AWS Resource Groups
| eventName | Description | Sample | Rule |
|---|---|---|---|
| any | Catch-all entry for AWS Resource Groups rules that match the service but not a specific eventName. | N | N |
| Cancel | Cancels the specified tag-sync task. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet. | N | N |
| Create | Creates a resource group with the specified name and description. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet. | N | N |
| Delete | Deletes the specified resource group. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet. | N | N |
| Get | Retrieves the current status of optional features in Resource Groups. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record. | N | N |
| Get | Returns information about a specified resource group. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet. | N | N |
| Get | Retrieves the service configuration associated with the specified resource group. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record. | N | N |
| Get | Retrieves the resource query associated with the specified resource group. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record. | N | N |
| Get | Returns a list of tags that are associated with a resource group, specified by an Amazon resource name (ARN). Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record. | N | N |
| Get | Returns information about a specified tag-sync task. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet. | N | N |
| Group | Adds the specified resources to the specified group. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record. | N | N |
| List | Returns the status of the last grouping or ungrouping action for each resource in the specified application group. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet. | N | N |
| List | Returns a list of Amazon resource names (ARNs) of the resources that are members of a specified resource group. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record. | N | N |
| List | Returns a list of existing Resource Groups in your account. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record. | N | N |
| List | Returns a list of tag-sync tasks. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet. | N | N |
| Put | Attaches a service configuration to the specified group. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet. | N | N |
| Search | Returns a list of Amazon Web Services resource identifiers that matches the specified query. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet. | N | N |
| Start | Creates a new tag-sync task to onboard and sync resources tagged with a specific tag key-value pair to an application. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet. | N | N |
| Tag | Adds tags to a resource group with the specified Amazon resource name (ARN). Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet. | N | N |
| Ungroup | Removes the specified resources from the specified group. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet. | N | N |
| Untag | Deletes tags from a specified resource group. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet. | N | N |
| Update | Turns on or turns off optional features in Resource Groups. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet. | N | N |
| Update | Updates the description for an existing group. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet. | N | N |
| Update | Updates the resource query of a group. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet. | N | N |
any: AWS Resource Groups (catch-all)
#Description
Catch-all entry for AWS Resource Groups rules that match the service but not a specific eventName.
CreateGroup
#Description
Creates a resource group with the specified name and description. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.
DeleteGroup
#Description
Deletes the specified resource group. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.
GetAccountSettings
#Description
Retrieves the current status of optional features in Resource Groups. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record.
Example CloudTrail Event #
This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.
{
"eventVersion": "1.11",
"eventID": "c767111c-8eeb-4379-af93-33aca5b4c9fa",
"eventSource": "resource-groups.amazonaws.com",
"eventName": "GetAccountSettings",
"awsRegion": "eu-west-1",
"eventType": "AwsApiCall",
"readOnly": true,
"managementEvent": true,
"requestID": "18a0d6bd-c4a5-4b1a-bcdd-c246da6b0d02",
"userAgent": "aws-sdk-go-v2/1.43.0 ua/2.1 os/linux lang/go#1.26.5 md/GOOS#linux md/GOARCH#arm64 api/resourcegroups#1.29.3 m/E,i"
}
GetGroup
#Description
Returns information about a specified resource group. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.
GetGroupConfiguration
#Description
Retrieves the service configuration associated with the specified resource group. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record.
Example CloudTrail Event #
This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.
{
"eventVersion": "1.11",
"eventID": "d588d096-1e67-482f-947d-a907565dc207",
"eventSource": "resource-groups.amazonaws.com",
"eventName": "GetGroupConfiguration",
"awsRegion": "ap-southeast-2",
"eventType": "AwsApiCall",
"readOnly": true,
"managementEvent": true,
"requestID": "dd3c74d8-ba14-42fb-9153-e833b6a90a70",
"userAgent": "aws-sdk-go-v2/1.43.0 ua/2.1 os/linux lang/go#1.26.5 md/GOOS#linux md/GOARCH#arm64 api/resourcegroups#1.29.3 m/E,i",
"errorCode": "BadRequestException",
"resources": [
{
"accountId": "123456789012",
"type": "AWS::ResourceGroups::Group",
"ARN": "arn:aws:resource-groups:ap-southeast-2:123456789012:group/EXAMPLE"
}
]
}
GetGroupQuery
#Description
Retrieves the resource query associated with the specified resource group. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record.
