Elastic File System

eventName	Description	Sample	Rule
any	Catch-all entry for Elastic File System rules that match the service but not a specific eventName.	N	N
DeleteFileSystem	Permanently deletes an Amazon EFS file system, which must have no mount targets or access points remaining.	Y	Y
DeleteMountTarget	Deletes an EFS mount target, which terminates network connectivity for the associated file system in that subnet.	Y	Y
CreateAccessPoint	Creates an EFS access point.	Y	N
CreateFileSystem	Creates a new, empty file system.	Y	N
CreateMountTarget	Creates a mount target for a file system.	Y	N
CreateReplicationConfiguration	Creates a replication conﬁguration to either a new or existing EFS file system.	N	N
CreateTags	DEPRECATED - CreateTags is deprecated and not maintained.	Y	N
DeleteAccessPoint	Deletes the specified access point.	N	N
DeleteFileSystemPolicy	Deletes the FileSystemPolicy for the specified file system.	Y	N
DeleteReplicationConfiguration	Deletes a replication configuration.	N	N
DeleteTags	DEPRECATED - DeleteTags is deprecated and not maintained.	Y	N
DescribeAccessPoints	Returns the description of a specific Amazon EFS access point if the AccessPointId is provided.	Y	N
DescribeAccountPreferences	Returns the account preferences settings for the Amazon Web Services account associated with the user making the request, in the current Amazon Web Services Region.	Y	N
DescribeBackupPolicy	Returns the backup policy for the specified EFS file system.	N	N
DescribeFileSystemPolicy	Returns the FileSystemPolicy for the specified EFS file system.	N	N
DescribeFileSystems	Returns the description of a specific Amazon EFS file system if either the file system CreationToken or the FileSystemId is provided.	Y	N
DescribeLifecycleConfiguration	Returns the current LifecycleConfiguration object for the specified EFS file system.	N	N
DescribeMountTargets	Returns the descriptions of all the current mount targets, or a specific mount target, for a file system.	Y	N
DescribeMountTargetSecurityGroups	Returns the security groups currently in effect for a mount target.	N	N
DescribeReplicationConfigurations	Retrieves the replication configuration for a specific file system.	Y	N
DescribeTags	DEPRECATED - The DescribeTags action is deprecated and not maintained.	N	N
ListTagsForResource	Lists all tags for a top-level EFS resource.	N	N
ModifyMountTargetSecurityGroups	Modifies the set of security groups in effect for a mount target.	Y	N
PutAccountPreferences	Use this operation to set the account preference in the current Amazon Web Services Region to use long 17 character (63 bit) or short 8 character (32 bit) resource IDs for new EFS file system and mount target resources.	Y	N
PutBackupPolicy	Updates the file system's backup policy.	Y	N
PutFileSystemPolicy	Applies an Amazon EFS FileSystemPolicy to an Amazon EFS file system.	Y	N
PutLifecycleConfiguration	Use this action to manage storage for your file system.	Y	N
TagResource	Creates a tag for an EFS resource.	Y	N
UntagResource	Removes tags from an EFS resource.	Y	N
UpdateFileSystem	Updates the throughput mode or the amount of provisioned throughput of an existing file system.	Y	N
UpdateFileSystemProtection	Updates protection on the file system.	Y	N
NewClientConnection	NewClientConnection recorded by CloudTrail for Amazon Elastic File System. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.	N	N

any: Elastic File System (catch-all)

Service: elasticfilesystem

Description

Catch-all entry for Elastic File System rules that match the service but not a specific eventName.

DeleteFileSystem

Service: elasticfilesystem

Description

Permanently deletes an Amazon EFS file system, which must have no mount targets or access points remaining.

