "2021-07-07T18:45:17Z",
"eventType": "AwsApiCall",
"eventVersion": "1.08",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "797507667711",
"requestID": "66db5fda-5758-471c-a288-6dc66176432b",
"requestParameters": {
"name": "Cluster_Galah"
},
"responseElements": null,
"sourceIPAddress": "213.205.197.211",
"userAgent": "aws-internal/3 aws-sdk-java/1.11.1030 Linux/5.4.109-57.182.amzn2int.x86_64 OpenJDK_64-Bit_Server_VM/25.292-b10 java/1.8.0_292 vendor/Oracle_Corporation cfg/retry-mode/legacy",
"userIdentity": {
"accessKeyId": "ASIA3TLZJI3732PVWTVV",
"accountId": "797507667711",
"arn": "arn:aws:iam::797507667711:user/bruce",
"principalId": "AIDA3TLZJI372XH6M2Q25",
"sessionContext": {
"attributes": {
"creationDate": "2021-07-07T11:45:11Z",
"mfaAuthenticated": "false"
},
"sessionIssuer": {},
"webIdFederationData": {}
},
"type": "IAMUser",
"userName": "bruce"
}
}
References #
ListInsights
#Description
Returns a list of all insights checked for against the specified cluster.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "ResourceNotFoundException",
"eventCategory": "Management",
"eventID": "9c45b3cf-fa32-494e-98f9-adc9dbd7c205",
"eventName": "ListInsights",
"eventSource": "eks.amazonaws.com",
"eventTime": "2026-06-29T18:43:25Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "123456789012",
"requestID": "aad853a0-6d9b-49e7-9977-ec6ea24085c5",
"requestParameters": {
"name": "dw-probe"
},
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
ListNodegroups
#Description
Lists the managed node groups associated with the specified cluster in your Amazon Web Services account in the specified Amazon Web Services Region.
Example CloudTrail Event #
{
"awsRegion": "us-east-2",
"eventCategory": "Management",
"eventID": "65c0a092-53f8-4ecf-8f9e-15cbc6a3eee8",
"eventName": "ListNodegroups",
"eventSource": "eks.amazonaws.com",
"eventTime": "2021-07-07T18:46:11Z",
"eventType": "AwsApiCall",
"eventVersion": "1.08",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "797507667711",
"requestID": "c73096ea-9b32-4f6f-a16a-d0988d968dff",
"requestParameters": {
"name": "Cluster_Galah"
},
"responseElements": null,
"sourceIPAddress": "213.205.197.211",
"userAgent": "aws-internal/3 aws-sdk-java/1.11.1030 Linux/5.4.109-57.182.amzn2int.x86_64 OpenJDK_64-Bit_Server_VM/25.292-b10 java/1.8.0_292 vendor/Oracle_Corporation cfg/retry-mode/legacy",
"userIdentity": {
"accessKeyId": "ASIA3TLZJI3732PVWTVV",
"accountId": "797507667711",
"arn": "arn:aws:iam::797507667711:user/bruce",
"principalId": "AIDA3TLZJI372XH6M2Q25",
"sessionContext": {
"attributes": {
"creationDate": "2021-07-07T11:45:11Z",
"mfaAuthenticated": "false"
},
"sessionIssuer": {},
"webIdFederationData": {}
},
"type": "IAMUser",
"userName": "bruce"
}
}
References #
ListPodIdentityAssociations
#Description
List the EKS Pod Identity associations in a cluster.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "ResourceNotFoundException",
"eventCategory": "Management",
"eventID": "574a4706-6969-4da4-84a0-3b498bd1f225",
"eventName": "ListPodIdentityAssociations",
"eventSource": "eks.amazonaws.com",
"eventTime": "2026-06-29T18:43:25Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "123456789012",
"requestID": "d8b2db9b-c316-4d14-b2ed-abbc35d03d68",
"requestParameters": {
"name": "dw-probe"
},
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
ListUpdates
#Description
Lists the updates associated with an Amazon EKS resource in your Amazon Web Services account, in the specified Amazon Web Services Region.
