Glacier
| eventName | Description | Sample | Rule |
|---|---|---|---|
| any | Catch-all entry for Glacier rules that match the service but not a specific eventName. | N | N |
| Abort | This operation aborts a multipart upload identified by the upload ID. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet. | N | N |
| Abort | This operation aborts the vault locking process if the vault lock is not in the Locked state. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet. | N | N |
| Add | This operation adds the specified tags to a vault. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet. | N | N |
| Complete | You call this operation to inform Amazon Glacier (Glacier) that all the archive parts have been uploaded and that Glacier can now assemble the archive from the uploaded parts. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet. | N | N |
| Complete | This operation completes the vault locking process by transitioning the vault lock from the InProgress state to the Locked state, which causes the vault lock policy to become unchangeable. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet. | N | N |
| Create | This operation creates a new vault with the specified name. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet. | N | N |
| Delete | This operation deletes an archive from a vault. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet. | N | N |
| Delete | This operation deletes a vault. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet. | N | N |
| Delete | This operation deletes the access policy associated with the specified vault. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet. | N | N |
| Delete | This operation deletes the notification configuration set for a vault. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet. | N | N |
| Describe | This operation returns information about a job you previously initiated, including the job initiation date, the user who initiated the job, the job status code/message and the Amazon SNS topic to notify after Amazon Glacier (Glacier) comple. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet. | N | N |
| Describe | This operation returns information about a vault, including the vault's Amazon Resource Name (ARN), the date the vault was created, the number of archives it contains, and the total size of all the archives in the vault. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet. | N | N |
| Get | This operation returns the current data retrieval policy for the account and region specified in the GET request. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record. | N | N |
| Get | This operation downloads the output of the job you initiated using InitiateJob. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet. | N | N |
| Get | This operation retrieves the access-policy subresource set on the vault; for more information on setting this subresource, see Set Vault Access Policy (PUT access-policy). Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record. | N | N |
| Get | This operation retrieves the following attributes from the lock-policy subresource set on the specified vault: The vault lock policy set on the vault. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record. | N | N |
| Get | This operation retrieves the notification-configuration subresource of the specified vault. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet. | N | N |
| Initiate | This operation initiates a job of the specified type, which can be a select, an archival retrieval, or a vault retrieval. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet. | N | N |
| Initiate | This operation initiates a multipart upload. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet. | N | N |
| Initiate | This operation initiates the vault locking process by doing the following: Installing a vault lock policy on the specified vault. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet. | N | N |
| List | This operation lists jobs for a vault, including jobs that are in-progress and jobs that have recently finished. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet. | N | N |
| List | This operation lists in-progress multipart uploads for the specified vault. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet. | N | N |
| List | This operation lists the parts of an archive that have been uploaded in a specific multipart upload. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet. | N | N |
| List | This operation lists the provisioned capacity units for the specified AWS account. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet. | N | N |
| List | This operation lists all the tags attached to a vault. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record. | N | N |
| List | This operation lists all vaults owned by the calling user's account. | Y | N |
| Purchase | This operation purchases a provisioned capacity unit for an AWS account. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet. | N | N |
| Remove | This operation removes one or more tags from the set of tags attached to a vault. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet. | N | N |
| Set | This operation sets and then enacts a data retrieval policy in the region specified in the PUT request. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet. | N | N |
| Set | This operation configures an access policy for a vault and will overwrite an existing policy. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet. | N | N |
| Set | This operation configures notifications that will be sent when specific events happen to a vault. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet. | N | N |
| Upload | This operation adds an archive to a vault. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet. | N | N |
| Upload | This operation uploads a part of an archive. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet. | N | N |
any: Glacier (catch-all)
#Description
Catch-all entry for Glacier rules that match the service but not a specific eventName.
AbortMultipartUpload
#Description
This operation aborts a multipart upload identified by the upload ID. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.
AbortVaultLock
#Description
This operation aborts the vault locking process if the vault lock is not in the Locked state. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.
CompleteMultipartUpload
#Description
You call this operation to inform Amazon Glacier (Glacier) that all the archive parts have been uploaded and that Glacier can now assemble the archive from the uploaded parts. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.
CompleteVaultLock
#Description
This operation completes the vault locking process by transitioning the vault lock from the InProgress state to the Locked state, which causes the vault lock policy to become unchangeable. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.
CreateVault
#Description
This operation creates a new vault with the specified name. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.
DeleteArchive
#Description
This operation deletes an archive from a vault. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.
DeleteVault
#Description
This operation deletes a vault. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.
DeleteVaultAccessPolicy
#Description
This operation deletes the access policy associated with the specified vault. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.
DeleteVaultNotifications
#Description
This operation deletes the notification configuration set for a vault. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.
DescribeJob
#Description
This operation returns information about a job you previously initiated, including the job initiation date, the user who initiated the job, the job status code/message and the Amazon SNS topic to notify after Amazon Glacier (Glacier) comple. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.
DescribeVault
#Description
This operation returns information about a vault, including the vault's Amazon Resource Name (ARN), the date the vault was created, the number of archives it contains, and the total size of all the archives in the vault. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.
GetDataRetrievalPolicy
#Description
This operation returns the current data retrieval policy for the account and region specified in the GET request. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record.
Example CloudTrail Event #
This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.
