Route 53 Resolver

eventName	Description	Sample	Rule
any	Catch-all entry for Route 53 Resolver rules that match the service but not a specific eventName.	N	N
DeleteResolverQueryLogConfig	Deletes a Route 53 Resolver query logging configuration, stopping DNS query log delivery for associated VPCs.	Y	Y
AssociateFirewallRuleGroup	Associates a FirewallRuleGroup with a VPC, to provide DNS filtering for the VPC.	N	N
AssociateResolverEndpointIpAddress	Adds IP addresses to an inbound or an outbound Resolver endpoint.	N	N
AssociateResolverQueryLogConfig	Associates an Amazon VPC with a specified query logging configuration.	N	N
AssociateResolverRule	Associates a Resolver rule with a VPC.	N	N
BatchCreateFirewallRule	Creates multiple DNS Firewall rules in the specified rule group.	Y	N
BatchDeleteFirewallRule	Deletes multiple DNS Firewall rules from the specified rule group.	Y	N
BatchUpdateFirewallRule	Updates multiple DNS Firewall rules in the specified rule group.	Y	N
CreateFirewallDomainList	Creates an empty firewall domain list for use in DNS Firewall rules.	Y	N
CreateFirewallRule	Creates a single DNS Firewall rule in the specified rule group.	Y	N
CreateFirewallRuleGroup	Creates an empty DNS Firewall rule group for filtering DNS network traffic in a VPC.	Y	N
CreateOutpostResolver	Creates a Route 53 Resolver on an Outpost.	N	N
CreateResolverEndpoint	Creates a Resolver endpoint.	N	N
CreateResolverQueryLogConfig	Creates a Resolver query logging configuration, which defines where you want Resolver to save DNS query logs that originate in your VPCs.	N	N
CreateResolverRule	For DNS queries that originate in your VPCs, specifies which Resolver endpoint the queries pass through, one domain name that you want to forward to your network, and the IP addresses of the DNS resolvers in your network.	Y	N
DeleteFirewallDomainList	Deletes the specified domain list.	Y	N
DeleteFirewallRule	Deletes the specified firewall rule.	Y	N
DeleteFirewallRuleGroup	Deletes the specified firewall rule group.	Y	N
DeleteOutpostResolver	Deletes a Resolver on the Outpost.	Y	N
DeleteResolverEndpoint	Deletes a Resolver endpoint.	Y	N
DeleteResolverRule	Deletes a Resolver rule.	Y	N
DisassociateFirewallRuleGroup	Disassociates a FirewallRuleGroup from a VPC, to remove DNS filtering from the VPC.	Y	N
DisassociateResolverEndpointIpAddress	Removes IP addresses from an inbound or an outbound Resolver endpoint.	Y	N
DisassociateResolverQueryLogConfig	Disassociates a VPC from a query logging configuration.	Y	N
DisassociateResolverRule	Removes the association between a specified Resolver rule and a specified VPC.	Y	N
GetFirewallConfig	Retrieves the configuration of the firewall behavior provided by DNS Firewall for a single VPC from Amazon Virtual Private Cloud (Amazon VPC).	Y	N
GetFirewallDomainList	Retrieves the specified firewall domain list.	Y	N
GetFirewallRuleGroup	Retrieves the specified firewall rule group.	Y	N
GetFirewallRuleGroupAssociation	Retrieves a firewall rule group association, which enables DNS filtering for a VPC with one rule group.	Y	N
GetFirewallRuleGroupPolicy	Returns the Identity and Access Management (Amazon Web Services IAM) policy for sharing the specified rule group.	Y	N
GetOutpostResolver	Gets information about a specified Resolver on the Outpost, such as its instance count and type, name, and the current status of the Resolver.	Y	N
GetResolverConfig	Retrieves the behavior configuration of Route 53 Resolver behavior for a single VPC from Amazon Virtual Private Cloud.	Y	N
GetResolverDnssecConfig	Gets DNSSEC validation information for a specified resource.	Y	N
GetResolverEndpoint	Gets information about a specified Resolver endpoint, such as whether it's an inbound or an outbound Resolver endpoint, and the current status of the endpoint.	Y	N
GetResolverQueryLogConfig	Gets information about a specified Resolver query logging configuration, such as the number of VPCs that the configuration is logging queries for and the location that logs are sent to.	Y	N
GetResolverQueryLogConfigAssociation	Gets information about a specified association between a Resolver query logging configuration and an Amazon VPC.	Y	N
GetResolverQueryLogConfigPolicy	Gets information about a query logging policy.	Y	N