Example CloudTrail Event #
{
"awsRegion": "us-east-2",
"eventCategory": "Management",
"eventID": "22cf3347-2a65-416b-8989-925064fc98ac",
"eventName": "ListUpdates",
"eventSource": "eks.amazonaws.com",
"eventTime": "2021-07-07T18:46:11Z",
"eventType": "AwsApiCall",
"eventVersion": "1.08",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "797507667711",
"requestID": "1e462ca3-9b55-40e2-a76a-39303ee579c7",
"requestParameters": {
"name": "Cluster_Galah"
},
"responseElements": null,
"sourceIPAddress": "213.205.197.211",
"userAgent": "aws-internal/3 aws-sdk-java/1.11.1030 Linux/5.4.109-57.182.amzn2int.x86_64 OpenJDK_64-Bit_Server_VM/25.292-b10 java/1.8.0_292 vendor/Oracle_Corporation cfg/retry-mode/legacy",
"userIdentity": {
"accessKeyId": "ASIA3TLZJI3732PVWTVV",
"accountId": "797507667711",
"arn": "arn:aws:iam::797507667711:user/bruce",
"principalId": "AIDA3TLZJI372XH6M2Q25",
"sessionContext": {
"attributes": {
"creationDate": "2021-07-07T11:45:11Z",
"mfaAuthenticated": "false"
},
"sessionIssuer": {},
"webIdFederationData": {}
},
"type": "IAMUser",
"userName": "bruce"
}
}
References #
RegisterCluster
#Description
Connects a Kubernetes cluster to the Amazon EKS control plane.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "InvalidRequestException",
"eventCategory": "Management",
"eventID": "5833e61c-e401-4656-8360-63fc25d48de1",
"eventName": "RegisterCluster",
"eventSource": "eks.amazonaws.com",
"eventTime": "2026-06-29T21:54:29Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "123456789012",
"requestID": "67e71640-3e27-4be1-8672-50cb589aaacb",
"requestParameters": {
"clientRequestToken": "44da4fd2-f151-4557-8516-e66145c3dcb7",
"connectorConfig": {
"provider": "OTHER",
"roleArn": "arn:aws:iam::123456789012:role/dwfix-eks-connector-role"
},
"name": "dwfix-eks-registered",
"tags": {
"project": "dwfix"
}
},
"responseElements": {
"message": "Nonexistent role or missing ssm service principal in trust policy: arn:aws:iam::123456789012:role/dwfix-eks-connector-role (Service: EksExternalClusterManager, Status Code: 400, Request ID: 4e70aa55-8d6a-4369-abe2-63d163d4db3e) (SDK Attempt Count: 1)"
},
"sourceIPAddress": "203.0.113.5",
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b,n cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
StartInsightsRefresh
#Description
Initiates an on-demand refresh operation for cluster insights, getting the latest analysis outside of the standard refresh schedule.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "ResourceNotFoundException",
"eventCategory": "Management",
"eventID": "6a244926-ce00-485d-a801-4085bb88f706",
"eventName": "StartInsightsRefresh",
"eventSource": "eks.amazonaws.com",
"eventTime": "2026-06-29T22:47:47Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "123456789012",
"requestID": "ce67c047-6f06-4632-9d4f-92b62d1bda1f",
"requestParameters": {
"name": "dwfix-eks-heavy"
},
"responseElements": {
"message": "The cluster isn't available yet for cluster insights. Wait up to 15 minutes and try again. (Service: EksClusterInsights, Status Code: 404, Request ID: 11cf034b-376e-4d73-a9f1-d5e36f33bece) (SDK Attempt Count: 1)"
},
"sourceIPAddress": "203.0.113.5",
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
TagResource
#Description
Associates the specified tags to an Amazon EKS resource with the specified resourceArn.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"eventCategory": "Management",
"eventID": "fc81f3dd-352c-49ee-a35d-16313e289a18",
"eventName": "TagResource",
"eventSource": "eks.amazonaws.com",
"eventTime": "2026-06-29T22:46:24Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "123456789012",
"requestID": "7f573614-dae8-49f2-95e9-dada4dabccfc",
"requestParameters": {
"resourceArn": "arn:aws:eks:us-west-1:123456789012:cluster/dwfix-eks-heavy",
"tags": {
"dwfix-sweep": "auto-collector"
}
},
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
