AWS Lambda

eventName	Description	Sample	Rule
any	Catch-all entry for AWS Lambda rules that match the service but not a specific eventName.	N	Y
AddPermission	Grants an AWS service or another account permission to invoke a Lambda function by adding a statement to the function's resource-based policy.	Y	Y
CreateFunction	Creates a new Lambda function by uploading deployment package code and specifying the runtime, handler, and execution role.	Y	Y
CreateFunctionUrlConfig	Creates a function URL, a dedicated HTTP(S) endpoint, for the specified Lambda function or function alias.	Y	Y
Invoke	Synchronously invokes a Lambda function and returns the function's response payload.	Y	N
ListFunctions	Returns a paginated list of Lambda functions in the current account and region, with optional filtering by runtime or layer.	Y	Y
PublishLayerVersion	Creates a new version of a Lambda layer by uploading a deployment package containing libraries or other dependencies.	Y	N
UpdateFunctionConfiguration	Modifies the configuration settings of a Lambda function, such as its memory, timeout, environment variables, or execution role.	Y	Y
AddEventSource	Identifies a stream as an event source for an AWS Lambda function.	N	N
AddLayerVersionPermission	Adds permissions to the resource-based policy of a version of an Lambda layer.	Y	N
CheckpointDurableExecution	Saves the progress of a durable function execution during runtime.	N	N
CreateAlias	Creates an alias for a Lambda function version.	Y	Y
CreateCapacityProvider	Creates a capacity provider that manages compute resources for Lambda functions	N	N
CreateCodeSigningConfig	Creates a code signing configuration.	Y	N
CreateEventSourceMapping	Creates a mapping between an event source and an Lambda function.	Y	Y
CreateMicrovmAuthToken	Creates an authentication token for accessing a running MicroVM.	N	N
CreateMicrovmImage	Creates a MicroVM image from the specified code artifact and base image.	N	N
CreateMicrovmShellAuthToken	Creates a shell authentication token for interactive shell access to a running MicroVM.	N	N
CreateNetworkConnector	Creates a network connector that enables Lambda compute resources to route outbound traffic through your Amazon VPC.	N	N
DeleteAlias	Deletes a Lambda function alias.	Y	Y
DeleteCapacityProvider	Deletes a capacity provider.	Y	N
DeleteCodeSigningConfig	Deletes the code signing configuration.	Y	N
DeleteEventSourceMapping	Deletes an event source mapping.	Y	Y
DeleteFunction	Deletes the specified Lambda function code and configuration.	Y	Y
DeleteFunctionCodeSigningConfig	Removes the code signing configuration from the function.	Y	N
DeleteFunctionConcurrency	Removes a concurrent execution limit from a function.	Y	N
DeleteFunctionEventInvokeConfig	Deletes the configuration for asynchronous invocation for a function, version, or alias.	Y	N
DeleteFunctionUrlConfig	Deletes a Lambda function URL.	Y	N
DeleteLayerVersion	Deletes a version of an Lambda layer.	Y	N
DeleteMicrovmImage	Deletes a MicroVM image.	N	N
DeleteMicrovmImageVersion	Deletes a specific version of a MicroVM image.	N	N
DeleteNetworkConnector	Initiates deletion of a network connector.	Y	N
DeleteProvisionedConcurrencyConfig	Deletes the provisioned concurrency configuration for a function.	Y	N
GetAccountSettings	Retrieves details about your account's limits and usage in an Amazon Web Services Region.	Y	N
GetAlias	Returns details about a Lambda function alias.	Y	N
GetCapacityProvider	Retrieves information about a specific capacity provider, including its configuration, state, and associated resources.	Y	N
GetCodeSigningConfig	Returns information about the specified code signing configuration.	N	N
GetDurableExecution	Retrieves detailed information about a specific durable execution, including its current status, input payload, result or error information, and execution metadata such as start time and usage statistics.	N	N
GetDurableExecutionHistory	Retrieves the execution history for a durable execution, showing all the steps, callbacks, and events that occurred during the execution.	N	N
GetDurableExecutionState	Retrieves the current execution state required for the replay process during durable function execution.	N	N
GetEventSource	Returns configuration information for the specified event source mapping (see AddEventSource).	N	N
GetEventSourceMapping	Returns details about an event source mapping.	Y	N
GetFunction	Returns the configuration information of the Lambda function and a presigned URL link to the .zip file you uploaded with UploadFunction so you can download the .zip file.	Y	N
GetFunctionCodeSigningConfig	Returns the code signing configuration for the specified function.	Y	N
GetFunctionConcurrency	Returns details about the reserved concurrency configuration for a function.	Y	N
GetFunctionConfiguration	Returns the configuration information of the Lambda function.	Y	N
GetFunctionEventInvokeConfig	Retrieves the configuration for asynchronous invocation for a function, version, or alias.	Y	N
GetFunctionRecursionConfig	Returns your function's recursive loop detection configuration.	Y	N
GetFunctionScalingConfig	Retrieves the scaling configuration for a Lambda Managed Instances function.	N	N
GetFunctionUrlConfig	Returns details about a Lambda function URL.	Y	N
GetLayerVersion	Returns information about a version of an Lambda layer, with a link to download the layer archive that's valid for 10 minutes.	Y	N
GetLayerVersionByArn	Returns information about a version of an Lambda layer, with a link to download the layer archive that's valid for 10 minutes.	N	N
GetLayerVersionPolicy	Returns the permission policy for a version of an Lambda layer.	Y	N
GetMicrovm	Retrieves the details of a specific MicroVM, including its state, endpoint, image information, and configuration.	N	N
GetMicrovmImage	Retrieves the details of a MicroVM image, including its state, versions, and configuration.	N	N
GetMicrovmImageBuild	Retrieves the details of a specific MicroVM image build, including its state, target architecture, and snapshot information.	N	N
GetMicrovmImageVersion	Retrieves the details of a specific version of a MicroVM image, including its configuration, state, and build information.	N	N
GetNetworkConnector	Retrieves the current configuration, state, and metadata of a network connector.	Y	N
GetPolicy	Returns the resource-based IAM policy for a function, version, or alias.	Y	N
GetProvisionedConcurrencyConfig	Retrieves the provisioned concurrency configuration for a function's alias or version.	Y	N
GetRuntimeManagementConfig	Retrieves the runtime management configuration for a function's version.	Y	N
InvokeAsync	Submits an invocation request to AWS Lambda.	N	N
InvokeWithResponseStream	Configure your Lambda functions to stream response payloads back to clients.	N	N
ListAliases	Returns a list of aliases for a Lambda function.	Y	Y
ListCapacityProviders	Returns a list of capacity providers in your account.	Y	N
ListCodeSigningConfigs	Returns a list of code signing configurations.	Y	N
ListDurableExecutionsByFunction	Returns a list of durable executions for a specified Lambda function.	Y	N
ListEventSourceMappings	Lists event source mappings.	Y	N
ListFunctionEventInvokeConfigs	Retrieves a list of configurations for asynchronous invocation for a function.	Y	N
ListFunctionsByCodeSigningConfig	List the functions that use the specified code signing configuration.	N	N
ListFunctionUrlConfigs	Returns a list of Lambda function URLs for the specified function.	Y	N
ListFunctionVersionsByCapacityProvider	Returns a list of function versions that are configured to use a specific capacity provider.	Y	N
ListLayers	Lists Lambda layers and shows information about the latest version of each.	Y	N
ListLayerVersions	Lists the versions of an Lambda layer.	Y	N
ListManagedMicrovmImages	Lists AWS managed MicroVM images available for use as base images.	N	N
ListManagedMicrovmImageVersions	Lists versions of a managed MicroVM image.	N	N
ListMicrovmImageBuilds	Lists builds for a MicroVM image version with optional filtering by architecture and chipset.	N	N
ListMicrovmImages	Lists MicroVM images in the account with optional name filtering.	N	N
ListMicrovmImageVersions	Lists versions of a MicroVM image.	N	N
ListMicrovms	Lists MicroVMs in the account with optional filtering by image and version.	N	N
ListNetworkConnectors	Returns a paginated list of network connectors in your account for the current Region.	Y	N
ListProvisionedConcurrencyConfigs	Retrieves a list of provisioned concurrency configurations for a function.	Y	N
ListTags	Returns a function, event source mapping, or code signing configuration's tags.	N	N
ListVersionsByFunction	Returns a list of versions, with the version-specific configuration of each.	Y	N
PublishVersion	Creates a version from the current code and configuration of a function.	Y	Y
PutFunctionCodeSigningConfig	Update the code signing configuration for the function.	Y	N
PutFunctionConcurrency	Sets the maximum number of simultaneous executions for a function, and reserves capacity for that concurrency level.	Y	N
PutFunctionEventInvokeConfig	Configures options for asynchronous invocation on a function, version, or alias.	Y	N
PutFunctionRecursionConfig	Sets your function's recursive loop detection configuration.	Y	N
PutFunctionScalingConfig	Sets the scaling configuration for a Lambda Managed Instances function.	N	N
PutProvisionedConcurrencyConfig	Adds a provisioned concurrency configuration to a function's alias or version.	N	N
PutRuntimeManagementConfig	Sets the runtime management configuration for a function's version.	Y	N
RemoveEventSource	Removes an event source mapping.	N	N
RemoveLayerVersionPermission	Removes a statement from the permissions policy for a version of an Lambda layer.	Y	N
RemovePermission	Revokes function-use permission from an Amazon Web Services service or another Amazon Web Services account.	Y	Y
ResumeMicrovm	Resumes a suspended MicroVM, restoring it to RUNNING state with all state intact.	N	N
RunMicrovm	Runs a new MicroVM from the specified image.	N	N
SendDurableExecutionCallbackFailure	Sends a failure response for a callback operation in a durable execution.	N	N
SendDurableExecutionCallbackHeartbeat	Sends a heartbeat signal for a long-running callback operation to prevent timeout.	N	N
SendDurableExecutionCallbackSuccess	Sends a successful completion response for a callback operation in a durable execution.	N	N
StopDurableExecution	Stops a running durable execution.	N	N
SuspendMicrovm	Suspends a running MicroVM, preserving its full memory and disk state.	N	N
TagResource	Adds tags to a function, event source mapping, or code signing configuration.	N	N
TerminateMicrovm	Terminates a MicroVM.	N	N
UntagResource	Removes tags from a function, event source mapping, or code signing configuration.	N	N
UpdateAlias	Updates the configuration of a Lambda function alias.	Y	Y
UpdateCapacityProvider	Updates the configuration of an existing capacity provider.	Y	N
UpdateCodeSigningConfig	Update the code signing configuration.	Y	N
UpdateEventSourceMapping	Updates an event source mapping.	Y	Y
UpdateFunctionCode	Updates a Lambda function's code.	Y	Y
UpdateFunctionEventInvokeConfig	Updates the configuration for asynchronous invocation for a function, version, or alias.	Y	N
UpdateFunctionUrlConfig	Updates the configuration for a Lambda function URL.	Y	N
UpdateMicrovmImage	Updates the configuration of a MicroVM image and triggers a new version build.	N	N
UpdateMicrovmImageVersion	Updates the status of a specific MicroVM image version.	N	N
UpdateNetworkConnector	Updates the VPC configuration or operator role of an existing network connector.	Y	N
UploadFunction	Creates a new Lambda function or updates an existing function.	N	N
DisableReplication20170630	DisableReplication20170630 recorded by CloudTrail for AWS Lambda. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.	N	N
EnableReplication20170630v2	EnableReplication20170630v2 recorded by CloudTrail for AWS Lambda. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.	N	N

any: AWS Lambda (catch-all)