Example CloudTrail Event #

{
  "apiVersion": "2015-02-01",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "05b12f89-c090-4df9-ba12-f209cefa7d2e",
  "eventName": "DeleteFileSystem",
  "eventSource": "elasticfilesystem.amazonaws.com",
  "eventTime": "2026-06-29T21:04:47Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "ab166884-3cc1-4570-ae13-fe5497d7f48c",
  "requestParameters": {
    "fileSystemId": "fs-0f48ebdbc4da91cd6"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "elasticfilesystem.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

AWS EFS Fileshare Modified or Deleted source medium: Detects when a EFS Fileshare is modified or deleted. You can't delete a file system that is in use. If the file system has any mount targets, the adversary must first delete them, so deletion of a mount will occur before deletion of a fileshare.

Elastic #

AWS EFS File System Deleted source medium: Identifies the deletion of an Amazon EFS file system using the "DeleteFileSystem" API operation. Deleting an EFS file system permanently removes all stored data and cannot be reversed. This action is rare in most environments and typically limited to controlled teardown workflows. Adversaries with sufficient permissions may delete a file system to destroy evidence, disrupt workloads, or impede recovery efforts.T1485

DeleteMountTarget

Service: elasticfilesystem

Description

Deletes an EFS mount target, which terminates network connectivity for the associated file system in that subnet.

Example CloudTrail Event #

{
  "apiVersion": "2015-02-01",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "79ba5d4d-cdc4-4cdb-91b2-3bb04fec1ce0",
  "eventName": "DeleteMountTarget",
  "eventSource": "elasticfilesystem.amazonaws.com",
  "eventTime": "2026-06-29T21:04:24Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "3794b453-659b-4db9-aa82-2016b5710320",
  "requestParameters": {
    "mountTargetId": "fsmt-0d0364c7d64747a0e"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "elasticfilesystem.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

AWS EFS Fileshare Mount Modified or Deleted source medium: Detects when a EFS Fileshare Mount is modified or deleted. An adversary breaking any file system using the mount target that is being deleted, which might disrupt instances or applications using those mounts.T1485

CreateAccessPoint

Service: elasticfilesystem

Description

Creates an EFS access point.

Example CloudTrail Event #

{
  "apiVersion": "2015-02-01",
  "awsRegion": "us-west-1",
  "errorCode": "BadRequest",
  "errorMessage": "File system is not in an available state.",
  "eventCategory": "Management",
  "eventID": "3b0caca1-36d8-4614-b3ac-278079537830",
  "eventName": "CreateAccessPoint",
  "eventSource": "elasticfilesystem.amazonaws.com",
  "eventTime": "2026-06-29T21:03:03Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "f003c469-a767-4f5a-803f-e75e002907a4",
  "requestParameters": {
    "clientToken": "dwfix-ap-041b6780",
    "fileSystemId": "fs-0f48ebdbc4da91cd6",
    "posixUser": {
      "gid": 1000,
      "uid": 1000
    },
    "rootDirectory": {
      "creationInfo": {
        "ownerGid": 1000,
        "ownerUid": 1000,
        "permissions": "755"
      },
      "path": "/dwfix"
    },
    "tags": [
      {
        "key": "Name",
        "value": "dwfix-ap-041b6780"
      }
    ]
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "elasticfilesystem.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreateFileSystem

Service: elasticfilesystem

Description

Creates a new, empty file system.