UntagResource
#Description
Deletes specified tags from an Amazon EKS resource.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "BadRequestException",
"eventCategory": "Management",
"eventID": "421d493c-1982-420a-844c-dc7b8ca0a4db",
"eventName": "UntagResource",
"eventSource": "eks.amazonaws.com",
"eventTime": "2026-06-29T19:23:16Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "123456789012",
"requestID": "33adb4a9-61de-44ba-a4ca-d7320276e33a",
"requestParameters": {
"resourceArn": "dw-probe",
"tagKeys": "ddddd"
},
"responseElements": {
"message": "Invalid input resource arn: bad syntax"
},
"sourceIPAddress": "203.0.113.5",
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
UpdateAddon
#Description
Updates an Amazon EKS add-on.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "ResourceNotFoundException",
"eventCategory": "Management",
"eventID": "358d9979-e51c-48a1-a244-21d0527a7115",
"eventName": "UpdateAddon",
"eventSource": "eks.amazonaws.com",
"eventTime": "2026-06-29T19:23:16Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "123456789012",
"requestID": "9a390595-8f3f-42c5-ab06-9aa5a9412f2b",
"requestParameters": {
"addonName": "dw-probe",
"clientRequestToken": "df3f8caf-34aa-4098-940a-c69c36f28bf6",
"name": "ddddd"
},
"responseElements": {
"clusterName": "ddddd",
"message": "No cluster found for name: ddddd."
},
"sourceIPAddress": "203.0.113.5",
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
UpdateCapability
#Description
Updates the configuration of a managed capability in your Amazon EKS cluster.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "ResourceNotFoundException",
"eventCategory": "Management",
"eventID": "e7dc3c92-7e80-459f-827f-2e56eb568c3e",
"eventName": "UpdateCapability",
"eventSource": "eks.amazonaws.com",
"eventTime": "2026-06-29T19:23:16Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "123456789012",
"requestID": "c8ff9ed8-f1cd-4a9d-bc8f-5690a29ade2d",
"requestParameters": {
"capabilityName": "dw-probe",
"clientRequestToken": "1a4d80ca-0573-4ef2-8f97-6400849c907a",
"name": "dw-probe"
},
"resources": [
{
"ARN": "arn:aws:eks:us-west-1:123456789012:capability/dw-probe/dw-probe/*",
"accountId": "123456789012",
"type": "AWS::EKS::Capability"
}
],
"responseElements": {
"clusterName": "dw-probe",
"message": "No cluster found for name: dw-probe."
},
"sourceIPAddress": "203.0.113.5",
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
UpdateClusterVersion
#Description
Updates an Amazon EKS cluster to the specified Kubernetes version.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "ResourceNotFoundException",
"eventCategory": "Management",
"eventID": "35656e45-5736-43fc-869f-89fdbd12d931",
"eventName": "UpdateClusterVersion",
"eventSource": "eks.amazonaws.com",
"eventTime": "2026-06-29T19:23:16Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "123456789012",
"requestID": "5f450ae1-36ed-4db0-90e2-e5a70b07c559",
"requestParameters": {
"clientRequestToken": "d832a899-cca6-49a5-996b-6fba28ead5b1",
"name": "dw-probe",
"version": "dw-probe"
},
"responseElements": {
"clusterName": "dw-probe",
"message": "No cluster found for name: dw-probe."
},
"sourceIPAddress": "203.0.113.5",
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
UpdateEksAnywhereSubscription
#Description
Update an EKS Anywhere Subscription.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "ResourceNotFoundException",
"eventCategory": "Management",
"eventID": "470a9431-ee2d-4097-add1-e30d8ee7a1a2",
"eventName": "UpdateEksAnywhereSubscription",
"eventSource": "eks.amazonaws.com",
"eventTime": "2026-06-29T19:23:16Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "123456789012",
"requestID": "a7fd93c3-dfc2-42df-bc59-42793d9ae160",
"requestParameters": {
"autoRenew": false,
"clientRequestToken": "7753a934-1d6f-41ce-a4bc-379bdd560478",
"id": "dw-probe"
},
"responseElements": {
"message": "subscription not found."