GetResolverRule	Gets information about a specified Resolver rule, such as the domain name that the rule forwards DNS queries for and the ID of the outbound Resolver endpoint that the rule is associated with.	Y	N
GetResolverRuleAssociation	Gets information about an association between a specified Resolver rule and a VPC.	Y	N
GetResolverRulePolicy	Gets information about the Resolver rule policy for a specified rule.	Y	N
ImportFirewallDomains	Imports domain names from a file into a domain list, for use in a DNS firewall rule group.	N	N
ListFirewallConfigs	Retrieves the firewall configurations that you have defined.	Y	N
ListFirewallDomainLists	Retrieves the firewall domain lists that you have defined.	Y	N
ListFirewallDomains	Retrieves the domains that you have defined for the specified firewall domain list.	Y	N
ListFirewallRuleGroupAssociations	Retrieves the firewall rule group associations that you have defined.	Y	N
ListFirewallRuleGroups	Retrieves the minimal high-level information for the rule groups that you have defined.	Y	N
ListFirewallRules	Retrieves the firewall rules that you have defined for the specified firewall rule group.	Y	N
ListFirewallRuleTypes	Retrieves the rule-type variants that can be used in the FirewallRuleType field of CreateFirewallRule and UpdateFirewallRule.	Y	N
ListOutpostResolvers	Lists all the Resolvers on Outposts that were created using the current Amazon Web Services account.	Y	N
ListResolverConfigs	Retrieves the Resolver configurations that you have defined.	Y	N
ListResolverDnssecConfigs	Lists the configurations for DNSSEC validation that are associated with the current Amazon Web Services account.	Y	N
ListResolverEndpointIpAddresses	Gets the IP addresses for a specified Resolver endpoint.	Y	N
ListResolverEndpoints	Lists all the Resolver endpoints that were created using the current Amazon Web Services account.	Y	N
ListResolverQueryLogConfigAssociations	Lists information about associations between Amazon VPCs and query logging configurations.	Y	N
ListResolverQueryLogConfigs	Lists information about the specified query logging configurations.	Y	N
ListResolverRuleAssociations	Lists the associations that were created between Resolver rules and VPCs using the current Amazon Web Services account.	Y	N
ListResolverRules	Lists the Resolver rules that were created using the current Amazon Web Services account.	Y	N
ListTagsForResource	Lists the tags that you associated with the specified resource.	Y	N
PutFirewallRuleGroupPolicy	Attaches an Identity and Access Management (Amazon Web Services IAM) policy for sharing the rule group.	Y	N
PutResolverQueryLogConfigPolicy	Specifies an Amazon Web Services account that you want to share a query logging configuration with, the query logging configuration that you want to share, and the operations that you want the account to be able to perform on the configurat.	N	N
PutResolverRulePolicy	Specifies an Amazon Web Services rule that you want to share with another account, the account that you want to share the rule with, and the operations that you want the account to be able to perform on the rule.	Y	N
TagResource	Adds one or more tags to a specified resource.	Y	N
UntagResource	Removes one or more tags from a specified resource.	Y	N
UpdateFirewallConfig	Updates the configuration of the firewall behavior provided by DNS Firewall for a single VPC from Amazon Virtual Private Cloud (Amazon VPC).	Y	N
UpdateFirewallDomains	Updates the firewall domain list from an array of domain specifications.	Y	N
UpdateFirewallRule	Updates the specified firewall rule.	Y	N
UpdateFirewallRuleGroupAssociation	Changes the association of a FirewallRuleGroup with a VPC.	Y	N
UpdateOutpostResolver	You can use UpdateOutpostResolver to update the instance count, type, or name of a Resolver on an Outpost.	Y	N
UpdateResolverConfig	Updates the behavior configuration of Route 53 Resolver behavior for a single VPC from Amazon Virtual Private Cloud.	Y	N
UpdateResolverDnssecConfig	Updates an existing DNSSEC validation configuration.	Y	N
UpdateResolverEndpoint	Updates the name, or endpoint type for an inbound or an outbound Resolver endpoint.	Y	N
UpdateResolverRule	Updates settings for a specified Resolver rule.	Y	N