Example CloudTrail Event #

{
  "apiVersion": "2015-02-01",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "50b40387-6fe2-4a68-88ac-8107eb0aaba9",
  "eventName": "CreateFileSystem",
  "eventSource": "elasticfilesystem.amazonaws.com",
  "eventTime": "2026-06-29T21:02:56Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "737d30f5-e1f7-4b04-86eb-24e34b511de9",
  "requestParameters": {
    "backup": false,
    "creationToken": "dwfix-efs-041b6780",
    "encrypted": false,
    "performanceMode": "generalPurpose",
    "tags": [
      {
        "key": "Name",
        "value": "dwfix-efs-041b6780"
      },
      {
        "key": "dw-temp",
        "value": "true"
      }
    ],
    "throughputMode": "bursting"
  },
  "responseElements": {
    "creationTime": "2026-06-29T21:02:56Z",
    "creationToken": "dwfix-efs-041b6780",
    "encrypted": false,
    "fileSystemArn": "arn:aws:elasticfilesystem:us-west-1:123456789012:file-system/fs-0f48ebdbc4da91cd6",
    "fileSystemId": "fs-0f48ebdbc4da91cd6",
    "fileSystemProtection": {
      "replicationOverwriteProtection": "ENABLED"
    },
    "lifeCycleState": "creating",
    "name": "dwfix-efs-041b6780",
    "numberOfMountTargets": 0,
    "ownerId": "123456789012",
    "performanceMode": "generalPurpose",
    "sizeInBytes": {
      "value": 0,
      "valueInArchive": 0,
      "valueInIA": 0,
      "valueInStandard": 0
    },
    "tags": [
      {
        "key": "Name",
        "value": "dwfix-efs-041b6780"
      },
      {
        "key": "dw-temp",
        "value": "true"
      }
    ],
    "throughputMode": "bursting"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "elasticfilesystem.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreateMountTarget

Service: elasticfilesystem

Description

Creates a mount target for a file system.

Example CloudTrail Event #

{
  "apiVersion": "2015-02-01",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "e9de0835-e064-430b-ba0e-06077a0644ff",
  "eventName": "CreateMountTarget",
  "eventSource": "elasticfilesystem.amazonaws.com",
  "eventTime": "2026-06-29T21:03:04Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "1bcbeee7-d18c-40e1-81fd-7f70fd6b583b",
  "requestParameters": {
    "fileSystemId": "fs-0f48ebdbc4da91cd6",
    "securityGroups": [
      "sg-063fc1a8302bc48a4"
    ],
    "subnetId": "subnet-0c9f719882f5c95ae"
  },
  "responseElements": {
    "availabilityZoneId": "usw1-az1",
    "availabilityZoneName": "us-west-1a",
    "fileSystemId": "fs-0f48ebdbc4da91cd6",
    "ipAddress": "172.31.26.213",
    "lifeCycleState": "creating",
    "mountTargetId": "fsmt-0d0364c7d64747a0e",
    "networkInterfaceId": "eni-02489f137b533071b",
    "ownerId": "123456789012",
    "subnetId": "subnet-0c9f719882f5c95ae",
    "vpcId": "vpc-0cf63cfb072f7d61f"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "elasticfilesystem.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreateReplicationConfiguration

Service: elasticfilesystem

Description

Creates a replication conﬁguration to either a new or existing EFS file system.

CreateTags

Service: elasticfilesystem

Description

DEPRECATED - CreateTags is deprecated and not maintained.

Example CloudTrail Event #

{
  "apiVersion": "2015-02-01",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "65376b77-fb2a-4c15-ae77-36f97ff02f06",
  "eventName": "CreateTags",
  "eventSource": "elasticfilesystem.amazonaws.com",
  "eventTime": "2026-06-29T21:03:03Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "e02649fb-f941-45ab-9915-221b62e3717a",
  "requestParameters": {
    "fileSystemId": "fs-0f48ebdbc4da91cd6",
    "tags": [
      {
        "key": "dw-legacy-tag",
        "value": "legacy-value"
      }
    ]
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "elasticfilesystem.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteAccessPoint

Service: elasticfilesystem

Description

Deletes the specified access point.

DeleteFileSystemPolicy

Service: elasticfilesystem

Description

Deletes the FileSystemPolicy for the specified file system.