Service: lambda

Description

Catch-all entry for AWS Lambda rules that match the service but not a specific eventName.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`event.outcome` (elastic rule field)	eq	`success`	11 rules	elastic
`aws::userIdentity.arn` (elastic rule field)	is_not_null		3 rules	elastic
`aws::userIdentity.invokedBy` (elastic rule field)	is_null		3 rules	elastic
`aws::requestParameters` (elastic rule field)	contains	`lambda:invokefunction`	2 rules	elastic
`aws::requestParameters` (elastic rule field)	contains	`principal=\*`	1 rule	elastic
`aws::requestParameters` (elastic rule field)	is_not_null		1 rule	elastic
`aws::userIdentity.type` (panther rule field)	eq	`AssumedRole`	1 rule	panther
`aws::userIdentity.type` (panther rule field)	in	`FederatedUser`	1 rule	panther
`aws::userIdentity.type` (panther rule field)	in	`IAMUser`	1 rule	panther
`source.as.organization.name` (elastic rule field)	is_not_null		1 rule	elastic
`userIdentity.sessionContext.sessionIssuer.userName` (panther rule field)	starts_with	`AWSReservedSSO_`	1 rule	panther

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

AWS New Lambda Layer Attached source low: Detects when a user attached a Lambda layer to an existing Lambda function. A malicious Lambda layer could execute arbitrary code in the context of the function's IAM role. This would give an adversary access to resources that the function has access to.

Elastic #

AWS Lambda Layer Added to Existing Function source low: Identifies when a Lambda layer is added to an existing AWS Lambda function. Lambda layers allow shared code, dependencies, or runtime modifications to be injected into a function’s execution environment. Adversaries with the ability to update function configurations may add a malicious layer to establish persistence, run unauthorized code, or intercept data handled by the function. This activity should be reviewed to ensure the modification is expected and authorized.T1578, T1578.005, T1648
AWS Lambda Function Invoked by an Unusual Principal source medium: Identifies the first time within the prior 14 days that a principal directly invokes an AWS Lambda function in an account, excluding invocations made on behalf of AWS services (normal event-source triggers). Adversaries who compromise credentials or move laterally may directly invoke functions to execute code, retrieve data returned by a function, or abuse an over-permissioned execution role. Direct, ad hoc invocation by a principal that does not normally call Lambda deviates from the usual event-driven invocation pattern and is worth reviewing. This rule relies on AWS Lambda data event logging, which is not enabled by default.T1648
AWS Lambda Function Invoked Cross-Account source medium: Identifies an AWS Lambda function invoked by a principal whose AWS account differs from the account that owns the function (a cross-account invocation). The caller's account is parsed from the invoking principal's ARN and compared to the function account. Adversaries who have been granted invoke permission on a function from an external account, or who operate from a separate attacker-controlled account, can use cross-account invocation to execute functions or retrieve the data they return. This is the data-plane counterpart to detecting the cross-account grant itself, and relies on AWS Lambda data event logging, which is not enabled by default.T1648

Show 8 more (11 total) on the rules page

Panther #

Lambda Code Updated by User source high: Detects when Lambda function code is updated by an IAM user, federated user, or AWS SSO user. This may indicate compromised credentials, a developer bypassing CI/CD guardrails, or insider threat activity.T1078

AddPermission

Service: lambda

Description

Grants an AWS service or another account permission to invoke a Lambda function by adding a statement to the function's resource-based policy.

CloudTrail management event, logged by default.

CloudTrail logs this operation under the eventName AddPermission20150331v2; the catalog keys on the SDK operation name AddPermission. A detection rule may use either name.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "Root",
    "principalId": "123456789012",
    "arn": "arn:aws:iam::123456789012:root",
    "accountId": "123456789012",
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE"
  },
  "eventTime": "2026-07-28T19:59:20Z",
  "eventSource": "lambda.amazonaws.com",
  "eventName": "AddPermission20150331v2",
  "awsRegion": "us-west-1",
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "aws-cli/2.34.28 md/awscrt#0.31.2 ua/2.1 os/linux#6.1.0-51-amd64 md/arch#x86_64 lang/python#3.14.3 md/pyimpl#CPython m/Z,E,n,b cfg/retry-mode#standard md/installer#exe md/distrib#debian.12 md/prompt#off md/command#lambda.add-permission",
  "requestParameters": {
    "functionName": "dw-harn-lambda-bf42d1",
    "statementId": "dw-harn-bf42d1",
    "action": "lambda:InvokeFunction",
    "principal": "sns.amazonaws.com"
  },
  "responseElements": {
    "statement": {
      "Sid": "dw-harn-bf42d1",
      "Effect": "Allow",
      "Principal": {
        "Service": "sns.amazonaws.com"
      },
      "Action": "lambda:InvokeFunction",
      "Resource": "arn:aws:lambda:us-west-1:123456789012:function:dw-harn-lambda-bf42d1"
    }
  },
  "requestID": "120d4bc9-a06a-4570-8296-4780b8f53cb7",
  "eventID": "a89d6295-e2e5-4e4f-9141-a5a6b09cc422",
  "readOnly": false,
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "123456789012",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

AWS Potential Backdoor Lambda Function Through Resource-Based Policy source informational: Identifies when a permission is added to a Lambda function, which could indicate a potential security risk.T1078
Lambda CRUD Actions source high: Unauthorized lambda Create, Read, Update, or Delete event occurred.T1525↳ also matches CreateFunction, UpdateFunctionConfiguration, CreateAlias, CreateEventSourceMapping, DeleteAlias, DeleteEventSourceMapping, and 6 more

CreateFunction

Service: lambda

Description

Creates a new Lambda function by uploading deployment package code and specifying the runtime, handler, and execution role.

CloudTrail management event, logged by default.

CloudTrail logs this operation under the eventName CreateFunction20150331; the catalog keys on the SDK operation name CreateFunction. A detection rule may use either name.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "18b550eb-8fbb-467f-8c79-3e06698cba9d",
  "eventName": "CreateFunction20150331",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T19:08:13Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "c1bb6ac6-4635-4eb0-b471-1881a0dcd72e",
  "requestParameters": {
    "code": {},
    "environment": {},
    "functionName": "dwfix-fn",
    "handler": "index.handler",
    "publish": false,
    "role": "arn:aws:iam::123456789012:role/dwfix-lambda-role",
    "runtime": "python3.12"
  },
  "responseElements": {
    "architectures": [
      "x86_64"
    ],
    "codeSha256": "P5VITRngl3L/kWmyVa6j5bLxE+yn+44ubt5qqYgt2JU=",
    "codeSize": 147,
    "description": "",
    "environment": {},
    "ephemeralStorage": {
      "size": 512
    },
    "functionArn": "arn:aws:lambda:us-west-1:123456789012:function:dwfix-fn",
    "functionName": "dwfix-fn",
    "handler": "index.handler",
    "lastModified": "2026-06-29T19:08:13.422+0000",
    "loggingConfig": {
      "logFormat": "Text",
      "logGroup": "/aws/lambda/dwfix-fn"
    },
    "memorySize": 128,
    "packageType": "Zip",
    "revisionId": "2eabd4d6-182a-494c-82f3-d12e2f7af3e1",
    "role": "arn:aws:iam::123456789012:role/dwfix-lambda-role",
    "runtime": "python3.12",
    "runtimeVersionConfig": {
      "runtimeVersionArn": "arn:aws:lambda:us-west-1::runtime:0eb6fb00a97c1a17d2e3014b04c79bfc9bea4301466439e3458f985dc75cadcc"
    },
    "snapStart": {
      "applyOn": "None",
      "optimizationStatus": "Off"
    },
    "state": "Pending",
    "stateReason": "The function is being created.",
    "stateReasonCode": "Creating",
    "timeout": 3,
    "tracingConfig": {
      "mode": "PassThrough"
    },
    "version": "$LATEST"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,Z,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

Lambda CRUD Actions source high: Unauthorized lambda Create, Read, Update, or Delete event occurred.T1525↳ also matches AddPermission, UpdateFunctionConfiguration, CreateAlias, CreateEventSourceMapping, DeleteAlias, DeleteEventSourceMapping, and 6 more

CreateFunctionUrlConfig

Service: lambda

Description

Creates a function URL, a dedicated HTTP(S) endpoint, for the specified Lambda function or function alias.

CloudTrail management event, logged by default.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "d3e1c694-f92c-4e23-b567-09f6df4d97da",
  "eventName": "CreateFunctionUrlConfig",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T19:08:22Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "cda6d2b4-d4a8-47be-af9b-f0fb51f5e65f",
  "requestParameters": {
    "authType": "AWS_IAM",
    "functionName": "dwfix-fn"
  },
  "responseElements": {
    "authType": "AWS_IAM",
    "creationTime": "2026-06-29T19:08:22.474258261Z",
    "functionArn": "arn:aws:lambda:us-west-1:123456789012:function:dwfix-fn",
    "functionUrl": "https://mbimn5dzlpsoma3pjcen34qxha0naktl.lambda-url.us-west-1.on.aws/"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,Z,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

New AWS Lambda Function URL Configuration Created source medium: Detects when a user creates a Lambda function URL configuration, which could be used to expose the function to the internet and potentially allow unauthorized access to the function's IAM role for AWS API calls. This could give an adversary access to the privileges associated with the Lambda service role that is attached to that function.

Invoke

Service: lambda

Description

Synchronously invokes a Lambda function and returns the function's response payload.

CloudTrail data event: not logged by a standard management-events trail. Requires explicit data-event configuration (an advanced event selector) on the trail or CloudTrail Lake; absence of this event does not prove the action did not occur. Lambda data event. NOT logged by a standard management-events trail: you must enable Lambda data-event logging (an advanced event selector on AWS::Lambda::Function) on the trail or CloudTrail Lake. Absence of Invoke events does NOT mean no function was executed.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Data",
  "eventID": "8f1122b9-f261-4707-b978-e195a9f56370",
  "eventName": "Invoke",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T18:45:04Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": false,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "77a406ba-436f-48da-a8f0-dfb711ef5a2d",
  "requestParameters": null,
  "resources": [
    {
      "ARN": "arn:aws:lambda:us-west-1:123456789012:function:ddddd",
      "accountId": "123456789012",
      "type": "AWS::Lambda::Function"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListFunctions

Service: lambda

Description

Returns a paginated list of Lambda functions in the current account and region, with optional filtering by runtime or layer.