},
"sourceIPAddress": "203.0.113.5",
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
UpdateNodegroupConfig
#Description
Updates an Amazon EKS managed node group configuration.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "ResourceNotFoundException",
"eventCategory": "Management",
"eventID": "a5349636-b241-4fb2-809a-e735833ad311",
"eventName": "UpdateNodegroupConfig",
"eventSource": "eks.amazonaws.com",
"eventTime": "2026-06-29T19:23:16Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "123456789012",
"requestID": "45b13ae1-f558-4303-8a92-71431f60ff72",
"requestParameters": {
"clientRequestToken": "5989e747-fd8e-4eee-868e-6ad7212096ac",
"name": "dw-probe",
"nodegroupName": "dw-probe"
},
"responseElements": {
"clusterName": "dw-probe",
"message": "No cluster found for name: dw-probe."
},
"sourceIPAddress": "203.0.113.5",
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
UpdateNodegroupVersion
#Description
Updates the Kubernetes version or AMI version of an Amazon EKS managed node group.
Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "ResourceNotFoundException",
"eventCategory": "Management",
"eventID": "5a802aca-c594-4e36-93a2-1c8b1e0ea336",
"eventName": "UpdateNodegroupVersion",
"eventSource": "eks.amazonaws.com",
"eventTime": "2026-06-29T19:23:16Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "123456789012",
"requestID": "7a262007-b0fe-4b5f-8735-f38ecec894dd",
"requestParameters": {
"clientRequestToken": "b5f644d5-4c61-41b1-b003-7fde36b821e9",
"name": "dw-probe",
"nodegroupName": "dw-probe"
},
"responseElements": {
"clusterName": "dw-probe",
"message": "No cluster found for name: dw-probe."
},
"sourceIPAddress": "203.0.113.5",
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
UpdatePodIdentityAssociation
#Description
Updates a EKS Pod Identity association.
CloudTrail management event, logged by default.Example CloudTrail Event #
{
"awsRegion": "us-west-1",
"errorCode": "InvalidParameterException",
"eventCategory": "Management",
"eventID": "c93ade74-20d7-45b6-bfc1-90ee264039dd",
"eventName": "UpdatePodIdentityAssociation",
"eventSource": "eks.amazonaws.com",
"eventTime": "2026-06-29T19:23:16Z",
"eventType": "AwsApiCall",
"eventVersion": "1.11",
"managementEvent": true,
"readOnly": false,
"recipientAccountId": "123456789012",
"requestID": "cee1ac75-4e23-4006-8296-e15057b5fd84",
"requestParameters": {
"associationId": "dw-probe",
"clientRequestToken": "42736a36-4400-4a54-ab63-de00f2a18536",
"name": "dw-probe"
},
"responseElements": {
"clusterName": "dw-probe",
"message": "The parameter associationId should be 19 characters long."
},
"sourceIPAddress": "203.0.113.5",
"userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
"userIdentity": {
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:user/sample-user",
"principalId": "AIDAEXAMPLE00000000",
"type": "IAMUser",
"userName": "sample-user"
}
}
AccessKubernetesApi
#Description
AccessKubernetesApi recorded by CloudTrail for Amazon Elastic Kubernetes Service. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.
Example CloudTrail Event #
This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.
{
"eventVersion": "1.11",
"eventID": "a57d4391-0e29-4017-91b5-f23bcc4777cb",
"eventSource": "eks.amazonaws.com",
"eventName": "AccessKubernetesApi",
"awsRegion": "us-east-1",
"eventType": "AwsApiCall",
"readOnly": true,
"managementEvent": true,
"requestID": "de15970a-29b3-4bc4-8b50-8087b179e8da",
"userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:153.0) Gecko/20100101 Firefox/153.0"
}
CancelUpdate
#Description
Cancels an in-progress update to an Amazon EKS cluster on a best-effort basis.