Example CloudTrail Event #

{
  "apiVersion": "2015-02-01",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "6e2503a6-10f5-4dd2-8f7b-a901b77fba86",
  "eventName": "DeleteFileSystemPolicy",
  "eventSource": "elasticfilesystem.amazonaws.com",
  "eventTime": "2026-06-29T21:04:23Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "fbb985df-0624-4907-a34a-46e35c01cb90",
  "requestParameters": {
    "fileSystemId": "fs-0f48ebdbc4da91cd6"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "elasticfilesystem.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteReplicationConfiguration

Service: elasticfilesystem

Description

Deletes a replication configuration.

DeleteTags

Service: elasticfilesystem

Description

DEPRECATED - DeleteTags is deprecated and not maintained.

Example CloudTrail Event #

{
  "apiVersion": "2015-02-01",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "3b02d6b5-5cad-4cd8-abb4-f4cf2388a8eb",
  "eventName": "DeleteTags",
  "eventSource": "elasticfilesystem.amazonaws.com",
  "eventTime": "2026-06-29T21:04:23Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "49e1aa5c-2644-46ad-a102-101073daa8d0",
  "requestParameters": {
    "fileSystemId": "fs-0f48ebdbc4da91cd6",
    "tagKeys": [
      "dw-legacy-tag"
    ]
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "elasticfilesystem.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DescribeAccessPoints

Service: elasticfilesystem

Description

Returns the description of a specific Amazon EFS access point if the AccessPointId is provided.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: elasticfilesystem:DescribeAccessPoints on the specified resource",
  "eventID": "e33af523-7c8e-480d-b88d-c59c48cad8a7",
  "eventName": "DescribeAccessPoints",
  "eventSource": "elasticfilesystem.amazonaws.com",
  "eventTime": "2020-06-10T05:35:00Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "2868b287-f71a-45ef-bb3f-033a556411e7",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "251.105.254.1",
  "userAgent": "Botocore/1.16.26 Python/2.7.18 Linux/5.4.0-2-amd64",
  "userIdentity": {
    "accessKeyId": "AKIA01U43UX3RBRDXF4Q",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/backup",
    "principalId": "AIDA9BO36HFBHKGJAO9C1",
    "type": "IAMUser",
    "userName": "backup"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

DescribeAccountPreferences

Service: elasticfilesystem

Description

Returns the account preferences settings for the Amazon Web Services account associated with the user making the request, in the current Amazon Web Services Region.

Example CloudTrail Event #

{
  "apiVersion": "2015-02-01",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "2ce6fb76-2e61-449d-ab57-852548927eaf",
  "eventName": "DescribeAccountPreferences",
  "eventSource": "elasticfilesystem.amazonaws.com",
  "eventTime": "2026-06-29T18:31:57Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "d0f92e59-4919-453d-ae86-d97c83243100",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "elasticfilesystem.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DescribeBackupPolicy

Service: elasticfilesystem

Description

Returns the backup policy for the specified EFS file system.

Example CloudTrail Event #

This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.

{
  "eventVersion": "1.11",
  "eventID": "832d609b-0807-4410-8b7c-5c4956fe15c9",
  "eventSource": "elasticfilesystem.amazonaws.com",
  "eventName": "DescribeBackupPolicy",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "apiVersion": "2015-02-01",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "0687d5a0-34ec-4260-8a37-30ac7e5ae722",
  "userAgent": "aws-sdk-go-v2/1.43.0 ua/2.1 os/linux lang/go#1.26.5 md/GOOS#linux md/GOARCH#arm64 api/efs#1.40.5 m/E,i",
  "errorCode": "PolicyNotFound",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "example.us-east-1.amazonaws.com"
  }
}