CloudTrail management event, logged by default.

CloudTrail logs this operation under the eventName ListFunctions20150331; the catalog keys on the SDK operation name ListFunctions. A detection rule may use either name.

Example CloudTrail Event #

{
  "awsRegion": "us-west-2",
  "eventID": "d801d31e-37a7-4c02-bda3-ef4098edc7cf",
  "eventName": "ListFunctions",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2017-02-19T20:41:54Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "d94d9ca2-f6e3-11e6-be7f-f234b09c28df",
  "requestParameters": {
    "maxItems": 50
  },
  "responseElements": null,
  "sourceIPAddress": "255.253.125.115",
  "userAgent": "console.amazonaws.com",
  "userIdentity": {
    "accessKeyId": "ASIAJGMT0U1DL7V6R08E",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:root",
    "principalId": "811596193553",
    "sessionContext": {
      "attributes": {
        "creationDate": "2017-02-19T15:37:15Z",
        "mfaAuthenticated": "true"
      }
    },
    "type": "Root"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Discovery API Calls from VPN ASN for the First Time by Identity source high: Flags the first time a given IAM principal invokes a narrow set of high-signal discovery APIs (credential check, account and IAM enumeration, bucket and compute inventory, logging introspection) from a source IP whose autonomous system number (ASN) matches a curated set commonly associated with consumer VPN brands, VPN-heavy hosting, and provider networks referenced in public reporting on TeamPCP activity (for example 31173 Services AB AS39351 and Oy Crea Nova Hosting Solution Ltd). Broad List*/Describe* patterns are intentionally omitted to reduce noise. Hosting ASNs are heavily dual-use; validate source.as.number in your data and extend event.action only when your baseline allows it.T1526, T1580↳ also matches ListAliases

References #

Sample log: flaws.cloud CloudTrail training logs

PublishLayerVersion

Service: lambda

Description

Creates a new version of a Lambda layer by uploading a deployment package containing libraries or other dependencies.

CloudTrail management event, logged by default.

CloudTrail logs this operation under the eventName PublishLayerVersion20181031; the catalog keys on the SDK operation name PublishLayerVersion. A detection rule may use either name.

Example CloudTrail Event #

{
  "additionalEventData": {
    "signatureStatus": "VALID"
  },
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "630b9159-7eb6-4017-8380-8518314a7eca",
  "eventName": "PublishLayerVersion20181031",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T19:08:25Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "7890f22c-9bbb-4348-939f-ede7261c66e6",
  "requestParameters": {
    "content": {},
    "layerName": "dwfix-layer"
  },
  "responseElements": {
    "content": {
      "codeSha256": "P5VITRngl3L/kWmyVa6j5bLxE+yn+44ubt5qqYgt2JU=",
      "codeSize": 147,
      "uncompressedCodeSize": 0
    },
    "createdDate": "2026-06-29T19:08:25.908+0000",
    "description": "",
    "layerArn": "arn:aws:lambda:us-west-1:123456789012:layer:dwfix-layer",
    "layerVersionArn": "arn:aws:lambda:us-west-1:123456789012:layer:dwfix-layer:1",
    "version": 1
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,Z,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateFunctionConfiguration

Service: lambda

Description

Modifies the configuration settings of a Lambda function, such as its memory, timeout, environment variables, or execution role.

CloudTrail management event, logged by default.

CloudTrail logs this operation under the eventName UpdateFunctionConfiguration20150331v2; the catalog keys on the SDK operation name UpdateFunctionConfiguration. A detection rule may use either name.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "Root",
    "principalId": "123456789012",
    "arn": "arn:aws:iam::123456789012:root",
    "accountId": "123456789012",
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE"
  },
  "eventTime": "2026-07-28T19:59:22Z",
  "eventSource": "lambda.amazonaws.com",
  "eventName": "UpdateFunctionConfiguration20150331v2",
  "awsRegion": "us-west-1",
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "aws-cli/2.34.28 md/awscrt#0.31.2 ua/2.1 os/linux#6.1.0-51-amd64 md/arch#x86_64 lang/python#3.14.3 md/pyimpl#CPython m/Z,E,n,b cfg/retry-mode#standard md/installer#exe md/distrib#debian.12 md/prompt#off md/command#lambda.update-function-configuration",
  "requestParameters": {
    "functionName": "dw-harn-lambda-bf42d1",
    "description": "dw harness bf42d1",
    "environment": {}
  },
  "responseElements": {
    "functionName": "dw-harn-lambda-bf42d1",
    "functionArn": "arn:aws:lambda:us-west-1:123456789012:function:dw-harn-lambda-bf42d1",
    "runtime": "python3.13",
    "role": "arn:aws:iam::123456789012:role/dw-harn-lambda-role-bf42d1",
    "handler": "lambda_function.handler",
    "codeSize": 202,
    "description": "dw harness bf42d1",
    "timeout": 3,
    "memorySize": 128,
    "lastModified": "2026-07-28T19:59:22.000+0000",
    "codeSha256": "2eOd/xYdNc+GohI5MpM68i1ZgaS0PtsNs72nW6zw/Eg=",
    "version": "$LATEST",
    "environment": {},
    "tracingConfig": {
      "mode": "PassThrough"
    },
    "revisionId": "cb86ee96-06d0-4555-87d3-5ea8fda4f116",
    "state": "Active",
    "lastUpdateStatus": "InProgress",
    "lastUpdateStatusReason": "The function is being created.",
    "lastUpdateStatusReasonCode": "Creating",
    "packageType": "Zip",
    "architectures": [
      "x86_64"
    ],
    "ephemeralStorage": {
      "size": 512
    },
    "snapStart": {
      "applyOn": "None",
      "optimizationStatus": "Off"
    },
    "runtimeVersionConfig": {
      "runtimeVersionArn": "arn:aws:lambda:us-west-1::runtime:c45043813da1baebf5ac04edcaef1a67db184ee08f1fd2b4ce1642305ee9845c"
    },
    "loggingConfig": {
      "logFormat": "Text",
      "logGroup": "/aws/lambda/dw-harn-lambda-bf42d1"
    }
  },
  "requestID": "c9c31e34-6900-4257-a968-18f50c9814d4",
  "eventID": "d07d4a18-218e-4531-b1ec-a850f80559e9",
  "readOnly": false,
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "123456789012",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com"
  }
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`aws::userIdentity.type` (panther rule field)	eq	`AssumedRole`	1 rule	panther
`aws::userIdentity.type` (panther rule field)	in	`FederatedUser`	1 rule	panther
`aws::userIdentity.type` (panther rule field)	in	`IAMUser`	1 rule	panther
`userIdentity.sessionContext.sessionIssuer.userName` (panther rule field)	starts_with	`AWSReservedSSO_`	1 rule	panther

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

Lambda Configuration Updated with Layers by User source high: Detects when Lambda function configuration is updated with layers by an IAM user, federated user, or AWS SSO user. Lambda layers can execute code before the main function, making them a stealthy persistence mechanism. This may indicate compromised credentials, a developer bypassing CI/CD guardrails, or insider threat activity.T1078
Lambda CRUD Actions source high: Unauthorized lambda Create, Read, Update, or Delete event occurred.T1525↳ also matches AddPermission, CreateFunction, CreateAlias, CreateEventSourceMapping, DeleteAlias, DeleteEventSourceMapping, and 6 more

AddEventSource

Service: lambda

Description

Identifies a stream as an event source for an AWS Lambda function.

AddLayerVersionPermission

Service: lambda

Description

Adds permissions to the resource-based policy of a version of an Lambda layer.

CloudTrail management event, logged by default.

CloudTrail logs this operation under the eventName AddLayerVersionPermission20181031; the catalog keys on the SDK operation name AddLayerVersionPermission. A detection rule may use either name.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "effa8abb-1413-4a8b-9200-c5d2aca72d0a",
  "eventName": "AddLayerVersionPermission20181031",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T21:01:16Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "bfec204f-f41a-4c70-99ee-87f40a425e8c",
  "requestParameters": {
    "action": "lambda:GetLayerVersion",
    "layerName": "dwfix-lambda-sample-layer",
    "principal": "123456789012",
    "statementId": "dwfix-layer-stmt-001",
    "versionNumber": 1
  },
  "responseElements": {
    "revisionId": "4accb008-ac2d-4c31-80e1-e9d2f679fc47",
    "statement": {
      "Sid": "dwfix-layer-stmt-001",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:root"
      },
      "Action": "lambda:GetLayerVersion",
      "Resource": "arn:aws:lambda:us-west-1:123456789012:layer:dwfix-lambda-sample-layer:1"
    }
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b,n cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CheckpointDurableExecution

Service: lambda

Description

Saves the progress of a durable function execution during runtime.

CreateAlias

Service: lambda

Description

Creates an alias for a Lambda function version.

CloudTrail logs this operation under the eventName CreateAlias20150331; the catalog keys on the SDK operation name CreateAlias. A detection rule may use either name.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "148f5095-438e-4a92-acd4-ad03b7d88550",
  "eventName": "CreateAlias20150331",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T19:08:22Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "0a513ebc-695d-49c1-ba92-faf6bc7eeea9",
  "requestParameters": {
    "functionName": "dwfix-fn",
    "functionVersion": "$LATEST",
    "name": "dw"
  },
  "responseElements": {
    "aliasArn": "arn:aws:lambda:us-west-1:123456789012:function:dwfix-fn:dw",
    "description": "",
    "functionVersion": "$LATEST",
    "name": "dw",
    "revisionId": "8468e1c6-109b-40e0-b1ad-44961fcb8773"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,Z,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

Lambda CRUD Actions source high: Unauthorized lambda Create, Read, Update, or Delete event occurred.T1525↳ also matches AddPermission, CreateFunction, UpdateFunctionConfiguration, CreateEventSourceMapping, DeleteAlias, DeleteEventSourceMapping, and 6 more

CreateCapacityProvider

Service: lambda

Description

Creates a capacity provider that manages compute resources for Lambda functions

CreateCodeSigningConfig

Service: lambda

Description

Creates a code signing configuration.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "4426d5da-4de9-48bb-9a8d-59a560038912",
  "eventName": "CreateCodeSigningConfig",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T21:01:11Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "936d338b-6d12-4f72-a443-8a8237e28246",
  "requestParameters": {
    "allowedPublishers": {
      "signingProfileVersionArns": [
        "arn:aws:signer:us-west-1:123456789012:/signing-profiles/dwfix-profile/abcdef12"
      ]
    },
    "codeSigningPolicies": {
      "untrustedArtifactOnDeployment": "Warn"
    },
    "description": "dwfix sample CSC"
  },
  "responseElements": {
    "CodeSigningConfig": {
      "AllowedPublishers": {
        "SigningProfileVersionArns": [
          "arn:aws:signer:us-west-1:123456789012:/signing-profiles/dwfix-profile/abcdef12"
        ]
      },
      "CodeSigningConfigArn": "arn:aws:lambda:us-west-1:123456789012:code-signing-config:csc-01f375fdb82a86aef",
      "CodeSigningConfigId": "csc-01f375fdb82a86aef",
      "CodeSigningPolicies": {
        "UntrustedArtifactOnDeployment": "Warn"
      },
      "Description": "dwfix sample CSC",
      "LastModified": "2026-06-29T21:01:11.875328097Z"
    }
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b,n cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreateEventSourceMapping

Service: lambda

Description

Creates a mapping between an event source and an Lambda function.

