AWS IAM Identity Center

eventName	Description	Sample	Rule
any	Catch-all entry for AWS IAM Identity Center rules that match the service but not a specific eventName.	N	N
CreateGroup	Creates a group within the specified identity store.	Y	Y
CreateGroupMembership	Creates a relationship between a member and a group.	Y	N
CreateUser	Creates a user within the specified identity store.	Y	Y
DeleteGroup	Delete a group within an identity store given GroupId.	Y	Y
DeleteGroupMembership	Delete a membership within a group given MembershipId.	Y	N
DeleteUser	Deletes a user within an identity store given UserId.	Y	Y
DescribeGroup	Retrieves the group metadata and attributes from GroupId in an identity store.	N	N
DescribeGroupMembership	Retrieves membership metadata and attributes from MembershipId in an identity store.	N	N
DescribeUser	Retrieves the user metadata and attributes from the UserId in an identity store.	N	N
GetGroupId	Retrieves GroupId in an identity store.	N	N
GetGroupMembershipId	Retrieves the MembershipId in an identity store.	N	N
GetUserId	Retrieves the UserId in an identity store.	N	N
IsMemberInGroups	Checks the user's membership in all requested groups and returns if the member exists in all queried groups.	N	N
ListGroupMemberships	For the specified group in the specified identity store, returns the list of all GroupMembership objects and returns results in paginated form.	N	N
ListGroupMembershipsForMember	For the specified member in the specified identity store, returns the list of all GroupMembership objects and returns results in paginated form.	N	N
ListGroups	Lists all groups in the identity store.	N	N
ListUsers	Lists all users in the identity store.	N	N
UpdateGroup	Updates the specified group metadata and attributes in the specified identity store.	Y	N
UpdateUser	Updates the specified user metadata and attributes in the specified identity store.	Y	N

any: AWS IAM Identity Center (catch-all)

#

Service: identitystore

Description

Catch-all entry for AWS IAM Identity Center rules that match the service but not a specific eventName.

CreateGroup

#

Service: identitystore

Description

Creates a group within the specified identity store.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "1c027ca7-9360-4ecc-95eb-5c8b6d3f42a7",
  "eventName": "CreateGroup",
  "eventSource": "identitystore.amazonaws.com",
  "eventTime": "2026-06-29T21:50:03Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "9c97dd4f-a55d-4df3-9e63-2233dec6ffb8",
  "requestParameters": {
    "description": "HIDDEN_DUE_TO_SECURITY_REASONS",
    "displayName": "HIDDEN_DUE_TO_SECURITY_REASONS",
    "identityStoreId": "d-90667510e7"
  },
  "resources": [
    {
      "ARN": "arn:aws:identitystore::123456789012:identitystore/d-90667510e7",
      "accountId": "123456789012",
      "type": "AWS::IdentityStore::IdentityStore"
    }
  ],
  "responseElements": {
    "groupId": "44782458-4061-70fd-e61f-9dad6f8b648f",
    "identityStoreId": "d-90667510e7"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "identitystore.us-east-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,b,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

High-Risk Cross-Cloud User Impersonation source medium: This detection focuses on identifying high-risk cross-cloud activities and sign-in anomalies that may indicate potential security threats. The query starts by analyzing Microsoft Entra ID Signin Logs to pinpoint instances where specific applications, risk levels, and result types align. It then correlates this information with relevant AWS CloudTrail events to identify activities across Azure and AWS environments.T1078, T1078.002, T1078.004, T1134↳ also matches CreateUser, DeleteGroup, DeleteUser

CreateGroupMembership

#

Service: identitystore

Description

Creates a relationship between a member and a group.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "03a9ea05-9f44-46c2-875d-b0cfb6ed4132",
  "eventName": "CreateGroupMembership",
  "eventSource": "identitystore.amazonaws.com",
  "eventTime": "2026-06-29T21:50:03Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "cc0c8978-8bf6-4930-98d1-bec7728a7a33",
  "requestParameters": {
    "groupId": "44782458-4061-70fd-e61f-9dad6f8b648f",
    "identityStoreId": "d-90667510e7",
    "memberId": {
      "userId": "544874c8-d091-700a-9f2e-41f3a29e080f"
    }
  },
  "resources": [
    {
      "ARN": "arn:aws:identitystore::123456789012:identitystore/d-90667510e7",
      "accountId": "123456789012",
      "type": "AWS::IdentityStore::IdentityStore"
    }
  ],
  "responseElements": {
    "identityStoreId": "d-90667510e7",
    "membershipId": "24989498-c001-7051-4d8a-5c2197974da7"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "identitystore.us-east-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,b,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreateUser

#

Service: identitystore

Description

Creates a user within the specified identity store.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "3ee4e944-453b-4839-919d-cc37909f7c9c",
  "eventName": "CreateUser",
  "eventSource": "identitystore.amazonaws.com",
  "eventTime": "2026-06-29T21:50:03Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "a0652af6-3399-420d-bb5f-134f9590fbba",
  "requestParameters": {
    "displayName": "HIDDEN_DUE_TO_SECURITY_REASONS",
    "identityStoreId": "d-90667510e7",
    "name": {
      "familyName": "HIDDEN_DUE_TO_SECURITY_REASONS",
      "givenName": "HIDDEN_DUE_TO_SECURITY_REASONS"
    },
    "userName": "HIDDEN_DUE_TO_SECURITY_REASONS"
  },
  "resources": [
    {
      "ARN": "arn:aws:identitystore::123456789012:identitystore/d-90667510e7",
      "accountId": "123456789012",
      "type": "AWS::IdentityStore::IdentityStore"
    }
  ],
  "responseElements": {
    "identityStoreId": "d-90667510e7",
    "userId": "544874c8-d091-700a-9f2e-41f3a29e080f"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "identitystore.us-east-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,b,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

High-Risk Cross-Cloud User Impersonation source medium: This detection focuses on identifying high-risk cross-cloud activities and sign-in anomalies that may indicate potential security threats. The query starts by analyzing Microsoft Entra ID Signin Logs to pinpoint instances where specific applications, risk levels, and result types align. It then correlates this information with relevant AWS CloudTrail events to identify activities across Azure and AWS environments.T1078, T1078.002, T1078.004, T1134↳ also matches CreateGroup, DeleteGroup, DeleteUser

DeleteGroup

#

Service: identitystore

Description

Delete a group within an identity store given GroupId.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "ba412b0a-8a5a-486f-9254-6a1c86f88cf6",
  "eventName": "DeleteGroup",
  "eventSource": "identitystore.amazonaws.com",
  "eventTime": "2026-06-29T21:50:04Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "158fceb8-435c-4e11-9511-0d63a2025419",
  "requestParameters": {
    "groupId": "44782458-4061-70fd-e61f-9dad6f8b648f",
    "identityStoreId": "d-90667510e7"
  },
  "resources": [
    {
      "ARN": "arn:aws:identitystore::123456789012:identitystore/d-90667510e7",
      "accountId": "123456789012",
      "type": "AWS::IdentityStore::IdentityStore"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "identitystore.us-east-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,b,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

High-Risk Cross-Cloud User Impersonation source medium: This detection focuses on identifying high-risk cross-cloud activities and sign-in anomalies that may indicate potential security threats. The query starts by analyzing Microsoft Entra ID Signin Logs to pinpoint instances where specific applications, risk levels, and result types align. It then correlates this information with relevant AWS CloudTrail events to identify activities across Azure and AWS environments.T1078, T1078.002, T1078.004, T1134↳ also matches CreateGroup, CreateUser, DeleteUser

DeleteGroupMembership

#

Service: identitystore

Description

Delete a membership within a group given MembershipId.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "f18436cf-7fc5-4d25-95d1-e9474fb3b78e",
  "eventName": "DeleteGroupMembership",
  "eventSource": "identitystore.amazonaws.com",
  "eventTime": "2026-06-29T21:50:04Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "13023686-407d-491d-bcf2-5c4e026aa8e1",
  "requestParameters": {
    "identityStoreId": "d-90667510e7",
    "membershipId": "24989498-c001-7051-4d8a-5c2197974da7"
  },
  "resources": [
    {
      "ARN": "arn:aws:identitystore::123456789012:identitystore/d-90667510e7",
      "accountId": "123456789012",
      "type": "AWS::IdentityStore::IdentityStore"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "identitystore.us-east-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,b,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteUser

#

Service: identitystore

Description

Deletes a user within an identity store given UserId.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "5d74de9d-a214-4268-8dda-473563184ae4",
  "eventName": "DeleteUser",
  "eventSource": "identitystore.amazonaws.com",
  "eventTime": "2026-06-29T21:50:04Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "f6cd0d62-76bd-42d0-851d-c07d3138ac55",
  "requestParameters": {
    "identityStoreId": "d-90667510e7",
    "userId": "544874c8-d091-700a-9f2e-41f3a29e080f"
  },
  "resources": [
    {
      "ARN": "arn:aws:identitystore::123456789012:identitystore/d-90667510e7",
      "accountId": "123456789012",
      "type": "AWS::IdentityStore::IdentityStore"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "identitystore.us-east-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,b,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

High-Risk Cross-Cloud User Impersonation source medium: This detection focuses on identifying high-risk cross-cloud activities and sign-in anomalies that may indicate potential security threats. The query starts by analyzing Microsoft Entra ID Signin Logs to pinpoint instances where specific applications, risk levels, and result types align. It then correlates this information with relevant AWS CloudTrail events to identify activities across Azure and AWS environments.T1078, T1078.002, T1078.004, T1134↳ also matches CreateGroup, CreateUser, DeleteGroup

DescribeGroup

#

Service: identitystore

Description

Retrieves the group metadata and attributes from GroupId in an identity store.