DescribeFileSystemPolicy

Service: elasticfilesystem

Description

Returns the FileSystemPolicy for the specified EFS file system.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "e79d9133-25c5-4768-811d-64ab582cf297",
  "eventSource": "elasticfilesystem.amazonaws.com",
  "eventName": "DescribeFileSystemPolicy",
  "awsRegion": "ca-central-1",
  "eventType": "AwsApiCall",
  "apiVersion": "2015-02-01",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "1eb5f296-0461-4bbd-911b-95ca068f7b9e",
  "userAgent": "aws-sdk-go-v2/1.38.1 ua/2.1 os/linux lang/go#1.25.0 md/GOOS#linux md/GOARCH#arm64 exec-env/AWS_ECS_FARGATE api/efs#1.38.0 app/APN_1.1-pc_70z3wc9b95eq8x71w5uctkf9r$ m/E,i",
  "errorCode": "PolicyNotFound",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "example.ca-central-1.amazonaws.com"
  }
}

DescribeFileSystems

Service: elasticfilesystem

Description

Returns the description of a specific Amazon EFS file system if either the file system CreationToken or the FileSystemId is provided.

Example CloudTrail Event #

{
  "apiVersion": "2015-02-01",
  "awsRegion": "us-east-2",
  "eventCategory": "Management",
  "eventID": "3a34d697-961d-4e13-9e29-da4b853766d1",
  "eventName": "DescribeFileSystems",
  "eventSource": "elasticfilesystem.amazonaws.com",
  "eventTime": "2021-07-07T13:08:54Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "797507667711",
  "requestID": "25831a48-e26b-445a-bdc1-aec604cb73f6",
  "requestParameters": {
    "maxItems": 101
  },
  "responseElements": null,
  "sourceIPAddress": "213.205.197.162",
  "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:89.0) Gecko/20100101 Firefox/89.0",
  "userIdentity": {
    "accessKeyId": "ASIA3TLZJI37TRWHLD2C",
    "accountId": "797507667711",
    "arn": "arn:aws:iam::797507667711:user/bruce",
    "principalId": "AIDA3TLZJI372XH6M2Q25",
    "sessionContext": {
      "attributes": {
        "creationDate": "2021-07-07T11:45:11Z",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {},
      "webIdFederationData": {}
    },
    "type": "IAMUser",
    "userName": "bruce"
  }
}

References #

Sample log: cado-security/AWS_EKS_Cluster_Forensics

DescribeLifecycleConfiguration

Service: elasticfilesystem

Description

Returns the current LifecycleConfiguration object for the specified EFS file system.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "c903152e-3cbc-4182-b77a-005515ca0e08",
  "eventSource": "elasticfilesystem.amazonaws.com",
  "eventName": "DescribeLifecycleConfiguration",
  "awsRegion": "ap-southeast-2",
  "eventType": "AwsApiCall",
  "apiVersion": "2015-02-01",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "b8591e27-d0c9-4f10-a0c0-3afdebeae894",
  "userAgent": "Botocore/1.35.95 ua/2.0 os/linux#5.10.245-245.983.amzn2.x86_64 md/arch#x86_64 lang/python#3.9.23 md/pyimpl#CPython cfg/retry-mode#adaptive",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "example.ap-southeast-2.amazonaws.com"
  }
}

DescribeMountTargets

Service: elasticfilesystem

Description

Returns the descriptions of all the current mount targets, or a specific mount target, for a file system.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: elasticfilesystem:DescribeMountTargets on resource: arn:aws:elasticfilesystem:us-east-1:811596193553:file-system/*",
  "eventID": "eab909ce-b4b6-4d99-96cf-e96012cf2ffb",
  "eventName": "DescribeMountTargets",
  "eventSource": "elasticfilesystem.amazonaws.com",
  "eventTime": "2018-10-17T20:26:59Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "ffff1555-d24a-11e8-8758-cf045ac4fdae",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "9.245.1.85",
  "userAgent": "Botocore/1.12.25 Python/2.7.15 Linux/4.16.0-kali2-amd64",
  "userIdentity": {
    "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/Level6",
    "principalId": "AIDADO2GQD0K8TEF7KW1V",
    "type": "IAMUser",
    "userName": "Level6"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