CloudTrail management event, logged by default.

CloudTrail logs this operation under the eventName CreateEventSourceMapping20150331; the catalog keys on the SDK operation name CreateEventSourceMapping. A detection rule may use either name.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "InvalidParameterValueException",
  "errorMessage": "The function execution role does not have permissions to call ReceiveMessage on SQS",
  "eventCategory": "Management",
  "eventID": "bf5d5d0e-2d8d-42ca-b64a-104718569409",
  "eventName": "CreateEventSourceMapping20150331",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T21:01:35Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "63db2ede-06b1-40a6-b213-f6680a6fa00c",
  "requestParameters": {
    "batchSize": 10,
    "enabled": true,
    "eventSourceArn": "arn:aws:sqs:us-west-1:123456789012:dwfix-lambda-sample-esm",
    "functionName": "dwfix-lambda-sample-fn"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b,n cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

Lambda CRUD Actions source high: Unauthorized lambda Create, Read, Update, or Delete event occurred.T1525↳ also matches AddPermission, CreateFunction, UpdateFunctionConfiguration, CreateAlias, DeleteAlias, DeleteEventSourceMapping, and 6 more

CreateMicrovmAuthToken

Service: lambda

Description

Creates an authentication token for accessing a running MicroVM.

CreateMicrovmImage

Service: lambda

Description

Creates a MicroVM image from the specified code artifact and base image.

CreateMicrovmShellAuthToken

Service: lambda

Description

Creates a shell authentication token for interactive shell access to a running MicroVM.

CreateNetworkConnector

Service: lambda

Description

Creates a network connector that enables Lambda compute resources to route outbound traffic through your Amazon VPC.

DeleteAlias

Service: lambda

Description

Deletes a Lambda function alias.

CloudTrail logs this operation under the eventName DeleteAlias20150331; the catalog keys on the SDK operation name DeleteAlias. A detection rule may use either name.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "f4ead621-69a6-43a5-bb3c-319dc9ed3379",
  "eventName": "DeleteAlias20150331",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T19:08:26Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "53e4ff38-1ae5-4c4d-953d-a61dc03cc019",
  "requestParameters": {
    "functionName": "dwfix-fn",
    "name": "dw"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,Z,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

Lambda CRUD Actions source high: Unauthorized lambda Create, Read, Update, or Delete event occurred.T1525↳ also matches AddPermission, CreateFunction, UpdateFunctionConfiguration, CreateAlias, CreateEventSourceMapping, DeleteEventSourceMapping, and 6 more

DeleteCapacityProvider

Service: lambda

Description

Deletes a capacity provider.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "Capacity provider not found: ddddd. Check that the ARN is correct and the capacity provider exists in this Region.",
  "eventCategory": "Management",
  "eventID": "227fed7a-9613-4144-b1a8-a78b7caf21b4",
  "eventName": "DeleteCapacityProvider",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T19:24:40Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "0c00e149-3f06-44e5-a878-604eb1367b55",
  "requestParameters": {
    "capacityProviderName": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteCodeSigningConfig

Service: lambda

Description

Deletes the code signing configuration.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "df7d72df-7bd8-449b-8455-2852c7ca3535",
  "eventName": "DeleteCodeSigningConfig",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T21:01:35Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "2377c7a9-70b0-496d-b8cc-1f7cc0eb0758",
  "requestParameters": {
    "codeSigningConfigArn": "arn:aws:lambda:us-west-1:123456789012:code-signing-config:csc-01f375fdb82a86aef"
  },
  "resources": [
    {
      "ARN": "arn:aws:lambda:us-west-1:123456789012:code-signing-config:csc-01f375fdb82a86aef",
      "accountId": "123456789012",
      "type": "code-signing-config"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b,n cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteEventSourceMapping

Service: lambda

Description

Deletes an event source mapping.

CloudTrail logs this operation under the eventName DeleteEventSourceMapping20150331; the catalog keys on the SDK operation name DeleteEventSourceMapping. A detection rule may use either name.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "Root",
    "principalId": "123456789012",
    "arn": "arn:aws:iam::123456789012:root",
    "accountId": "123456789012",
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE"
  },
  "eventTime": "2026-07-28T19:59:32Z",
  "eventSource": "lambda.amazonaws.com",
  "eventName": "DeleteEventSourceMapping20150331",
  "awsRegion": "us-west-1",
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "aws-cli/2.34.28 md/awscrt#0.31.2 ua/2.1 os/linux#6.1.0-51-amd64 md/arch#x86_64 lang/python#3.14.3 md/pyimpl#CPython m/Z,E,n,b cfg/retry-mode#standard md/installer#exe md/distrib#debian.12 md/prompt#off md/command#lambda.delete-event-source-mapping",
  "requestParameters": {
    "uUID": "46deb737-2ec4-49b3-921d-b47f951b0ec7"
  },
  "responseElements": {
    "uUID": "46deb737-2ec4-49b3-921d-b47f951b0ec7",
    "batchSize": 1,
    "maximumBatchingWindowInSeconds": 0,
    "eventSourceArn": "arn:aws:sqs:us-west-1:123456789012:dw-harn-sqs-lambda-bf42d1",
    "functionArn": "arn:aws:lambda:us-west-1:123456789012:function:dw-harn-lambda-bf42d1",
    "lastModified": "Jul 28, 2026, 7:59:32 PM",
    "state": "Deleting",
    "stateTransitionReason": "USER_INITIATED",
    "functionResponseTypes": [],
    "eventSourceMappingArn": "arn:aws:lambda:us-west-1:123456789012:event-source-mapping:46deb737-2ec4-49b3-921d-b47f951b0ec7"
  },
  "requestID": "b31bf5f8-d236-44ed-af1a-6ea99343bc28",
  "eventID": "d7fe885c-2628-4532-ae6d-6cdd78229690",
  "readOnly": false,
  "resources": [
    {
      "accountId": "123456789012",
      "type": "event-source-mapping",
      "ARN": "arn:aws:lambda:us-west-1:123456789012:event-source-mapping:46deb737-2ec4-49b3-921d-b47f951b0ec7"
    }
  ],
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "123456789012",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

Lambda CRUD Actions source high: Unauthorized lambda Create, Read, Update, or Delete event occurred.T1525↳ also matches AddPermission, CreateFunction, UpdateFunctionConfiguration, CreateAlias, CreateEventSourceMapping, DeleteAlias, and 6 more

DeleteFunction

Service: lambda

Description

Deletes the specified Lambda function code and configuration.

CloudTrail management event, logged by default.

CloudTrail logs this operation under the eventName DeleteFunction20150331; the catalog keys on the SDK operation name DeleteFunction. A detection rule may use either name.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "994298a8-42e5-41cc-8630-dbfc21d12f9a",
  "eventName": "DeleteFunction20150331",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T19:08:26Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "78058774-bfba-4642-9ecc-7d1775a75b72",
  "requestParameters": {
    "functionName": "dwfix-fn"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,Z,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Lambda Function Deletion source low: Identifies the deletion of an AWS Lambda function. Deleting a function removes its code, configuration, versions, and aliases. Adversaries may delete functions to disrupt business operations and automated workflows, to destroy attacker-deployed backdoors and remove evidence after achieving their objective, or to inhibit incident response. Because function deletion is destructive and often irreversible without redeployment, deletions performed by unexpected principals or outside change windows should be reviewed.T1485, T1489

Panther #

Lambda CRUD Actions source high: Unauthorized lambda Create, Read, Update, or Delete event occurred.T1525↳ also matches AddPermission, CreateFunction, UpdateFunctionConfiguration, CreateAlias, CreateEventSourceMapping, DeleteAlias, and 6 more

DeleteFunctionCodeSigningConfig

Service: lambda

Description

Removes the code signing configuration from the function.

CloudTrail management event, logged by default.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "Function not found: arn:aws:lambda:us-west-1:123456789012:function:ddddd",
  "eventCategory": "Management",
  "eventID": "3bb4b2ff-d863-4556-9084-ebc6ffad5244",
  "eventName": "DeleteFunctionCodeSigningConfig",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T19:24:40Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "7c8d2fb4-c387-45f8-8918-3caac5881a11",
  "requestParameters": {
    "functionName": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteFunctionConcurrency

Service: lambda

Description

Removes a concurrent execution limit from a function.

CloudTrail logs this operation under the eventName DeleteFunctionConcurrency20171031; the catalog keys on the SDK operation name DeleteFunctionConcurrency. A detection rule may use either name.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "19bc02d9-e346-48b7-9453-1922564c4e6c",
  "eventName": "DeleteFunctionConcurrency20171031",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T19:08:26Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "0c38cd51-901f-4146-a3ca-3081ffa299ff",
  "requestParameters": {
    "functionName": "dwfix-fn"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,Z,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteFunctionEventInvokeConfig

Service: lambda

Description

Deletes the configuration for asynchronous invocation for a function, version, or alias.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "c24a28c3-3715-49dd-aa6e-15bacfc2e5fa",
  "eventName": "DeleteFunctionEventInvokeConfig",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T19:08:26Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "e6310047-d6b8-4faf-abae-99cff4aff5be",
  "requestParameters": {
    "functionName": "dwfix-fn"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,Z,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteFunctionUrlConfig

Service: lambda

Description

Deletes a Lambda function URL.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "9a1a05dc-c038-4f7b-942c-aa9425f77909",
  "eventName": "DeleteFunctionUrlConfig",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T19:08:26Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "6365063f-6e81-4bc4-9849-4db73c839885",
  "requestParameters": {
    "functionName": "dwfix-fn"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,Z,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteLayerVersion

Service: lambda

Description

Deletes a version of an Lambda layer.

CloudTrail logs this operation under the eventName DeleteLayerVersion20181031; the catalog keys on the SDK operation name DeleteLayerVersion. A detection rule may use either name.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "a6bca423-3d6c-4362-95b1-2612edb6ea11",
  "eventName": "DeleteLayerVersion20181031",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T19:08:26Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "81546de0-e261-4db9-8a90-7cdb53d78901",
  "requestParameters": {
    "layerName": "dwfix-layer",
    "versionNumber": 1
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,Z,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteMicrovmImage

Service: lambda

Description

Deletes a MicroVM image.

