AWS memorydb

eventName	Description	Sample	Rule
DescribeACLs	DescribeACLs recorded by CloudTrail for AWS memorydb. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.	N	N
DescribeEngineVersions	DescribeEngineVersions recorded by CloudTrail for AWS memorydb. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.	N	N
DescribeMultiRegionClusters	DescribeMultiRegionClusters recorded by CloudTrail for AWS memorydb. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.	N	N
DescribeParameterGroups	DescribeParameterGroups recorded by CloudTrail for AWS memorydb. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.	N	N
DescribeReservedNodesOfferings	DescribeReservedNodesOfferings recorded by CloudTrail for AWS memorydb. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.	N	N
DescribeServiceUpdates	DescribeServiceUpdates recorded by CloudTrail for AWS memorydb. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.	N	N
DescribeSubnetGroups	DescribeSubnetGroups recorded by CloudTrail for AWS memorydb. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.	N	N

DescribeACLs

Service: memorydb

Description

DescribeACLs recorded by CloudTrail for AWS memorydb. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.

Example CloudTrail Event #

This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.

{
  "eventVersion": "1.11",
  "eventID": "7b3af8bd-7883-4c1d-9500-930fdb1a7067",
  "eventSource": "memorydb.amazonaws.com",
  "eventName": "DescribeACLs",
  "awsRegion": "eu-north-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "5fd320c2-0736-4f61-9727-df1e72758abd",
  "userAgent": "resource-explorer-2.amazonaws.com"
}

References #

Humpty from IRCC

DescribeEngineVersions

#

Service: memorydb

Description

DescribeEngineVersions recorded by CloudTrail for AWS memorydb. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.

Example CloudTrail Event #

This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.

{
  "eventVersion": "1.11",
  "eventID": "0fa20f0d-f094-44ac-a02a-bb2dc2ed73e6",
  "eventSource": "memorydb.amazonaws.com",
  "eventName": "DescribeEngineVersions",
  "awsRegion": "sa-east-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "afb9ecef-99e4-4e3b-a151-350be2de08e5",
  "userAgent": "Botocore/1.35.95 ua/2.0 os/linux#5.10.245-245.983.amzn2.x86_64 md/arch#x86_64 lang/python#3.9.23 md/pyimpl#CPython cfg/retry-mode#standard",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "example.sa-east-1.amazonaws.com",
    "keyExchange": "secp256r1"
  }
}

References #

Humpty from IRCC

DescribeMultiRegionClusters

#

Service: memorydb

Description

DescribeMultiRegionClusters recorded by CloudTrail for AWS memorydb. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.

Example CloudTrail Event #

This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.

{
  "eventVersion": "1.11",
  "eventID": "13f040e1-1ad0-43d4-8be7-0c9d37773e3a",
  "eventSource": "memorydb.amazonaws.com",
  "eventName": "DescribeMultiRegionClusters",
  "awsRegion": "eu-west-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "904adea4-4d87-4035-bbda-ea29211113b8",
  "userAgent": "Botocore/1.35.95 ua/2.0 os/linux#5.10.245-245.983.amzn2.x86_64 md/arch#x86_64 lang/python#3.9.23 md/pyimpl#CPython cfg/retry-mode#standard",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "example.eu-west-1.amazonaws.com",
    "keyExchange": "secp256r1"
  }
}

References #

Humpty from IRCC

DescribeParameterGroups

#

Service: memorydb

Description

DescribeParameterGroups recorded by CloudTrail for AWS memorydb. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.

Example CloudTrail Event #

This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.

{
  "eventVersion": "1.11",
  "eventID": "78a5a2e3-07f3-4a8b-9f26-dd44b2fa4530",
  "eventSource": "memorydb.amazonaws.com",
  "eventName": "DescribeParameterGroups",
  "awsRegion": "us-east-2",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "2ae7af41-6f25-4530-9a97-9a5b054604f1",
  "userAgent": "resource-explorer-2.amazonaws.com"
}

References #

Humpty from IRCC

DescribeReservedNodesOfferings

#

Service: memorydb

Description

DescribeReservedNodesOfferings recorded by CloudTrail for AWS memorydb. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.

Example CloudTrail Event #

This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.

{
  "eventVersion": "1.11",
  "eventID": "793f59bd-a84b-4e20-a7be-557a8aa23f3f",
  "eventSource": "memorydb.amazonaws.com",
  "eventName": "DescribeReservedNodesOfferings",
  "awsRegion": "eu-west-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "2a7f20ed-cee0-4daf-946b-1c37d4af6e23",
  "userAgent": "Botocore/1.35.95 ua/2.0 os/linux#5.10.245-245.983.amzn2.x86_64 md/arch#x86_64 lang/python#3.9.23 md/pyimpl#CPython cfg/retry-mode#standard",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "example.eu-west-1.amazonaws.com",
    "keyExchange": "secp256r1"
  }
}

References #

Humpty from IRCC

DescribeServiceUpdates

#

Service: memorydb

Description

DescribeServiceUpdates recorded by CloudTrail for AWS memorydb. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.

Example CloudTrail Event #

This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.

{
  "eventVersion": "1.11",
  "eventID": "bd72e606-5e72-419f-820c-dddf55863668",
  "eventSource": "memorydb.amazonaws.com",
  "eventName": "DescribeServiceUpdates",
  "awsRegion": "ap-southeast-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "5e929266-64c8-48a3-ab35-59aec0c118c3",
  "userAgent": "aws-sdk-go-v2/1.43.0 ua/2.1 os/linux lang/go#1.26.5 md/GOOS#linux md/GOARCH#arm64 api/memorydb#1.19.4",
  "errorCode": "AccessDenied",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "example.ap-southeast-1.amazonaws.com"
  }
}

References #

Humpty from IRCC

DescribeSubnetGroups

#

Service: memorydb

Description

DescribeSubnetGroups recorded by CloudTrail for AWS memorydb. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.

Example CloudTrail Event #

This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.

{
  "eventVersion": "1.11",
  "eventID": "78cff300-c4ee-49eb-b821-f7cdfefff763",
  "eventSource": "memorydb.amazonaws.com",
  "eventName": "DescribeSubnetGroups",
  "awsRegion": "eu-west-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "d986ae10-aa84-4fce-92a8-ab883987e459",
  "userAgent": "config.amazonaws.com"
}

References #

Humpty from IRCC

any: AWS memorydb (catch-all)

#

Scope grouping: This repository-authored catalog entry represents a broad attribution scope, not a distinct emitted event or operation. Any sample below is a representative record from that scope; attached rules, if any, are listed separately.

Service: memorydb

Description

Catch-all entry for AWS memorydb rules that match the service but not a specific eventName.