DescribeMountTargetSecurityGroups

Service: elasticfilesystem

Description

Returns the security groups currently in effect for a mount target.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "1dce6f6d-0460-4161-b521-ee778e8c0038",
  "eventSource": "elasticfilesystem.amazonaws.com",
  "eventName": "DescribeMountTargetSecurityGroups",
  "awsRegion": "eu-west-1",
  "eventType": "AwsApiCall",
  "apiVersion": "2015-02-01",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "ea344c1d-b75c-4e64-b996-8ea1d25b4248",
  "userAgent": "Botocore/1.35.95 ua/2.0 os/linux#5.10.245-245.983.amzn2.x86_64 md/arch#x86_64 lang/python#3.9.23 md/pyimpl#CPython cfg/retry-mode#adaptive",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "example.eu-west-1.amazonaws.com"
  }
}

DescribeReplicationConfigurations

Service: elasticfilesystem

Description

Retrieves the replication configuration for a specific file system.

Example CloudTrail Event #

{
  "apiVersion": "2015-02-01",
  "awsRegion": "us-west-1",
  "errorCode": "ReplicationNotFound",
  "errorMessage": "No replications found.",
  "eventCategory": "Management",
  "eventID": "f9837619-b4d6-43d4-bee1-bf8e5f64b87a",
  "eventName": "DescribeReplicationConfigurations",
  "eventSource": "elasticfilesystem.amazonaws.com",
  "eventTime": "2026-06-29T18:31:57Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "fe2d727d-da5a-4b9e-b5f0-0d35542dfec6",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "elasticfilesystem.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DescribeTags

Service: elasticfilesystem

Description

DEPRECATED - The DescribeTags action is deprecated and not maintained.

ListTagsForResource

Service: elasticfilesystem

Description

Lists all tags for a top-level EFS resource.

ModifyMountTargetSecurityGroups

Service: elasticfilesystem

Description

Modifies the set of security groups in effect for a mount target.

Example CloudTrail Event #

{
  "apiVersion": "2015-02-01",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "4a1d9434-e234-49a9-b1e1-a5c849cafad1",
  "eventName": "ModifyMountTargetSecurityGroups",
  "eventSource": "elasticfilesystem.amazonaws.com",
  "eventTime": "2026-06-29T21:04:23Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "5b9baa25-9ebb-4f02-b276-aa8e256c1a1b",
  "requestParameters": {
    "mountTargetId": "fsmt-0d0364c7d64747a0e",
    "securityGroups": [
      "sg-063fc1a8302bc48a4"
    ]
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "elasticfilesystem.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

PutAccountPreferences

Service: elasticfilesystem

Description

Use this operation to set the account preference in the current Amazon Web Services Region to use long 17 character (63 bit) or short 8 character (32 bit) resource IDs for new EFS file system and mount target resources.

Example CloudTrail Event #

{
  "apiVersion": "2015-02-01",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "1b518dcc-bffc-4baa-9aae-dd94ef9cb164",
  "eventName": "PutAccountPreferences",
  "eventSource": "elasticfilesystem.amazonaws.com",
  "eventTime": "2026-06-29T21:02:56Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "ff235c00-ed10-4e6d-aa3e-02ecfb62a798",
  "requestParameters": {
    "resourceIdType": "LONG_ID"
  },
  "responseElements": {
    "resourceIdPreference": {
      "resourceIdType": "LONG_ID",
      "resources": [
        "FILE_SYSTEM",
        "MOUNT_TARGET"
      ]
    }
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "elasticfilesystem.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

PutBackupPolicy

Service: elasticfilesystem

Description

Updates the file system's backup policy.