DeleteMicrovmImageVersion

Service: lambda

Description

Deletes a specific version of a MicroVM image.

DeleteNetworkConnector

Service: lambda

Description

Initiates deletion of a network connector.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "AccessDenied",
  "errorMessage": "Unable to determine service/operation name to be authorized",
  "eventCategory": "Management",
  "eventID": "26a6397d-8664-430a-ba0f-f7359c183aa2",
  "eventName": "DeleteNetworkConnector",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T19:24:41Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "d98650cc-d4c3-4359-85d5-e6213333cc83",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteProvisionedConcurrencyConfig

Service: lambda

Description

Deletes the provisioned concurrency configuration for a function.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "Cannot find alias arn: arn:aws:lambda:us-west-1:123456789012:function:ddddd:ddddd",
  "eventCategory": "Management",
  "eventID": "3b252a94-034c-4114-b62f-a97045742ca3",
  "eventName": "DeleteProvisionedConcurrencyConfig",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T19:24:41Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "b8d3d10e-0e6f-4f1c-b3cc-ccc7c8bbb38d",
  "requestParameters": {
    "functionName": "ddddd",
    "qualifier": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetAccountSettings

Service: lambda

Description

Retrieves details about your account's limits and usage in an Amazon Web Services Region.

CloudTrail logs this operation under the eventName GetAccountSettings20160819; the catalog keys on the SDK operation name GetAccountSettings. A detection rule may use either name.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "e8167db5-807a-457e-b48d-a385d163b6d2",
  "eventName": "GetAccountSettings20160819",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T18:32:23Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "39e5958e-cda8-4729-8bbd-a3a2264504ff",
  "requestParameters": {
    "includeBlacklistedFeatures": false,
    "includeDeprecatedFeaturesAccess": false,
    "includeDeprecatedRuntimeDetails": false,
    "includePreviewFeatures": false,
    "includeUnreservedConcurrentExecutionsMinimum": false
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetAlias

Service: lambda

Description

Returns details about a Lambda function alias.

CloudTrail logs this operation under the eventName GetAlias20150331; the catalog keys on the SDK operation name GetAlias. A detection rule may use either name.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "Cannot find alias arn: arn:aws:lambda:us-west-1:123456789012:function:ddddd:ddddd",
  "eventCategory": "Management",
  "eventID": "abdaed42-a233-4fba-a278-84d16d13dae1",
  "eventName": "GetAlias20150331",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T18:45:04Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "fc5a71b8-89a3-40b6-872f-03d3f280b175",
  "requestParameters": {
    "functionName": "ddddd",
    "name": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetCapacityProvider

Service: lambda

Description

Retrieves information about a specific capacity provider, including its configuration, state, and associated resources.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "Capacity provider not found: arn:aws:lambda:us-west-1:123456789012:capacity-provider:ddddd. Check that the ARN is correct and the capacity provider exists in this Region.",
  "eventCategory": "Management",
  "eventID": "523843d8-bcdb-4cea-a3c4-b414a3b028b0",
  "eventName": "GetCapacityProvider",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T18:45:04Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "9be0429b-e909-43eb-827a-239c5e7defa6",
  "requestParameters": {
    "capacityProviderName": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetCodeSigningConfig

Service: lambda

Description

Returns information about the specified code signing configuration.

GetDurableExecution

Service: lambda

Description

Retrieves detailed information about a specific durable execution, including its current status, input payload, result or error information, and execution metadata such as start time and usage statistics.

GetDurableExecutionHistory

Service: lambda

Description

Retrieves the execution history for a durable execution, showing all the steps, callbacks, and events that occurred during the execution.

GetDurableExecutionState

Service: lambda

Description

Retrieves the current execution state required for the replay process during durable function execution.

GetEventSource

Service: lambda

Description

Returns configuration information for the specified event source mapping (see AddEventSource).

GetEventSourceMapping

Service: lambda

Description

Returns details about an event source mapping.

CloudTrail logs this operation under the eventName GetEventSourceMapping20150331; the catalog keys on the SDK operation name GetEventSourceMapping. A detection rule may use either name.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "The resource you requested does not exist.",
  "eventCategory": "Management",
  "eventID": "5f3dddf2-2cdf-4890-ac06-ece354224239",
  "eventName": "GetEventSourceMapping20150331",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T18:45:04Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "5beabaa1-5bf9-44bf-b516-102b713d9317",
  "requestParameters": {
    "uUID": "dddddddddddddddddddddddddddddddddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetFunction

Service: lambda

Description

Returns the configuration information of the Lambda function and a presigned URL link to the .zip file you uploaded with UploadFunction so you can download the .zip file.

CloudTrail management event, logged by default.

CloudTrail logs this operation under the eventName GetFunction20150331v2; the catalog keys on the SDK operation name GetFunction. A detection rule may use either name.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "Function not found: arn:aws:lambda:us-west-1:123456789012:function:ddddd",
  "eventCategory": "Management",
  "eventID": "c6032136-12a7-4db3-a0f5-2dd967cf40e7",
  "eventName": "GetFunction20150331v2",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T18:45:04Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "06326a69-cef0-444e-943a-9940a4a197be",
  "requestParameters": {
    "functionName": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetFunctionCodeSigningConfig

Service: lambda

Description

Returns the code signing configuration for the specified function.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "005fb7a0-c038-4739-9cf3-81675ce46ff0",
  "eventName": "GetFunctionCodeSigningConfig",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2023-07-10T12:28:38Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123837392027",
  "requestID": "be57736f-7ec4-4a7b-a77e-eaacba55bece",
  "requestParameters": {
    "functionName": "stratus-red-team-backdoor-f-func"
  },
  "responseElements": null,
  "sourceIPAddress": "192.168.10.20",
  "tlsDetails": {
    "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256",
    "clientProvidedHostHeader": "lambda.us-east-1.amazonaws.com",
    "tlsVersion": "TLSv1.2"
  },
  "userAgent": "APN/1.0 HashiCorp/1.0 Terraform/1.1.2 (+https://www.terraform.io) terraform-provider-aws/3.76.1 (+https://registry.terraform.io/providers/hashicorp/aws) aws-sdk-go/1.44.157 (go1.19.3; linux; amd64) HashiCorp-terraform-exec/0.17.3",
  "userIdentity": {
    "accessKeyId": "AKIATFQR7NSC8Q4X20BJ",
    "accountId": "123837392027",
    "arn": "arn:aws:iam::123837392027:user/bert-jan",
    "principalId": "AIDATFQR7NSC5AU2ZV3IE",
    "type": "IAMUser",
    "userName": "bert-jan"
  }
}

References #

Sample log: invictus-ir/aws_dataset

GetFunctionConcurrency

Service: lambda

Description

Returns details about the reserved concurrency configuration for a function.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "Function not found: arn:aws:lambda:us-west-1:123456789012:function:ddddd",
  "eventCategory": "Management",
  "eventID": "1ffdc979-636c-43d9-904b-7468efb2ad1e",
  "eventName": "GetFunctionConcurrency",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T18:45:04Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "af13d728-4610-4665-978c-adcaa7283687",
  "requestParameters": {
    "functionName": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetFunctionConfiguration

Service: lambda

Description

Returns the configuration information of the Lambda function.

CloudTrail logs this operation under the eventName GetFunctionConfiguration20150331v2; the catalog keys on the SDK operation name GetFunctionConfiguration. A detection rule may use either name.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "Function not found: arn:aws:lambda:us-west-1:123456789012:function:ddddd",
  "eventCategory": "Management",
  "eventID": "68d212a4-9d6c-473b-affa-1b5b265e93f6",
  "eventName": "GetFunctionConfiguration20150331v2",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T18:45:04Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "e3a1b11b-3f0e-4465-94a2-e0adf2c852c1",
  "requestParameters": {
    "functionName": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetFunctionEventInvokeConfig

Service: lambda

Description

Retrieves the configuration for asynchronous invocation for a function, version, or alias.

Example CloudTrail Event #

{
  "awsRegion": "us-west-2",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: lambda:GetFunctionEventInvokeConfig on resource: arn:aws:lambda:us-west-2:811596193553:function:Level6",
  "eventID": "bd9e79c6-6183-4255-8205-25c6fabf2179",
  "eventName": "GetFunctionEventInvokeConfig",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2020-06-27T17:08:13Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "d449ae6a-0b55-488e-ae4e-a1175350cc92",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "127.3.73.208",
  "userAgent": "aws-cli/1.18.46 Python/3.7.7 Linux/5.4.0-kali4-amd64 botocore/1.15.46",
  "userIdentity": {
    "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/Level6",
    "principalId": "AIDADO2GQD0K8TEF7KW1V",
    "type": "IAMUser",
    "userName": "Level6"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

GetFunctionRecursionConfig

Service: lambda

Description

Returns your function's recursive loop detection configuration.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "The resource you requested does not exist.",
  "eventCategory": "Management",
  "eventID": "46756424-3be0-48fc-93bf-1375e8e0c736",
  "eventName": "GetFunctionRecursionConfig",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T18:45:04Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "94371621-fd7b-4c13-8cfa-1b5c930bcb85",
  "requestParameters": {
    "functionName": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetFunctionScalingConfig

Service: lambda

Description

Retrieves the scaling configuration for a Lambda Managed Instances function.

GetFunctionUrlConfig

Service: lambda

Description

Returns details about a Lambda function URL.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "The resource you requested does not exist.",
  "eventCategory": "Management",
  "eventID": "9a943a58-0319-4448-b091-4b23173fd606",
  "eventName": "GetFunctionUrlConfig",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T18:45:04Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "79da03d9-3660-47df-9a59-45eb243498f5",
  "requestParameters": {
    "functionName": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetLayerVersion

Service: lambda

Description

Returns information about a version of an Lambda layer, with a link to download the layer archive that's valid for 10 minutes.

CloudTrail logs this operation under the eventName GetLayerVersion20181031; the catalog keys on the SDK operation name GetLayerVersion. A detection rule may use either name.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "The resource you requested does not exist.",
  "eventCategory": "Management",
  "eventID": "8d4b946a-edbd-43de-878a-f164b32f4de9",
  "eventName": "GetLayerVersion20181031",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T18:45:04Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "e42cacf4-0061-4290-a55c-debe02695267",
  "requestParameters": {
    "layerName": "ddddd",
    "versionNumber": 1
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetLayerVersionByArn

Service: lambda

Description

Returns information about a version of an Lambda layer, with a link to download the layer archive that's valid for 10 minutes.

GetLayerVersionPolicy

Service: lambda

Description

Returns the permission policy for a version of an Lambda layer.