any: Route 53 Resolver (catch-all)

Service: route53resolver

Description

Catch-all entry for Route 53 Resolver rules that match the service but not a specific eventName.

DeleteResolverQueryLogConfig

Service: route53resolver

Description

Deletes a Route 53 Resolver query logging configuration, stopping DNS query log delivery for associated VPCs.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "[RSLVR-01601] The specified query logging configuration doesn't exist. Trace Id: \"1-6a42c6ea-0600e23b49a6beb23073e07b\"",
  "eventCategory": "Management",
  "eventID": "a0fcba4e-8639-4c9f-8a6d-d1a089ad9a53",
  "eventName": "DeleteResolverQueryLogConfig",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T19:26:34Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "7064656b-fea5-4f78-82fe-f39a9c91e097",
  "requestParameters": {
    "originSequenceNumber": 0,
    "resolverQueryLogConfigId": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Route 53 Resolver Query Log Configuration Deleted source medium: Identifies the deletion of an Amazon Route 53 Resolver Query Log Configuration. Resolver query logs provide critical visibility into DNS activity across VPCs, including lookups made by EC2 instances, containers, Lambda functions, and other AWS resources. Deleting a query log configuration immediately stops DNS query and response logging for the associated VPC. Adversaries may delete these configurations to evade detection, suppress forensic evidence, or degrade security monitoring capabilities.T1562, T1562.008

Panther #

AWS DNS Logs Deleted source informational: Detects when logs for a DNS Resolver have been removed.T1562.008

AssociateFirewallRuleGroup

Service: route53resolver

Description

Associates a FirewallRuleGroup with a VPC, to provide DNS filtering for the VPC.

AssociateResolverEndpointIpAddress

Service: route53resolver

Description

Adds IP addresses to an inbound or an outbound Resolver endpoint.

AssociateResolverQueryLogConfig

Service: route53resolver

Description

Associates an Amazon VPC with a specified query logging configuration.

AssociateResolverRule

Service: route53resolver

Description

Associates a Resolver rule with a VPC.

BatchCreateFirewallRule

Service: route53resolver

Description

Creates multiple DNS Firewall rules in the specified rule group.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "019e3eac-6154-4689-a131-73221f734dfa",
  "eventName": "BatchCreateFirewallRule",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T21:00:49Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "20ee0f8c-97c4-4e05-ad92-0d7eb59e7da0",
  "requestParameters": {
    "createFirewallRuleEntries": [
      {
        "action": "BLOCK",
        "blockResponse": "NXDOMAIN",
        "creatorRequestId": "dwfix-brule2-b0ce40ee",
        "firewallDomainListId": "rslvr-fdl-8fee939a532b4536",
        "firewallRuleGroupId": "rslvr-frg-81dc088dd0314635",
        "name": "dwfix-brule2-b0ce40ee",
        "priority": 200
      }
    ]
  },
  "responseElements": {
    "createdFirewallRules": [
      {
        "action": "BLOCK",
        "blockResponse": "NXDOMAIN",
        "creationTime": "2026-06-29T21:00:49.198833780Z",
        "creatorRequestId": "dwfix-brule2-b0ce40ee",
        "firewallDomainListId": "rslvr-fdl-8fee939a532b4536",
        "firewallDomainRedirectionAction": "INSPECT_REDIRECTION_DOMAIN",
        "firewallRuleGroupId": "rslvr-frg-81dc088dd0314635",
        "modificationTime": "2026-06-29T21:00:49.198833780Z",
        "name": "dwfix-brule2-b0ce40ee",
        "priority": 200
      }
    ]
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,n,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

BatchDeleteFirewallRule

Service: route53resolver

Description

Deletes multiple DNS Firewall rules from the specified rule group.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "e86d84e2-ebba-42ef-a31f-fd51acd41664",
  "eventName": "BatchDeleteFirewallRule",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T21:00:49Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "bfe01f3a-ffdb-488a-a080-bed0a254238d",
  "requestParameters": {
    "deleteFirewallRuleEntries": [
      {
        "firewallDomainListId": "rslvr-fdl-8fee939a532b4536",
        "firewallRuleGroupId": "rslvr-frg-81dc088dd0314635"
      }
    ]
  },
  "responseElements": {
    "deletedFirewallRules": [
      {
        "action": "BLOCK",
        "blockResponse": "NXDOMAIN",
        "creationTime": "2026-06-29T21:00:49.198833780Z",
        "creatorRequestId": "dwfix-brule2-b0ce40ee",
        "firewallDomainListId": "rslvr-fdl-8fee939a532b4536",
        "firewallDomainRedirectionAction": "INSPECT_REDIRECTION_DOMAIN",
        "firewallRuleGroupId": "rslvr-frg-81dc088dd0314635",
        "modificationTime": "2026-06-29T21:00:49.288371759Z",
        "name": "dwfix-brule2-upd-b0ce40ee",
        "priority": 210
      }
    ]
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,n,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