Example CloudTrail Event #

This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.

{
  "eventVersion": "1.11",
  "eventID": "5214ea11-c8b1-3d96-b7fb-204069979953",
  "eventSource": "identitystore.amazonaws.com",
  "eventName": "DescribeGroup",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "5c600e5b-7504-40ff-a4c0-35a29042f49c",
  "userAgent": "user-subscriptions.amazonaws.com",
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::IdentityStore::IdentityStore",
      "ARN": "arn:aws:identitystore::123456789012:identitystore/EXAMPLE"
    }
  ]
}

DescribeGroupMembership

#

Service: identitystore

Description

Retrieves membership metadata and attributes from MembershipId in an identity store.

DescribeUser

#

Service: identitystore

Description

Retrieves the user metadata and attributes from the UserId in an identity store.

Example CloudTrail Event #

This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.

{
  "eventVersion": "1.11",
  "eventID": "f4ce89fb-7327-336e-987a-e249cfe2ff38",
  "eventSource": "identitystore.amazonaws.com",
  "eventName": "DescribeUser",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "caee8868-542c-4bde-8942-d94227625c12",
  "userAgent": "Boto3/1.43.40 md/Botocore#1.43.40 ua/2.1 os/macos#25.5.0 md/arch#arm64 lang/python#3.14.2 md/pyimpl#CPython m/b,s,r,D,Z cfg/retry-mode#legacy Botocore/1.43.40",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "example.us-east-1.amazonaws.com"
  },
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::IdentityStore::IdentityStore",
      "ARN": "arn:aws:identitystore::123456789012:identitystore/EXAMPLE"
    }
  ]
}

GetGroupId

#

Service: identitystore

Description

Retrieves GroupId in an identity store.

Example CloudTrail Event #

This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.

{
  "eventVersion": "1.11",
  "eventID": "2fe33a6a-9142-4e99-a4bd-e8d70e0b465a",
  "eventSource": "identitystore.amazonaws.com",
  "eventName": "GetGroupId",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "70e9605a-dcd9-496d-925d-074ba07ae7f5",
  "userAgent": "APN/1.0 HashiCorp/1.0 Terraform/1.15.5 (+https://www.terraform.io) terraform-provider-aws/5.100.0 (+https://registry.terraform.io/providers/hashicorp/aws) aws-sdk-go-v2/1.36.3 ua/2.1 os/linux lang/go#1.23.10 md/GOOS#linux md/GOARCH#arm64 api/identitystore#1.28.3 m/g",
  "errorCode": "ThrottlingException",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "example.us-east-1.amazonaws.com"
  }
}

GetGroupMembershipId

#

Service: identitystore

Description

Retrieves the MembershipId in an identity store.

GetUserId

#

Service: identitystore

Description

Retrieves the UserId in an identity store.

IsMemberInGroups

#

Service: identitystore

Description

Checks the user's membership in all requested groups and returns if the member exists in all queried groups.

Example CloudTrail Event #

This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.

{
  "eventVersion": "1.11",
  "eventID": "0748edce-37ec-33ff-805e-dc3610fb5a77",
  "eventSource": "identitystore.amazonaws.com",
  "eventName": "IsMemberInGroups",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "0ca6a096-06b2-4687-ab8c-d5a49f1df675",
  "userAgent": "user-subscriptions.amazonaws.com",
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::IdentityStore::IdentityStore",
      "ARN": "arn:aws:identitystore::123456789012:identitystore/EXAMPLE"
    }
  ]
}

ListGroupMemberships

#

Service: identitystore

Description

For the specified group in the specified identity store, returns the list of all GroupMembership objects and returns results in paginated form.

Example CloudTrail Event #

This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.