CloudTrail logs this operation under the eventName GetLayerVersionPolicy20181031; the catalog keys on the SDK operation name GetLayerVersionPolicy. A detection rule may use either name.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "Layer version arn:aws:lambda:us-west-1:123456789012:layer:ddddd:1 does not exist.",
  "eventCategory": "Management",
  "eventID": "ab62551a-a49b-41d1-9c57-d1dfbc0a0a9f",
  "eventName": "GetLayerVersionPolicy20181031",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T18:45:04Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "76626ecf-3fa1-4411-a730-a05d4ab01c81",
  "requestParameters": {
    "layerName": "ddddd",
    "versionNumber": 1
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetMicrovm

Service: lambda

Description

Retrieves the details of a specific MicroVM, including its state, endpoint, image information, and configuration.

GetMicrovmImage

Service: lambda

Description

Retrieves the details of a MicroVM image, including its state, versions, and configuration.

GetMicrovmImageBuild

Service: lambda

Description

Retrieves the details of a specific MicroVM image build, including its state, target architecture, and snapshot information.

GetMicrovmImageVersion

Service: lambda

Description

Retrieves the details of a specific version of a MicroVM image, including its configuration, state, and build information.

GetNetworkConnector

Service: lambda

Description

Retrieves the current configuration, state, and metadata of a network connector.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "AccessDenied",
  "errorMessage": "Unable to determine service/operation name to be authorized",
  "eventCategory": "Management",
  "eventID": "53599b58-8961-4f53-a09c-0c99ca6f43d6",
  "eventName": "GetNetworkConnector",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T18:45:05Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "99156192-83d7-4298-952b-c7e1929bdef4",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetPolicy

Service: lambda

Description

Returns the resource-based IAM policy for a function, version, or alias.

CloudTrail logs this operation under the eventName GetPolicy20150331v2; the catalog keys on the SDK operation name GetPolicy. A detection rule may use either name.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "The resource you requested does not exist.",
  "eventCategory": "Management",
  "eventID": "fa09d18f-6a71-4a5c-b3fc-0d62ce17ead4",
  "eventName": "GetPolicy20150331v2",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T18:45:05Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "e20ac9a0-b08c-48ec-885c-070af158b21a",
  "requestParameters": {
    "functionName": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetProvisionedConcurrencyConfig

Service: lambda

Description

Retrieves the provisioned concurrency configuration for a function's alias or version.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "Cannot find alias arn: arn:aws:lambda:us-west-1:123456789012:function:ddddd:ddddd",
  "eventCategory": "Management",
  "eventID": "3109dcd6-2f54-4c7b-88da-016aea5715e5",
  "eventName": "GetProvisionedConcurrencyConfig",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T18:45:05Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "345fbd69-d181-40b1-854e-ef86d753802a",
  "requestParameters": {
    "functionName": "ddddd",
    "qualifier": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetRuntimeManagementConfig

Service: lambda

Description

Retrieves the runtime management configuration for a function's version.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "Function not found: arn:aws:lambda:us-west-1:123456789012:function:ddddd",
  "eventCategory": "Management",
  "eventID": "e1e643c4-dd73-4382-8f6a-2209ad976f80",
  "eventName": "GetRuntimeManagementConfig",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T18:45:05Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "6f0744b5-74b8-477d-a11f-31f211c8a019",
  "requestParameters": {
    "functionName": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

InvokeAsync

Service: lambda

Description

Submits an invocation request to AWS Lambda.

InvokeWithResponseStream

Service: lambda

Description

Configure your Lambda functions to stream response payloads back to clients.

ListAliases

Service: lambda

Description

Returns a list of aliases for a Lambda function.

CloudTrail logs this operation under the eventName ListAliases20150331; the catalog keys on the SDK operation name ListAliases. A detection rule may use either name.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "Function not found: arn:aws:lambda:us-west-1:123456789012:function:ddddd",
  "eventCategory": "Management",
  "eventID": "da1de1f1-57ed-4c81-a5a9-06e612c3a62f",
  "eventName": "ListAliases20150331",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T18:45:05Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "2265d889-ebc9-4f92-8901-2326f82bc39e",
  "requestParameters": {
    "functionName": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Discovery API Calls from VPN ASN for the First Time by Identity source high: Flags the first time a given IAM principal invokes a narrow set of high-signal discovery APIs (credential check, account and IAM enumeration, bucket and compute inventory, logging introspection) from a source IP whose autonomous system number (ASN) matches a curated set commonly associated with consumer VPN brands, VPN-heavy hosting, and provider networks referenced in public reporting on TeamPCP activity (for example 31173 Services AB AS39351 and Oy Crea Nova Hosting Solution Ltd). Broad List*/Describe* patterns are intentionally omitted to reduce noise. Hosting ASNs are heavily dual-use; validate source.as.number in your data and extend event.action only when your baseline allows it.T1526, T1580↳ also matches ListFunctions

ListCapacityProviders

Service: lambda

Description

Returns a list of capacity providers in your account.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "8fe94b42-6c01-4504-ae91-7b217a983cfd",
  "eventName": "ListCapacityProviders",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T18:32:23Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "e9b751f2-08cc-432f-8da5-5e535e5a9fac",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListCodeSigningConfigs

Service: lambda

Description

Returns a list of code signing configurations.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "547b56cb-ca2e-4083-8153-c3ac8ede70f7",
  "eventName": "ListCodeSigningConfigs",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T18:32:23Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "92b0d1eb-4dee-40d9-95e6-ca187ef98b75",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListDurableExecutionsByFunction

Service: lambda

Description

Returns a list of durable executions for a specified Lambda function.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "Function not found",
  "eventCategory": "Management",
  "eventID": "fe0ef80c-b25c-440d-a666-17a417bc75be",
  "eventName": "ListDurableExecutionsByFunction",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T18:45:05Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "3141ff19-a4d9-452e-8268-7957aff59325",
  "requestParameters": {
    "functionName": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListEventSourceMappings

Service: lambda

Description

Lists event source mappings.

CloudTrail logs this operation under the eventName ListEventSourceMappings20150331; the catalog keys on the SDK operation name ListEventSourceMappings. A detection rule may use either name.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "c9d0b785-68d1-419f-9023-849f80891774",
  "eventName": "ListEventSourceMappings20150331",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T18:32:23Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "1bcb3bee-b0be-4924-b86f-198e77328fd0",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListFunctionEventInvokeConfigs

Service: lambda

Description

Retrieves a list of configurations for asynchronous invocation for a function.

Example CloudTrail Event #

{
  "awsRegion": "us-west-2",
  "eventID": "313136b-863b-47ee-9fa1-8e5fccfb635b",
  "eventName": "ListFunctionEventInvokeConfigs",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2020-02-12T11:01:37Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "4df88ceb-f87f-4135-bd6d-96fec0d6e0f2",
  "requestParameters": {
    "functionName": "Level6"
  },
  "responseElements": {
    "functionEventInvokeConfigs": []
  },
  "sourceIPAddress": "239.3.72.215",
  "userAgent": "aws-cli/1.17.10 Python/3.8.1 Darwin/19.2.0 botocore/1.14.10",
  "userIdentity": {
    "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/Level6",
    "principalId": "AIDADO2GQD0K8TEF7KW1V",
    "type": "IAMUser",
    "userName": "Level6"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

ListFunctionsByCodeSigningConfig

Service: lambda

Description

List the functions that use the specified code signing configuration.

ListFunctionUrlConfigs

Service: lambda

Description

Returns a list of Lambda function URLs for the specified function.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "Function does not exist",
  "eventCategory": "Management",
  "eventID": "531090e2-865b-42ac-9dce-b7f9633deab2",
  "eventName": "ListFunctionUrlConfigs",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T18:45:05Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "001073ac-1dd3-4109-b91f-d10525843084",
  "requestParameters": {
    "functionName": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListFunctionVersionsByCapacityProvider

Service: lambda

Description

Returns a list of function versions that are configured to use a specific capacity provider.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "Capacity provider not found: ddddd. Check that the ARN is correct and the capacity provider exists in this Region.",
  "eventCategory": "Management",
  "eventID": "9bfc0a10-0bb8-4f78-87e0-76da45cf156a",
  "eventName": "ListFunctionVersionsByCapacityProvider",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T18:45:05Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "1361fbde-7b47-41ca-9d63-eff44f3d340c",
  "requestParameters": {
    "capacityProviderName": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListLayers

Service: lambda

Description

Lists Lambda layers and shows information about the latest version of each.

CloudTrail logs this operation under the eventName ListLayers20181031; the catalog keys on the SDK operation name ListLayers. A detection rule may use either name.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "1fe22835-6617-47e6-96bd-cccd8879ecfd",
  "eventName": "ListLayers20181031",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T18:32:23Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "ad4cb62e-0df6-4bbc-ada5-723881667ec7",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListLayerVersions

Service: lambda

Description

Lists the versions of an Lambda layer.

CloudTrail logs this operation under the eventName ListLayerVersions20181031; the catalog keys on the SDK operation name ListLayerVersions. A detection rule may use either name.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "92881bc8-3a0b-4b5e-9275-cefaeeaf7fdc",
  "eventName": "ListLayerVersions20181031",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T18:45:05Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "b4a02918-4b62-4147-a28b-c4d7d9852907",
  "requestParameters": {
    "layerName": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListManagedMicrovmImages

Service: lambda

Description

Lists AWS managed MicroVM images available for use as base images.

ListManagedMicrovmImageVersions

Service: lambda

Description

Lists versions of a managed MicroVM image.

ListMicrovmImageBuilds

Service: lambda

Description

Lists builds for a MicroVM image version with optional filtering by architecture and chipset.

ListMicrovmImages

Service: lambda

Description

Lists MicroVM images in the account with optional name filtering.

ListMicrovmImageVersions

Service: lambda

Description

Lists versions of a MicroVM image.

ListMicrovms

Service: lambda

Description

Lists MicroVMs in the account with optional filtering by image and version.

ListNetworkConnectors

Service: lambda

Description

Returns a paginated list of network connectors in your account for the current Region.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "AccessDenied",
  "errorMessage": "An unknown error occurred",
  "eventCategory": "Management",
  "eventID": "75e4a78e-de41-4e02-9dd1-b654f51aabc6",
  "eventName": "ListNetworkConnectors",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T18:32:24Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "5794097a-6816-4037-a691-feef13de6a97",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListProvisionedConcurrencyConfigs

Service: lambda

Description

Retrieves a list of provisioned concurrency configurations for a function.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "Function not found: arn:aws:lambda:us-west-1:123456789012:function:ddddd",
  "eventCategory": "Management",
  "eventID": "d5784e77-59b9-432b-836a-e7bab004f499",
  "eventName": "ListProvisionedConcurrencyConfigs",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T18:45:05Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "e2576bf7-8c92-4123-953e-f3befa37d004",
  "requestParameters": {
    "functionName": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListVersionsByFunction

Service: lambda

Description

Returns a list of versions, with the version-specific configuration of each.