BatchUpdateFirewallRule

Service: route53resolver

Description

Updates multiple DNS Firewall rules in the specified rule group.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "3d025d43-9ac1-4219-97ad-412900162e57",
  "eventName": "BatchUpdateFirewallRule",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T21:00:49Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "1bb6a2ae-da67-44d3-bcd8-3c42d8e724e6",
  "requestParameters": {
    "updateFirewallRuleEntries": [
      {
        "action": "BLOCK",
        "blockResponse": "NXDOMAIN",
        "firewallDomainListId": "rslvr-fdl-8fee939a532b4536",
        "firewallRuleGroupId": "rslvr-frg-81dc088dd0314635",
        "name": "dwfix-brule2-upd-b0ce40ee",
        "priority": 210
      }
    ]
  },
  "responseElements": {
    "updatedFirewallRules": [
      {
        "action": "BLOCK",
        "blockResponse": "NXDOMAIN",
        "creationTime": "2026-06-29T21:00:49.198833780Z",
        "creatorRequestId": "dwfix-brule2-b0ce40ee",
        "firewallDomainListId": "rslvr-fdl-8fee939a532b4536",
        "firewallDomainRedirectionAction": "INSPECT_REDIRECTION_DOMAIN",
        "firewallRuleGroupId": "rslvr-frg-81dc088dd0314635",
        "modificationTime": "2026-06-29T21:00:49.288371759Z",
        "name": "dwfix-brule2-upd-b0ce40ee",
        "priority": 210
      }
    ]
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,n,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreateFirewallDomainList

Service: route53resolver

Description

Creates an empty firewall domain list for use in DNS Firewall rules.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "9019220d-f10a-4f23-bf5d-1c98fedaeeaa",
  "eventName": "CreateFirewallDomainList",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T21:00:48Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "7528a680-f18e-4a2c-b79a-93b940f80e97",
  "requestParameters": {
    "creatorRequestId": "dwfix-dl1-b0ce40ee",
    "name": "dwfix-domlist1-b0ce40ee",
    "tags": [
      {
        "key": "dwfix",
        "value": "sample"
      }
    ]
  },
  "responseElements": {
    "firewallDomainList": {
      "arn": "arn:aws:route53resolver:us-west-1:123456789012:firewall-domain-list/rslvr-fdl-79add0c098164bec",
      "creationTime": "2026-06-29T21:00:48.773287006Z",
      "creatorRequestId": "dwfix-dl1-b0ce40ee",
      "domainCount": 0,
      "id": "rslvr-fdl-79add0c098164bec",
      "modificationTime": "2026-06-29T21:00:48.773287006Z",
      "name": "dwfix-domlist1-b0ce40ee",
      "status": "COMPLETE",
      "statusMessage": "Created Firewall Domain List"
    }
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,n,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreateFirewallRule

Service: route53resolver

Description

Creates a single DNS Firewall rule in the specified rule group.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "27119214-474f-40c2-ba01-ab3d9a41070c",
  "eventName": "CreateFirewallRule",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T21:00:49Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "09a2e6c9-bb63-4857-9e43-1676033373b3",
  "requestParameters": {
    "action": "ALERT",
    "creatorRequestId": "dwfix-rule1-b0ce40ee",
    "firewallDomainListId": "rslvr-fdl-79add0c098164bec",
    "firewallRuleGroupId": "rslvr-frg-81dc088dd0314635",
    "name": "dwfix-rule1-b0ce40ee",
    "priority": 100
  },
  "responseElements": {
    "firewallRule": {
      "action": "ALERT",
      "creationTime": "2026-06-29T21:00:49.134377392Z",
      "creatorRequestId": "dwfix-rule1-b0ce40ee",
      "firewallDomainListId": "rslvr-fdl-79add0c098164bec",
      "firewallDomainRedirectionAction": "INSPECT_REDIRECTION_DOMAIN",
      "firewallRuleGroupId": "rslvr-frg-81dc088dd0314635",
      "modificationTime": "2026-06-29T21:00:49.134377392Z",
      "name": "dwfix-rule1-b0ce40ee",
      "priority": 100
    }
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,n,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreateFirewallRuleGroup

Service: route53resolver

Description

Creates an empty DNS Firewall rule group for filtering DNS network traffic in a VPC.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "da8960b9-389d-4a0d-bee1-ddf18974f7d3",
  "eventName": "CreateFirewallRuleGroup",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T21:00:49Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "c4ebf5d5-7265-410b-a541-c8723c1a4d91",
  "requestParameters": {
    "creatorRequestId": "dwfix-rg-b0ce40ee",
    "name": "dwfix-rulegroup-b0ce40ee",
    "tags": [
      {
        "key": "dwfix",
        "value": "sample"
      }
    ]
  },
  "responseElements": {
    "firewallRuleGroup": {
      "arn": "arn:aws:route53resolver:us-west-1:123456789012:firewall-rule-group/rslvr-frg-81dc088dd0314635",
      "creationTime": "2026-06-29T21:00:48.975031337Z",
      "creatorRequestId": "dwfix-rg-b0ce40ee",
      "id": "rslvr-frg-81dc088dd0314635",
      "modificationTime": "2026-06-29T21:00:48.975031337Z",
      "name": "dwfix-rulegroup-b0ce40ee",
      "ownerId": "123456789012",
      "ruleCount": 0,
      "shareStatus": "NOT_SHARED",
      "status": "COMPLETE",
      "statusMessage": "Created Firewall Rule Group"
    }
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,n,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreateOutpostResolver

Service: route53resolver

Description

Creates a Route 53 Resolver on an Outpost.

CreateResolverEndpoint

Service: route53resolver

Description

Creates a Resolver endpoint.

CreateResolverQueryLogConfig

Service: route53resolver

Description

Creates a Resolver query logging configuration, which defines where you want Resolver to save DNS query logs that originate in your VPCs.

CreateResolverRule

Service: route53resolver

Description

For DNS queries that originate in your VPCs, specifies which Resolver endpoint the queries pass through, one domain name that you want to forward to your network, and the IP addresses of the DNS resolvers in your network.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "506f62b1-0003-4751-b95f-51eda43d613d",
  "eventName": "CreateResolverRule",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T21:00:49Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "643764d1-9ed3-4220-8e73-888df3736fee",
  "requestParameters": {
    "creatorRequestId": "dwfix-rr-b0ce40ee",
    "domainName": "dwfix-test.example.com.",
    "name": "dwfix-resolverrule-b0ce40ee",
    "ruleType": "SYSTEM"
  },
  "responseElements": {
    "resolverRule": {
      "arn": "arn:aws:route53resolver:us-west-1:123456789012:resolver-rule/rslvr-rr-129d1a22688545a09",
      "creationTime": "2026-06-29T21:00:49.483668272Z",
      "creatorRequestId": "dwfix-rr-b0ce40ee",
      "domainName": "dwfix-test.example.com.",
      "id": "rslvr-rr-129d1a22688545a09",
      "modificationTime": "2026-06-29T21:00:49.483668272Z",
      "name": "dwfix-resolverrule-b0ce40ee",
      "ownerId": "123456789012",
      "ruleType": "SYSTEM",
      "shareStatus": "NOT_SHARED",
      "status": "COMPLETE",
      "statusMessage": "[Trace id: 1-6a42dd01-0213d9b62781a4c30018dcb0] Successfully created Resolver Rule."
    }
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,n,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteFirewallDomainList

Service: route53resolver

Description

Deletes the specified domain list.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "[RSLVR-02025] Can’t find the resource with ID \"ddddd\". Trace Id: \"1-6a42c6ea-05908bf83e6923070c484dc4\"",
  "eventCategory": "Management",
  "eventID": "92b4827c-1bbd-4de6-8ac7-48b60e9fc954",
  "eventName": "DeleteFirewallDomainList",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T19:26:34Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "cca74cae-a4d2-46d2-8002-38321d5d1b27",
  "requestParameters": {
    "firewallDomainListId": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteFirewallRule

Service: route53resolver

Description

Deletes the specified firewall rule.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "[RSLVR-02049] Missing parameter to identify the rule within the firewall rule group Trace Id: \"1-6a42c6ea-301d7b21793a9a48350ee331\"",
  "eventCategory": "Management",
  "eventID": "191d50b4-9f79-4e55-98af-22823b119d1e",
  "eventName": "DeleteFirewallRule",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T19:26:34Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "ee876e41-4e69-4411-bef0-d21f2a4ce2d6",
  "requestParameters": {
    "firewallRuleGroupId": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteFirewallRuleGroup

Service: route53resolver

Description

Deletes the specified firewall rule group.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "[RSLVR-02025] Can’t find the resource with ID \"ddddd\". Trace Id: \"1-6a42c6ea-00178e7971aa547d5d59fad8\"",
  "eventCategory": "Management",
  "eventID": "a76ac096-9d87-42fd-a0e6-d252f1bcf1c2",
  "eventName": "DeleteFirewallRuleGroup",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T19:26:34Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "3c0ef2a8-88b3-4e57-a277-c44038d7c698",
  "requestParameters": {
    "firewallRuleGroupId": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteOutpostResolver

Service: route53resolver

Description

Deletes a Resolver on the Outpost.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "0c8ca208-58bd-4bfc-bbfc-1c40c26f9f93",
  "eventName": "DeleteOutpostResolver",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T19:26:34Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "421303b3-831e-45d0-a09a-7b488148888c",
  "requestParameters": {
    "id": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteResolverEndpoint

Service: route53resolver

Description

Deletes a Resolver endpoint.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "[RSLVR-00501] Resolver endpoint with ID \"ddddd\" does not exist.",
  "eventCategory": "Management",
  "eventID": "396a522c-9602-4fd1-8105-cef6b6031b01",
  "eventName": "DeleteResolverEndpoint",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T19:26:34Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "ded4f2ca-853b-4b8f-b009-8f2f8e700c21",
  "requestParameters": {
    "resolverEndpointId": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteResolverRule

Service: route53resolver

Description

Deletes a Resolver rule.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "[RSLVR-00703] Resolver rule with ID \"ddddd\" does not exist.",
  "eventCategory": "Management",
  "eventID": "684c555a-deb2-4908-8697-f2a4affdc46e",
  "eventName": "DeleteResolverRule",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T19:26:34Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "db23163d-7b7e-48ed-be75-ec48431a7d3f",
  "requestParameters": {
    "resolverRuleId": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DisassociateFirewallRuleGroup

Service: route53resolver

Description

Disassociates a FirewallRuleGroup from a VPC, to remove DNS filtering from the VPC.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "[RSLVR-02025] Can’t find the resource with ID \"ddddd\". Trace Id: \"1-6a42c6ea-723c0f312088d7220ae4c1aa\"",
  "eventCategory": "Management",
  "eventID": "4fca3b13-8762-4722-855b-8bbbd0cddf19",
  "eventName": "DisassociateFirewallRuleGroup",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T19:26:34Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "71464bdc-42b8-4cbc-b4d5-be6f375609b2",
  "requestParameters": {
    "firewallRuleGroupAssociationId": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DisassociateResolverEndpointIpAddress

Service: route53resolver

Description

Removes IP addresses from an inbound or an outbound Resolver endpoint.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "[RSLVR-00501] Resolver endpoint with ID \"ddddd\" does not exist.",
  "eventCategory": "Management",
  "eventID": "26c030a8-bf1c-4856-b430-f85c9c56ca9f",
  "eventName": "DisassociateResolverEndpointIpAddress",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T19:26:34Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "039cff47-0c95-431f-a4b5-4c0ec363c3fb",
  "requestParameters": {
    "ipAddress": {},
    "resolverEndpointId": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DisassociateResolverQueryLogConfig

Service: route53resolver

Description

Disassociates a VPC from a query logging configuration.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "InvalidParameterException",
  "errorMessage": "[RSLVR-01007] The ID of the resource is invalid. Trace Id: \"1-6a42c6ea-37af4b29542b0973088b5ace\"",
  "eventCategory": "Management",
  "eventID": "2fd63fef-fec2-4143-940a-6c5711a06936",
  "eventName": "DisassociateResolverQueryLogConfig",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T19:26:34Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "d8ec70a1-8572-4b34-8339-a2a14c534b6d",
  "requestParameters": {
    "originSequenceNumber": 0,
    "resolverQueryLogConfigId": "ddddd",
    "resourceId": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DisassociateResolverRule