{
  "eventVersion": "1.11",
  "eventID": "87c3ad2e-d5f9-3944-99a8-91ff8402474b",
  "eventSource": "identitystore.amazonaws.com",
  "eventName": "ListGroupMemberships",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "9faec0de-14cc-4423-a014-6a6f47116bc7",
  "userAgent": "user-subscriptions.amazonaws.com",
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::IdentityStore::IdentityStore",
      "ARN": "arn:aws:identitystore::123456789012:identitystore/EXAMPLE"
    }
  ]
}

ListGroupMembershipsForMember

#

Service: identitystore

Description

For the specified member in the specified identity store, returns the list of all GroupMembership objects and returns results in paginated form.

Example CloudTrail Event #

This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.

{
  "eventVersion": "1.11",
  "eventID": "2c351089-8f65-33e5-8b65-fe814911c93a",
  "eventSource": "identitystore.amazonaws.com",
  "eventName": "ListGroupMembershipsForMember",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "46c480f8-4a36-45d0-8e10-6013d7f857bb",
  "userAgent": "Boto3/1.36.18 md/Botocore#1.36.26 ua/2.0 os/linux#6.9.12 md/arch#x86_64 lang/python#3.11.15 md/pyimpl#CPython cfg/retry-mode#legacy Botocore/1.36.26",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "example.us-east-1.amazonaws.com"
  },
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::IdentityStore::IdentityStore",
      "ARN": "arn:aws:identitystore::123456789012:identitystore/EXAMPLE"
    }
  ]
}

ListGroups

#

Service: identitystore

Description

Lists all groups in the identity store.

ListUsers

#

Service: identitystore

Description

Lists all users in the identity store.

UpdateGroup

#

Service: identitystore

Description

Updates the specified group metadata and attributes in the specified identity store.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "0dfe15af-25d2-4705-85c9-e6dee51e8636",
  "eventName": "UpdateGroup",
  "eventSource": "identitystore.amazonaws.com",
  "eventTime": "2026-06-29T21:50:04Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "334bb00d-9869-4a63-b8be-8a09e0825351",
  "requestParameters": {
    "groupId": "44782458-4061-70fd-e61f-9dad6f8b648f",
    "identityStoreId": "d-90667510e7",
    "operations": [
      {
        "attributePath": "displayName",
        "attributeValue": "HIDDEN_DUE_TO_SECURITY_REASONS"
      }
    ]
  },
  "resources": [
    {
      "ARN": "arn:aws:identitystore::123456789012:identitystore/d-90667510e7",
      "accountId": "123456789012",
      "type": "AWS::IdentityStore::IdentityStore"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "identitystore.us-east-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,b,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateUser

#

Service: identitystore

Description

Updates the specified user metadata and attributes in the specified identity store.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "2c4a2f6d-47f0-4bbf-a82d-ee4283f61177",
  "eventName": "UpdateUser",
  "eventSource": "identitystore.amazonaws.com",
  "eventTime": "2026-06-29T21:50:04Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "bed62308-b129-4ab2-80f3-ff33ec0b853e",
  "requestParameters": {
    "identityStoreId": "d-90667510e7",
    "operations": [
      {
        "attributePath": "displayName",
        "attributeValue": "HIDDEN_DUE_TO_SECURITY_REASONS"
      }
    ],
    "userId": "544874c8-d091-700a-9f2e-41f3a29e080f"
  },
  "resources": [
    {
      "ARN": "arn:aws:identitystore::123456789012:identitystore/d-90667510e7",
      "accountId": "123456789012",
      "type": "AWS::IdentityStore::IdentityStore"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "identitystore.us-east-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,b,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

AWS IAM Identity Center

any: AWS IAM Identity Center (catch-all)

Description

CreateGroup

Description

Example CloudTrail Event #

Related events #

Detection Rules #

Kusto #

CreateGroupMembership

Description

Example CloudTrail Event #

CreateUser

Description

Example CloudTrail Event #

Related events #

Detection Rules #

Kusto #

DeleteGroup

Description

Example CloudTrail Event #

Related events #

Detection Rules #

Kusto #

DeleteGroupMembership

Description

Example CloudTrail Event #

DeleteUser

Description

Example CloudTrail Event #

Related events #

Detection Rules #

Kusto #

DescribeGroup

Description

Example CloudTrail Event #

DescribeGroupMembership

Description

DescribeUser

Description

Example CloudTrail Event #

GetGroupId

Description

Example CloudTrail Event #

GetGroupMembershipId

Description

GetUserId

Description

IsMemberInGroups

Description

Example CloudTrail Event #

ListGroupMemberships

Description

Example CloudTrail Event #

ListGroupMembershipsForMember

Description

Example CloudTrail Event #

ListGroups

Description

ListUsers

Description

UpdateGroup

Description

Example CloudTrail Event #

UpdateUser

Description

Example CloudTrail Event #