CloudTrail logs this operation under the eventName ListVersionsByFunction20150331; the catalog keys on the SDK operation name ListVersionsByFunction. A detection rule may use either name.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "Function not found: arn:aws:lambda:us-west-1:123456789012:function:ddddd",
  "eventCategory": "Management",
  "eventID": "602eecca-d61d-446e-887a-9c5a18f46b86",
  "eventName": "ListVersionsByFunction20150331",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T18:45:05Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "620cb532-45ce-4dbd-8938-273867e1bc9f",
  "requestParameters": {
    "functionName": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

PublishVersion

Service: lambda

Description

Creates a version from the current code and configuration of a function.

CloudTrail logs this operation under the eventName PublishVersion20150331; the catalog keys on the SDK operation name PublishVersion. A detection rule may use either name.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "aed03aeb-621b-4a9d-ab66-968c44ee83a4",
  "eventName": "PublishVersion20150331",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T19:08:22Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "df0333b2-d181-40a5-88df-cf9d4dc74600",
  "requestParameters": {
    "functionName": "dwfix-fn"
  },
  "responseElements": {
    "architectures": [
      "x86_64"
    ],
    "codeSha256": "P5VITRngl3L/kWmyVa6j5bLxE+yn+44ubt5qqYgt2JU=",
    "codeSize": 147,
    "description": "dw",
    "environment": {},
    "ephemeralStorage": {
      "size": 512
    },
    "functionArn": "arn:aws:lambda:us-west-1:123456789012:function:dwfix-fn:1",
    "functionName": "dwfix-fn",
    "handler": "index.handler",
    "lastModified": "2026-06-29T19:08:18.000+0000",
    "lastUpdateStatus": "Successful",
    "loggingConfig": {
      "logFormat": "Text",
      "logGroup": "/aws/lambda/dwfix-fn"
    },
    "memorySize": 128,
    "packageType": "Zip",
    "revisionId": "cebdfc12-b34b-412e-bc0d-ca5cb97cda5f",
    "role": "arn:aws:iam::123456789012:role/dwfix-lambda-role",
    "runtime": "python3.12",
    "runtimeVersionConfig": {
      "runtimeVersionArn": "arn:aws:lambda:us-west-1::runtime:0eb6fb00a97c1a17d2e3014b04c79bfc9bea4301466439e3458f985dc75cadcc"
    },
    "snapStart": {
      "applyOn": "None",
      "optimizationStatus": "Off"
    },
    "state": "Active",
    "timeout": 3,
    "tracingConfig": {
      "mode": "PassThrough"
    },
    "version": "1"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,Z,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

Lambda CRUD Actions source high: Unauthorized lambda Create, Read, Update, or Delete event occurred.T1525↳ also matches AddPermission, CreateFunction, UpdateFunctionConfiguration, CreateAlias, CreateEventSourceMapping, DeleteAlias, and 6 more

PutFunctionCodeSigningConfig

Service: lambda

Description

Update the code signing configuration for the function.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "913ba49c-db49-4904-add9-56ce996f0240",
  "eventName": "PutFunctionCodeSigningConfig",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T21:01:34Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "27c9f598-c5be-4d1a-92ff-b37ac3dbf86b",
  "requestParameters": {
    "codeSigningConfigArn": "arn:aws:lambda:us-west-1:123456789012:code-signing-config:csc-01f375fdb82a86aef",
    "functionName": "dwfix-lambda-sample-fn"
  },
  "responseElements": {
    "codeSigningConfigArn": "arn:aws:lambda:us-west-1:123456789012:code-signing-config:csc-01f375fdb82a86aef",
    "functionName": "dwfix-lambda-sample-fn"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b,n cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

PutFunctionConcurrency

Service: lambda

Description

Sets the maximum number of simultaneous executions for a function, and reserves capacity for that concurrency level.

CloudTrail logs this operation under the eventName PutFunctionConcurrency20171031; the catalog keys on the SDK operation name PutFunctionConcurrency. A detection rule may use either name.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "12fdb4cf-b681-4525-bf92-6c57f8d62ead",
  "eventName": "PutFunctionConcurrency20171031",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T19:08:16Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "90acde81-dfae-47b4-9891-1834d322a3c0",
  "requestParameters": {
    "functionName": "dwfix-fn",
    "reservedConcurrentExecutions": 0
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,Z,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

PutFunctionEventInvokeConfig

Service: lambda

Description

Configures options for asynchronous invocation on a function, version, or alias.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "684364a9-49f1-4dd7-b425-2dbbb50d84d6",
  "eventName": "PutFunctionEventInvokeConfig",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T19:08:17Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "cab66387-dd63-4a36-a765-c8e0feff7aac",
  "requestParameters": {
    "functionName": "dwfix-fn",
    "maximumRetryAttempts": 1
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,Z,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

PutFunctionRecursionConfig

Service: lambda

Description

Sets your function's recursive loop detection configuration.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "22f52c3c-d88c-46cc-a06a-50d02efb4185",
  "eventName": "PutFunctionRecursionConfig",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T21:01:23Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "258ea01b-8ce3-45ca-a864-dac0d6087d45",
  "requestParameters": {
    "functionName": "dwfix-lambda-sample-fn",
    "recursiveLoop": "Terminate"
  },
  "responseElements": {
    "recursiveLoop": "Terminate"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b,n cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

PutFunctionScalingConfig

Service: lambda

Description

Sets the scaling configuration for a Lambda Managed Instances function.

PutProvisionedConcurrencyConfig

Service: lambda

Description

Adds a provisioned concurrency configuration to a function's alias or version.

PutRuntimeManagementConfig

Service: lambda

Description

Sets the runtime management configuration for a function's version.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "8f802fbb-d8ab-4b5c-8c62-5992461adcbc",
  "eventName": "PutRuntimeManagementConfig",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T19:08:22Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "b6c3b967-00dd-414b-8561-dfe6360ae2b9",
  "requestParameters": {
    "functionName": "dwfix-fn",
    "updateRuntimeOn": "Auto"
  },
  "responseElements": {
    "functionArn": "arn:aws:lambda:us-west-1:123456789012:function:dwfix-fn",
    "updateRuntimeOn": "Auto"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,Z,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

RemoveEventSource

Service: lambda

Description

Removes an event source mapping.

RemoveLayerVersionPermission

Service: lambda

Description

Removes a statement from the permissions policy for a version of an Lambda layer.

CloudTrail logs this operation under the eventName RemoveLayerVersionPermission20181031; the catalog keys on the SDK operation name RemoveLayerVersionPermission. A detection rule may use either name.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "Layer version arn:aws:lambda:us-west-1:123456789012:layer:ddddd:1 does not exist.",
  "eventCategory": "Management",
  "eventID": "b2236a25-3603-4d68-97b7-a8abfc31c986",
  "eventName": "RemoveLayerVersionPermission20181031",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T19:24:41Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "a6ba04ed-2065-4dbd-9a89-a50e09ac0dcb",
  "requestParameters": {
    "layerName": "ddddd",
    "statementId": "ddddd",
    "versionNumber": 1
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

RemovePermission

Service: lambda

Description

Revokes function-use permission from an Amazon Web Services service or another Amazon Web Services account.

CloudTrail management event, logged by default.

CloudTrail logs this operation under the eventName RemovePermission20150331v2; the catalog keys on the SDK operation name RemovePermission. A detection rule may use either name.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "Root",
    "principalId": "123456789012",
    "arn": "arn:aws:iam::123456789012:root",
    "accountId": "123456789012",
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE"
  },
  "eventTime": "2026-07-28T19:59:21Z",
  "eventSource": "lambda.amazonaws.com",
  "eventName": "RemovePermission20150331v2",
  "awsRegion": "us-west-1",
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "aws-cli/2.34.28 md/awscrt#0.31.2 ua/2.1 os/linux#6.1.0-51-amd64 md/arch#x86_64 lang/python#3.14.3 md/pyimpl#CPython m/Z,E,n,b cfg/retry-mode#standard md/installer#exe md/distrib#debian.12 md/prompt#off md/command#lambda.remove-permission",
  "requestParameters": {
    "functionName": "dw-harn-lambda-bf42d1",
    "statementId": "dw-harn-bf42d1"
  },
  "responseElements": null,
  "requestID": "4705f5f0-0336-41b8-90ed-a90f593fcdce",
  "eventID": "2171ea43-7df0-4a81-8061-ef29381a6934",
  "readOnly": false,
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "123456789012",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

Lambda CRUD Actions source high: Unauthorized lambda Create, Read, Update, or Delete event occurred.T1525↳ also matches AddPermission, CreateFunction, UpdateFunctionConfiguration, CreateAlias, CreateEventSourceMapping, DeleteAlias, and 6 more

ResumeMicrovm

Service: lambda

Description

Resumes a suspended MicroVM, restoring it to RUNNING state with all state intact.

RunMicrovm

Service: lambda

Description

Runs a new MicroVM from the specified image.

SendDurableExecutionCallbackFailure

Service: lambda

Description

Sends a failure response for a callback operation in a durable execution.

SendDurableExecutionCallbackHeartbeat

Service: lambda

Description

Sends a heartbeat signal for a long-running callback operation to prevent timeout.

SendDurableExecutionCallbackSuccess

Service: lambda

Description

Sends a successful completion response for a callback operation in a durable execution.

StopDurableExecution

Service: lambda

Description

Stops a running durable execution.

SuspendMicrovm

Service: lambda

Description

Suspends a running MicroVM, preserving its full memory and disk state.

TagResource

Service: lambda

Description

Adds tags to a function, event source mapping, or code signing configuration.

TerminateMicrovm

Service: lambda

Description

Terminates a MicroVM.

UntagResource

Service: lambda

Description

Removes tags from a function, event source mapping, or code signing configuration.

UpdateAlias

Service: lambda

Description

Updates the configuration of a Lambda function alias.