Example CloudTrail Event #
This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.
{
"eventVersion": "1.09",
"eventID": "0b09b136-4c8e-4be6-ba11-11f38c9bab43",
"eventSource": "resource-groups.amazonaws.com",
"eventName": "GetGroupQuery",
"awsRegion": "us-east-2",
"eventType": "AwsApiCall",
"readOnly": true,
"managementEvent": true,
"requestID": "d234fc00-f583-4b88-88d4-97c02dcccff2",
"userAgent": "aws-sdk-go-v2/1.43.0 ua/2.1 os/linux lang/go#1.26.5 md/GOOS#linux md/GOARCH#arm64 api/resourcegroups#1.29.3 m/E,i",
"resources": [
{
"accountId": "123456789012",
"type": "AWS::ResourceGroups::Group",
"ARN": "arn:aws:resource-groups:us-east-2:123456789012:group/EXAMPLE"
}
]
}
GroupResources
#Description
Adds the specified resources to the specified group. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record.
Example CloudTrail Event #
This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.
{
"eventVersion": "1.09",
"eventID": "1f9a2a13-0062-4e47-9978-957e2483d786",
"eventSource": "resource-groups.amazonaws.com",
"eventName": "GroupResources",
"awsRegion": "us-east-2",
"eventType": "AwsApiCall",
"readOnly": false,
"managementEvent": true,
"requestID": "baeca522-dca3-46cb-9dbd-d6a69d1ceeb5",
"userAgent": "resource-groups.amazonaws.com",
"errorCode": "NotFoundException"
}
ListGroupingStatuses
#Description
Returns the status of the last grouping or ungrouping action for each resource in the specified application group. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.
ListGroupResources
#Description
Returns a list of Amazon resource names (ARNs) of the resources that are members of a specified resource group. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record.
Example CloudTrail Event #
This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.
{
"eventVersion": "1.11",
"eventID": "d48a5650-ce2b-4ff9-8847-5a613631682a",
"eventSource": "resource-groups.amazonaws.com",
"eventName": "ListGroupResources",
"awsRegion": "ap-southeast-2",
"eventType": "AwsApiCall",
"readOnly": true,
"managementEvent": true,
"requestID": "07e6f13e-8c28-431b-a074-a1cec99fffe9",
"userAgent": "aws-sdk-go-v2/1.43.0 ua/2.1 os/linux lang/go#1.26.5 md/GOOS#linux md/GOARCH#arm64 api/resourcegroups#1.29.3 m/C,E,i",
"resources": [
{
"accountId": "123456789012",
"type": "AWS::ResourceGroups::Group",
"ARN": "arn:aws:resource-groups:ap-southeast-2:123456789012:group/EXAMPLE"
}
]
}
ListGroups
#Description
Returns a list of existing Resource Groups in your account. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record.
Example CloudTrail Event #
This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.
{
"eventVersion": "1.11",
"eventID": "7ca1d0dc-5006-4e81-b3c4-2243db9b1c8f",
"eventSource": "resource-groups.amazonaws.com",
"eventName": "ListGroups",
"awsRegion": "sa-east-1",
"eventType": "AwsApiCall",
"readOnly": true,
"managementEvent": true,
"requestID": "fb11da78-dbe7-4bc8-b828-766a2214e031",
"userAgent": "ssm.amazonaws.com"
}
PutGroupConfiguration
#Description
Attaches a service configuration to the specified group. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.
SearchResources
#Description
Returns a list of Amazon Web Services resource identifiers that matches the specified query. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.
Tag
#Description
Adds tags to a resource group with the specified Amazon resource name (ARN). Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.
UngroupResources
#Description
Removes the specified resources from the specified group. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.
Untag
#Description
Deletes tags from a specified resource group. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.
UpdateAccountSettings
#Description
Turns on or turns off optional features in Resource Groups. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.
UpdateGroup
#Description
Updates the description for an existing group. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.
UpdateGroupQuery
#Description
Updates the resource query of a group. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.