{
"eventVersion": "1.11",
"eventID": "c345e32f-fa3c-4f0a-93ef-95cb4b57155d",
"eventSource": "glacier.amazonaws.com",
"eventName": "GetDataRetrievalPolicy",
"awsRegion": "us-east-1",
"eventType": "AwsApiCall",
"readOnly": true,
"managementEvent": true,
"requestID": "Y0PrDTkwt1DDAGctjOKITmbAp0vv88IIaQQ3JHsRLfaFsts",
"userAgent": "aws-sdk-go-v2/1.43.0 ua/2.1 os/linux lang/go#1.26.5 md/GOOS#linux md/GOARCH#arm64 api/glacier#1.27.6 m/E,i",
"tlsDetails": {
"tlsVersion": "TLSv1.3",
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "example.us-east-1.amazonaws.com"
}
}
GetJobOutput
#Description
This operation downloads the output of the job you initiated using InitiateJob. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.
GetVaultAccessPolicy
#Description
This operation retrieves the access-policy subresource set on the vault; for more information on setting this subresource, see Set Vault Access Policy (PUT access-policy). Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record.
Example CloudTrail Event #
This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.
{
"eventVersion": "1.11",
"eventID": "65475381-18f1-4d80-8199-632eecaf1829",
"eventSource": "glacier.amazonaws.com",
"eventName": "GetVaultAccessPolicy",
"awsRegion": "us-east-1",
"eventType": "AwsApiCall",
"readOnly": true,
"managementEvent": true,
"requestID": "FsYdjumDert9k5Kqrs0be3iv97PYDDhnl8NW9YLFTbLkiuI",
"userAgent": "Botocore/1.35.95 ua/2.0 os/linux#5.10.245-245.983.amzn2.x86_64 md/arch#x86_64 lang/python#3.9.23 md/pyimpl#CPython cfg/retry-mode#standard",
"errorCode": "ResourceNotFoundException",
"tlsDetails": {
"tlsVersion": "TLSv1.3",
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "example.us-east-1.amazonaws.com"
}
}
GetVaultLock
#Description
This operation retrieves the following attributes from the lock-policy subresource set on the specified vault: The vault lock policy set on the vault. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record.
Example CloudTrail Event #
This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.
{
"eventVersion": "1.11",
"eventID": "fa000918-34bf-4db8-b053-78daa4c26ce5",
"eventSource": "glacier.amazonaws.com",
"eventName": "GetVaultLock",
"awsRegion": "us-east-1",
"eventType": "AwsApiCall",
"readOnly": true,
"managementEvent": true,
"requestID": "7naF5OCAVH2fkQp_bW-JuEbyrwJ845tu7stkTwt5FNdGJaM",
"userAgent": "Botocore/1.35.95 ua/2.0 os/linux#5.10.245-245.983.amzn2.x86_64 md/arch#x86_64 lang/python#3.9.23 md/pyimpl#CPython cfg/retry-mode#standard",
"errorCode": "ResourceNotFoundException",
"tlsDetails": {
"tlsVersion": "TLSv1.3",
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "example.us-east-1.amazonaws.com"
}
}
GetVaultNotifications
#Description
This operation retrieves the notification-configuration subresource of the specified vault. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.
InitiateJob
#Description
This operation initiates a job of the specified type, which can be a select, an archival retrieval, or a vault retrieval. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.
InitiateMultipartUpload
#Description
This operation initiates a multipart upload. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.
InitiateVaultLock
#Description
This operation initiates the vault locking process by doing the following: Installing a vault lock policy on the specified vault. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.
ListJobs
#Description
This operation lists jobs for a vault, including jobs that are in-progress and jobs that have recently finished. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.
ListMultipartUploads
#Description
This operation lists in-progress multipart uploads for the specified vault. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.
ListParts
#Description
This operation lists the parts of an archive that have been uploaded in a specific multipart upload. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.
ListProvisionedCapacity
#Description
This operation lists the provisioned capacity units for the specified AWS account. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.
ListVaults
#Description
This operation lists all vaults owned by the calling user's account.
Example CloudTrail Event #
{
"awsRegion": "us-west-2",
"eventCategory": "Management",
"eventID": "94685cb3-9d0c-4722-8749-3bfa6f5698bc",
"eventName": "ListVaults",
"eventSource": "glacier.amazonaws.com",
"eventTime": "2021-04-13T13:30:01Z",
"eventType": "AwsApiCall",
"eventVersion": "1.08",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "760111141337",
"requestID": "RQotNJdxtYHIfvr_3ikxpRlPvQBJkvR2zQgv3v144m_smYs",
"requestParameters": {
"accountId": "-"
},
"responseElements": null,
"sourceIPAddress": "95.9.125.40",
"userAgent": "Boto3/1.14.6 Python/3.9.4 Darwin/20.3.0 Botocore/1.17.6",
"userIdentity": {
"accessKeyId": "AKIAYTOGP2RLIXX7QSZR",
"accountId": "760111141337",
"arn": "arn:aws:iam::760111141337:user/cloudmapper",
"principalId": "AIDAYTOGP2RLK32EB7QZV",
"type": "IAMUser",
"userName": "cloudmapper"
}
}
References #
PurchaseProvisionedCapacity
#Description
This operation purchases a provisioned capacity unit for an AWS account. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.
SetDataRetrievalPolicy
#Description
This operation sets and then enacts a data retrieval policy in the region specified in the PUT request. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.
SetVaultAccessPolicy
#Description
This operation configures an access policy for a vault and will overwrite an existing policy. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.
SetVaultNotifications
#Description
This operation configures notifications that will be sent when specific events happen to a vault. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.
UploadArchive
#Description
This operation adds an archive to a vault. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.
UploadMultipartPart
#Description
This operation uploads a part of an archive. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.