Example CloudTrail Event #

{
  "apiVersion": "2015-02-01",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "5047344f-8e79-4400-8448-6335e3958717",
  "eventName": "PutBackupPolicy",
  "eventSource": "elasticfilesystem.amazonaws.com",
  "eventTime": "2026-06-29T21:03:02Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "0b04ab0f-c17f-4126-90cc-addb36eb3f34",
  "requestParameters": {
    "backupPolicy": {
      "status": "DISABLED"
    },
    "fileSystemId": "fs-0f48ebdbc4da91cd6"
  },
  "responseElements": {
    "backupPolicy": {
      "status": "DISABLING"
    }
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "elasticfilesystem.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

PutFileSystemPolicy

Service: elasticfilesystem

Description

Applies an Amazon EFS FileSystemPolicy to an Amazon EFS file system.

Example CloudTrail Event #

{
  "apiVersion": "2015-02-01",
  "awsRegion": "us-west-1",
  "errorCode": "IncorrectFileSystemLifeCycleState",
  "eventCategory": "Management",
  "eventID": "75f7c08a-9abe-49b7-a85e-28f9ac808093",
  "eventName": "PutFileSystemPolicy",
  "eventSource": "elasticfilesystem.amazonaws.com",
  "eventTime": "2026-06-29T21:03:03Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "1d1660f7-6710-4595-bd8d-4de063441016",
  "requestParameters": {
    "bypassPolicyLockoutSafetyCheck": false,
    "fileSystemId": "fs-0f48ebdbc4da91cd6",
    "policy": {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Principal": {
            "AWS": "*"
          },
          "Action": [
            "elasticfilesystem:ClientMount"
          ],
          "Resource": "*",
          "Condition": {
            "Bool": {
              "elasticfilesystem:AccessedViaMountTarget": "true"
            }
          }
        }
      ]
    }
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "elasticfilesystem.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

PutLifecycleConfiguration

Service: elasticfilesystem

Description

Use this action to manage storage for your file system.

Example CloudTrail Event #

{
  "apiVersion": "2015-02-01",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "e1eb2337-a43e-4eeb-9f7a-6dd4937006aa",
  "eventName": "PutLifecycleConfiguration",
  "eventSource": "elasticfilesystem.amazonaws.com",
  "eventTime": "2026-06-29T21:03:02Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "5555cff9-70f7-4f5f-a1ee-78121c16c1d8",
  "requestParameters": {
    "fileSystemId": "fs-0f48ebdbc4da91cd6",
    "lifecyclePolicies": [
      {
        "transitionToIA": "AFTER_30_DAYS"
      }
    ]
  },
  "responseElements": {
    "lifecyclePolicies": [
      {
        "transitionToIA": "AFTER_30_DAYS"
      }
    ]
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "elasticfilesystem.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

TagResource

Service: elasticfilesystem

Description

Creates a tag for an EFS resource.

Example CloudTrail Event #

{
  "apiVersion": "2015-02-01",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "b9c6458e-fd45-4db8-9c21-56b17b68c825",
  "eventName": "TagResource",
  "eventSource": "elasticfilesystem.amazonaws.com",
  "eventTime": "2026-06-29T21:03:03Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "950b9fee-5048-48a3-aa01-5fb13b260a7d",
  "requestParameters": {
    "resourceId": "fs-0f48ebdbc4da91cd6",
    "tags": [
      {
        "key": "dw-new-tag",
        "value": "new-value"
      }
    ]
  },
  "resources": [
    {
      "ARN": "arn:aws:elasticfilesystem:us-west-1:123456789012:file-system/fs-0f48ebdbc4da91cd6",
      "accountId": "123456789012",
      "type": "AWS::EFS::FileSystem"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "elasticfilesystem.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UntagResource

Service: elasticfilesystem

Description

Removes tags from an EFS resource.