CloudTrail logs this operation under the eventName UpdateAlias20150331; the catalog keys on the SDK operation name UpdateAlias. A detection rule may use either name.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "Function not found: arn:aws:lambda:us-west-1:123456789012:function:ddddd",
  "eventCategory": "Management",
  "eventID": "3b609c31-e760-4f26-a88e-93fd102c7473",
  "eventName": "UpdateAlias20150331",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T19:24:41Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "805885fb-d0d9-4910-ad55-c501d6053324",
  "requestParameters": {
    "functionName": "ddddd",
    "name": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

Lambda CRUD Actions source high: Unauthorized lambda Create, Read, Update, or Delete event occurred.T1525↳ also matches AddPermission, CreateFunction, UpdateFunctionConfiguration, CreateAlias, CreateEventSourceMapping, DeleteAlias, and 6 more

UpdateCapacityProvider

Service: lambda

Description

Updates the configuration of an existing capacity provider.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "Capacity provider not found: arn:aws:lambda:us-west-1:123456789012:capacity-provider:ddddd. Check that the ARN is correct and the capacity provider exists in this Region.",
  "eventCategory": "Management",
  "eventID": "244d15e5-b6a8-4654-ba6c-e402dd768904",
  "eventName": "UpdateCapacityProvider",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T19:24:41Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "840624a0-37ae-4288-9a9a-c2b4db69d4ac",
  "requestParameters": {
    "capacityProviderName": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateCodeSigningConfig

Service: lambda

Description

Update the code signing configuration.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "d6e823b7-1320-4863-9aa7-513278204dd8",
  "eventName": "UpdateCodeSigningConfig",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T21:01:11Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "70167b5d-0f32-464f-ad07-6037afc3a242",
  "requestParameters": {
    "codeSigningConfigArn": "arn:aws:lambda:us-west-1:123456789012:code-signing-config:csc-01f375fdb82a86aef",
    "codeSigningPolicies": {
      "untrustedArtifactOnDeployment": "Enforce"
    },
    "description": "dwfix sample CSC updated"
  },
  "resources": [
    {
      "ARN": "arn:aws:lambda:us-west-1:123456789012:code-signing-config:csc-01f375fdb82a86aef",
      "accountId": "123456789012",
      "type": "code-signing-config"
    }
  ],
  "responseElements": {
    "CodeSigningConfig": {
      "AllowedPublishers": {
        "SigningProfileVersionArns": [
          "arn:aws:signer:us-west-1:123456789012:/signing-profiles/dwfix-profile/abcdef12"
        ]
      },
      "CodeSigningConfigArn": "arn:aws:lambda:us-west-1:123456789012:code-signing-config:csc-01f375fdb82a86aef",
      "CodeSigningConfigId": "csc-01f375fdb82a86aef",
      "CodeSigningPolicies": {
        "UntrustedArtifactOnDeployment": "Enforce"
      },
      "Description": "dwfix sample CSC updated",
      "LastModified": "2026-06-29T21:01:11.908845156Z"
    }
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b,n cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateEventSourceMapping

Service: lambda

Description

Updates an event source mapping.

CloudTrail logs this operation under the eventName UpdateEventSourceMapping20150331; the catalog keys on the SDK operation name UpdateEventSourceMapping. A detection rule may use either name.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "The resource you requested does not exist.",
  "eventCategory": "Management",
  "eventID": "e9d7a28b-83e4-476f-94c0-237d4f33d418",
  "eventName": "UpdateEventSourceMapping20150331",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T19:24:41Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "35610337-af8f-4ff0-adbf-ff2532962677",
  "requestParameters": {
    "uUID": "dddddddddddddddddddddddddddddddddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

Lambda CRUD Actions source high: Unauthorized lambda Create, Read, Update, or Delete event occurred.T1525↳ also matches AddPermission, CreateFunction, UpdateFunctionConfiguration, CreateAlias, CreateEventSourceMapping, DeleteAlias, and 6 more

UpdateFunctionCode

Service: lambda

Description

Updates a Lambda function's code.

CloudTrail management event, logged by default.

CloudTrail logs this operation under the eventName UpdateFunctionCode20150331v2; the catalog keys on the SDK operation name UpdateFunctionCode. A detection rule may use either name.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "Root",
    "principalId": "123456789012",
    "arn": "arn:aws:iam::123456789012:root",
    "accountId": "123456789012",
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE"
  },
  "eventTime": "2026-07-28T19:59:25Z",
  "eventSource": "lambda.amazonaws.com",
  "eventName": "UpdateFunctionCode20150331v2",
  "awsRegion": "us-west-1",
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "aws-cli/2.34.28 md/awscrt#0.31.2 ua/2.1 os/linux#6.1.0-51-amd64 md/arch#x86_64 lang/python#3.14.3 md/pyimpl#CPython m/Z,E,n,b cfg/retry-mode#standard md/installer#exe md/distrib#debian.12 md/prompt#off md/command#lambda.update-function-code",
  "requestParameters": {
    "functionName": "dw-harn-lambda-bf42d1",
    "publish": false,
    "dryRun": false
  },
  "responseElements": {
    "functionName": "dw-harn-lambda-bf42d1",
    "functionArn": "arn:aws:lambda:us-west-1:123456789012:function:dw-harn-lambda-bf42d1",
    "runtime": "python3.13",
    "role": "arn:aws:iam::123456789012:role/dw-harn-lambda-role-bf42d1",
    "handler": "lambda_function.handler",
    "codeSize": 202,
    "description": "dw harness bf42d1",
    "timeout": 3,
    "memorySize": 128,
    "lastModified": "2026-07-28T19:59:25.000+0000",
    "codeSha256": "2eOd/xYdNc+GohI5MpM68i1ZgaS0PtsNs72nW6zw/Eg=",
    "version": "$LATEST",
    "environment": {},
    "tracingConfig": {
      "mode": "PassThrough"
    },
    "revisionId": "5689de4d-90f3-499a-afd7-8dd08d6b11f0",
    "state": "Active",
    "lastUpdateStatus": "InProgress",
    "lastUpdateStatusReason": "The function is being created.",
    "lastUpdateStatusReasonCode": "Creating",
    "packageType": "Zip",
    "architectures": [
      "x86_64"
    ],
    "ephemeralStorage": {
      "size": 512
    },
    "snapStart": {
      "applyOn": "None",
      "optimizationStatus": "Off"
    },
    "runtimeVersionConfig": {
      "runtimeVersionArn": "arn:aws:lambda:us-west-1::runtime:c45043813da1baebf5ac04edcaef1a67db184ee08f1fd2b4ce1642305ee9845c"
    },
    "loggingConfig": {
      "logFormat": "Text",
      "logGroup": "/aws/lambda/dw-harn-lambda-bf42d1"
    }
  },
  "requestID": "a1483ddc-11c1-4c4d-b84d-0e95d94127f1",
  "eventID": "edc63f63-51a5-4ccf-af0a-ad2f9d227246",
  "readOnly": false,
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "123456789012",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com"
  }
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`user_type` (splunk rule field)	eq	`iamuser`	1 rule	splunk

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Splunk #

AWS Lambda UpdateFunctionCode source: The following analytic identifies IAM users attempting to update or modify AWS Lambda code via the AWS CLI. It leverages CloudTrail logs to detect successful UpdateFunctionCode events initiated by IAM users. This activity is significant…T1204

YARA-L #

AWS Lambda Update Function Code source low: Detects an IAM user attempting to update/modify AWS lambda code.T1648

Panther #

Lambda CRUD Actions source high: Unauthorized lambda Create, Read, Update, or Delete event occurred.T1525↳ also matches AddPermission, CreateFunction, UpdateFunctionConfiguration, CreateAlias, CreateEventSourceMapping, DeleteAlias, and 6 more

UpdateFunctionEventInvokeConfig

Service: lambda

Description

Updates the configuration for asynchronous invocation for a function, version, or alias.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "InvalidParameterValueException",
  "errorMessage": "You must specify at least one of error handling or destination setting.",
  "eventCategory": "Management",
  "eventID": "cb06037a-ae44-4617-8459-bd5d426f2d4c",
  "eventName": "UpdateFunctionEventInvokeConfig",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T19:24:41Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "b4abbea5-b9ae-419b-ae17-9a91921ce85b",
  "requestParameters": {
    "functionName": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateFunctionUrlConfig

Service: lambda

Description

Updates the configuration for a Lambda function URL.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "Function does not exist",
  "eventCategory": "Management",
  "eventID": "c1c91df6-4150-4528-86c2-71708d176641",
  "eventName": "UpdateFunctionUrlConfig",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T19:24:41Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "c7a64836-58f9-49fd-b7a8-a02396c95770",
  "requestParameters": {
    "functionName": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateMicrovmImage

Service: lambda

Description

Updates the configuration of a MicroVM image and triggers a new version build.

UpdateMicrovmImageVersion

Service: lambda

Description

Updates the status of a specific MicroVM image version.

UpdateNetworkConnector

Service: lambda

Description

Updates the VPC configuration or operator role of an existing network connector.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "AccessDenied",
  "errorMessage": "Unable to determine service/operation name to be authorized",
  "eventCategory": "Management",
  "eventID": "2e4ca71a-8344-4537-9a8b-6c801d7de242",
  "eventName": "UpdateNetworkConnector",
  "eventSource": "lambda.amazonaws.com",
  "eventTime": "2026-06-29T19:24:41Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "573b9b4d-4780-400f-81db-73418dfbd26c",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "lambda.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UploadFunction

Service: lambda

Description

Creates a new Lambda function or updates an existing function.

DisableReplication20170630

Service: lambda

Description

DisableReplication20170630 recorded by CloudTrail for AWS Lambda. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.

Example CloudTrail Event #

This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.

{
  "eventVersion": "1.11",
  "eventID": "68844e8d-e55e-490a-be2c-0447dcf653f6",
  "eventSource": "lambda.amazonaws.com",
  "eventName": "DisableReplication20170630",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "readOnly": false,
  "managementEvent": true,
  "requestID": "6ceb6c52-a93e-46b6-ac33-dccc35b73ae6",
  "userAgent": "replicator.lambda.amazonaws.com",
  "resources": [
    {
      "accountId": "123456789012",
      "type": "function",
      "ARN": "arn:aws:lambda:us-east-1:123456789012:function:EXAMPLE"
    }
  ]
}

EnableReplication20170630v2

Service: lambda

Description

EnableReplication20170630v2 recorded by CloudTrail for AWS Lambda. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "2d9d3266-ba86-4200-adc0-d029e8287a52",
  "eventSource": "lambda.amazonaws.com",
  "eventName": "EnableReplication20170630v2",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "readOnly": false,
  "managementEvent": true,
  "requestID": "c769c636-10a2-4392-b8aa-1c48c6d2d25d",
  "userAgent": "cloudfront.amazonaws.com"
}

AWS Lambda

any: AWS Lambda (catch-all)

Description

Common Indicators #

Detection Rules #

Sigma #

Elastic #

Panther #

AddPermission

Description

Example CloudTrail Event #

Related events #

Detection Rules #

Panther #

CreateFunction

Description

Example CloudTrail Event #

Related events #

Detection Rules #

Panther #

CreateFunctionUrlConfig

Description

Example CloudTrail Event #

Detection Rules #

Sigma #

Invoke

Description

Example CloudTrail Event #

ListFunctions

Description

Example CloudTrail Event #

Related events #

Detection Rules #

Elastic #

References #

PublishLayerVersion

Description

Example CloudTrail Event #

UpdateFunctionConfiguration

Description

Example CloudTrail Event #

Common Indicators #

Related events #

Detection Rules #

Panther #

AddEventSource

Description

AddLayerVersionPermission

Description

Example CloudTrail Event #

CheckpointDurableExecution

Description

CreateAlias

Description

Example CloudTrail Event #

Related events #

Detection Rules #

Panther #

CreateCapacityProvider

Description

CreateCodeSigningConfig

Description

Example CloudTrail Event #

CreateEventSourceMapping

Description

Example CloudTrail Event #

Related events #

Detection Rules #

Panther #

CreateMicrovmAuthToken

Description

CreateMicrovmImage

Description

CreateMicrovmShellAuthToken

Description

CreateNetworkConnector

Description

DeleteAlias

Description

Example CloudTrail Event #