Example CloudTrail Event #

{
  "apiVersion": "2015-02-01",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "88e4382c-e34b-4187-b0fc-5488fb483c07",
  "eventName": "UntagResource",
  "eventSource": "elasticfilesystem.amazonaws.com",
  "eventTime": "2026-06-29T21:04:23Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "0d75f2ff-4061-4b38-b6f6-4cae82f8f42d",
  "requestParameters": {
    "resourceId": "fs-0f48ebdbc4da91cd6",
    "tagKeys": [
      "dw-new-tag"
    ]
  },
  "resources": [
    {
      "ARN": "arn:aws:elasticfilesystem:us-west-1:123456789012:file-system/fs-0f48ebdbc4da91cd6",
      "accountId": "123456789012",
      "type": "AWS::EFS::FileSystem"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "elasticfilesystem.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateFileSystem

Service: elasticfilesystem

Description

Updates the throughput mode or the amount of provisioned throughput of an existing file system.

Example CloudTrail Event #

{
  "apiVersion": "2015-02-01",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "fde03b06-6d8c-4b57-bac5-2c98caee96c1",
  "eventName": "UpdateFileSystem",
  "eventSource": "elasticfilesystem.amazonaws.com",
  "eventTime": "2026-06-29T21:03:02Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "59d336a9-389c-473e-8c1d-9a1e770674c1",
  "requestParameters": {
    "fileSystemId": "fs-0f48ebdbc4da91cd6",
    "throughputMode": "elastic"
  },
  "responseElements": {
    "creationTime": "2026-06-29T21:02:56Z",
    "creationToken": "dwfix-efs-041b6780",
    "encrypted": false,
    "fileSystemArn": "arn:aws:elasticfilesystem:us-west-1:123456789012:file-system/fs-0f48ebdbc4da91cd6",
    "fileSystemId": "fs-0f48ebdbc4da91cd6",
    "fileSystemProtection": {
      "replicationOverwriteProtection": "ENABLED"
    },
    "lifeCycleState": "updating",
    "name": "dwfix-efs-041b6780",
    "numberOfMountTargets": 0,
    "ownerId": "123456789012",
    "performanceMode": "generalPurpose",
    "sizeInBytes": {
      "value": 6144,
      "valueInArchive": 0,
      "valueInIA": 0,
      "valueInStandard": 6144
    },
    "tags": [
      {
        "key": "Name",
        "value": "dwfix-efs-041b6780"
      },
      {
        "key": "dw-temp",
        "value": "true"
      }
    ],
    "throughputMode": "bursting"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "elasticfilesystem.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateFileSystemProtection

Service: elasticfilesystem

Description

Updates protection on the file system.

Example CloudTrail Event #

{
  "apiVersion": "2015-02-01",
  "awsRegion": "us-west-1",
  "errorCode": "IncorrectFileSystemLifeCycleState",
  "eventCategory": "Management",
  "eventID": "dd199b1f-9048-4d02-adf3-caef5d41b9de",
  "eventName": "UpdateFileSystemProtection",
  "eventSource": "elasticfilesystem.amazonaws.com",
  "eventTime": "2026-06-29T21:03:02Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "77807c4a-3e1f-478a-8d65-60e2e5e02c9a",
  "requestParameters": {
    "fileSystemId": "fs-0f48ebdbc4da91cd6",
    "replicationOverwriteProtection": "DISABLED"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "elasticfilesystem.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

NewClientConnection

Service: elasticfilesystem

Description

NewClientConnection recorded by CloudTrail for Amazon Elastic File System. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "6b9358e7-6463-36a1-941b-e4cfd3714dfb",
  "eventSource": "elasticfilesystem.amazonaws.com",
  "eventName": "NewClientConnection",
  "awsRegion": "us-east-1",
  "eventType": "AwsServiceEvent",
  "readOnly": true,
  "managementEvent": true,
  "userAgent": "AWS Internal",
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::EFS::FileSystem",
      "ARN": "arn:aws:elasticfilesystem:us-east-1:123456789012:file-system/EXAMPLE"
    },
    {
      "accountId": "123456789012",
      "type": "AWS::EFS::AccessPoint",
      "ARN": "arn:aws:elasticfilesystem:us-east-1:123456789012:access-point/EXAMPLE"
    }
  ]
}