Service: route53resolver

Description

Removes the association between a specified Resolver rule and a specified VPC.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "[RSLVR-00800] Resolver Rule Association between Resolver Rule \"ddddd\" and VPC \"ddddd\" does not exist.",
  "eventCategory": "Management",
  "eventID": "b92334b6-cd4a-4ef4-ae6d-2af5cc5cf7ae",
  "eventName": "DisassociateResolverRule",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T19:26:34Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "6f82f1f5-721a-4931-86d8-564bd1fcafcd",
  "requestParameters": {
    "resolverRuleId": "ddddd",
    "vPCId": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetFirewallConfig

Service: route53resolver

Description

Retrieves the configuration of the firewall behavior provided by DNS Firewall for a single VPC from Amazon Virtual Private Cloud (Amazon VPC).

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "[RSLVR-00916] The ID of the resource is invalid. Trace Id: \"1-6a42bd6d-0cce64d623ab4c464e96c365\"",
  "eventCategory": "Management",
  "eventID": "8484c7b0-805a-4a9a-b477-dfa08bcc6e0c",
  "eventName": "GetFirewallConfig",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T18:46:05Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "3e455558-c12a-4143-9fee-c89cae8b53f1",
  "requestParameters": {
    "resourceId": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetFirewallDomainList

Service: route53resolver

Description

Retrieves the specified firewall domain list.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "[RSLVR-02025] Can’t find the resource with ID \"ddddd\". Trace Id: \"1-6a42bd6d-544d0b1b0b64c5e2701c064f\"",
  "eventCategory": "Management",
  "eventID": "1eb73715-8d31-4c6a-bcd1-f1b49358b547",
  "eventName": "GetFirewallDomainList",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T18:46:05Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "ff2f9f93-1db0-4618-ab38-0453ba5351a3",
  "requestParameters": {
    "firewallDomainListId": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetFirewallRuleGroup

Service: route53resolver

Description

Retrieves the specified firewall rule group.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "[RSLVR-02025] Can’t find the resource with ID \"ddddd\". Trace Id: \"1-6a42bd6d-3833300c4f13376225955603\"",
  "eventCategory": "Management",
  "eventID": "a5c70c0a-1e8a-4ce2-b22e-3498b4c16bdd",
  "eventName": "GetFirewallRuleGroup",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T18:46:05Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "2febbfa8-14b3-4d2d-b91a-e7f649af6c5a",
  "requestParameters": {
    "firewallRuleGroupId": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetFirewallRuleGroupAssociation

Service: route53resolver

Description

Retrieves a firewall rule group association, which enables DNS filtering for a VPC with one rule group.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "[RSLVR-02025] Can’t find the resource with ID \"ddddd\". Trace Id: \"1-6a42bd6d-32878aba5c77815b5f8e16c3\"",
  "eventCategory": "Management",
  "eventID": "02620b84-159b-425a-9c7f-00e8e8a5d775",
  "eventName": "GetFirewallRuleGroupAssociation",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T18:46:06Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "03b50268-ef9e-4f6f-a571-2736ef85abe0",
  "requestParameters": {
    "firewallRuleGroupAssociationId": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetFirewallRuleGroupPolicy

Service: route53resolver

Description

Returns the Identity and Access Management (Amazon Web Services IAM) policy for sharing the specified rule group.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "[RSLVR-02034] The ARN in your request isn’t valid:\"arn:aws:iam::123456789012:role/dw-probe\". Provide a valid ARN. Trace Id: \"1-6a42bd6e-31bac8b52f8ff17850d8dce0\"",
  "eventCategory": "Management",
  "eventID": "10def44f-f04b-4420-a590-5c672349e0cc",
  "eventName": "GetFirewallRuleGroupPolicy",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T18:46:06Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "4ffac6dc-99aa-4b89-930c-5cb0eef4f296",
  "requestParameters": {
    "arn": "arn:aws:iam::123456789012:role/dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetOutpostResolver

Service: route53resolver

Description

Gets information about a specified Resolver on the Outpost, such as its instance count and type, name, and the current status of the Resolver.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "625642fb-36bf-4258-b310-36bb368db0f7",
  "eventName": "GetOutpostResolver",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T18:46:06Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "2fe27418-206b-4571-8e50-4daf43a07903",
  "requestParameters": {
    "id": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetResolverConfig

Service: route53resolver

Description

Retrieves the behavior configuration of Route 53 Resolver behavior for a single VPC from Amazon Virtual Private Cloud.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "[RSLVR-00916] The ID of the resource is invalid.",
  "eventCategory": "Management",
  "eventID": "be0e24b5-98c0-44e7-8f16-636f14f8dca3",
  "eventName": "GetResolverConfig",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T18:46:06Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "c9696ab1-1407-4c1b-af77-ae3ace73a178",
  "requestParameters": {
    "resourceId": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetResolverDnssecConfig

Service: route53resolver

Description

Gets DNSSEC validation information for a specified resource.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "InvalidParameterException",
  "errorMessage": "The ID of the resource is invalid. Trace Id: \"1-6a42bd6e-47e70e042f3a1c7a4502f9f6\"",
  "eventCategory": "Management",
  "eventID": "e6d4119e-c8bf-4170-a4a9-72b2b3cd10e8",
  "eventName": "GetResolverDnssecConfig",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T18:46:06Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "e0188afa-fb06-4925-9b1f-962fa849f8d6",
  "requestParameters": {
    "resourceId": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetResolverEndpoint

Service: route53resolver

Description

Gets information about a specified Resolver endpoint, such as whether it's an inbound or an outbound Resolver endpoint, and the current status of the endpoint.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "[RSLVR-00501] Resolver endpoint with ID \"ddddd\" does not exist.",
  "eventCategory": "Management",
  "eventID": "a97b98eb-ea89-4052-8bf2-edee33718e5f",
  "eventName": "GetResolverEndpoint",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T18:46:06Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "b21c0b50-586a-4555-a558-fc17b6a0cebd",
  "requestParameters": {
    "resolverEndpointId": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetResolverQueryLogConfig

Service: route53resolver

Description

Gets information about a specified Resolver query logging configuration, such as the number of VPCs that the configuration is logging queries for and the location that logs are sent to.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "[RSLVR-01601] The specified query logging configuration doesn't exist. Trace Id: \"1-6a42bd6e-2292f3fd4ddeebf012b4edfc\"",
  "eventCategory": "Management",
  "eventID": "6f164efd-b8eb-4d86-b53b-8982a4237a58",
  "eventName": "GetResolverQueryLogConfig",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T18:46:06Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "3d56c911-30ee-4139-b22c-d33161f1e564",
  "requestParameters": {
    "resolverQueryLogConfigId": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetResolverQueryLogConfigAssociation

Service: route53resolver

Description

Gets information about a specified association between a Resolver query logging configuration and an Amazon VPC.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "[RSLVR-01602] The specified query logging configuration association doesn't exist. Trace Id: \"1-6a42bd6e-7a6e4eb105d460ed542cadfb\"",
  "eventCategory": "Management",
  "eventID": "d086a65d-fb44-4f6c-8199-b5f979c90d03",
  "eventName": "GetResolverQueryLogConfigAssociation",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T18:46:06Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "dec0147c-7159-4161-868f-5d066c929848",
  "requestParameters": {
    "resolverQueryLogConfigAssociationId": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetResolverQueryLogConfigPolicy

Service: route53resolver

Description

Gets information about a query logging policy.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "InvalidParameterException",
  "errorMessage": "[RSLVR-01010] The specified Amazon Resource Name (ARN) is invalid. Trace Id: \"1-6a42bd6e-5fb7bb320a4b64ae11d1b15c\"",
  "eventCategory": "Management",
  "eventID": "b5a952c4-079d-4d77-b258-4839db9cac09",
  "eventName": "GetResolverQueryLogConfigPolicy",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T18:46:06Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "1b682b88-50c1-4c18-9e30-00ba4093dd31",
  "requestParameters": {
    "arn": "arn:aws:iam::123456789012:role/dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetResolverRule

Service: route53resolver

Description

Gets information about a specified Resolver rule, such as the domain name that the rule forwards DNS queries for and the ID of the outbound Resolver endpoint that the rule is associated with.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "[RSLVR-00703] Resolver rule with ID \"ddddd\" does not exist.",
  "eventCategory": "Management",
  "eventID": "0e75648f-ae33-4a5b-9c31-b67e70da7af4",
  "eventName": "GetResolverRule",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T18:46:06Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "ca2fa8fa-ca23-4890-9184-c87398ed56aa",
  "requestParameters": {
    "resolverRuleId": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetResolverRuleAssociation

Service: route53resolver

Description

Gets information about an association between a specified Resolver rule and a VPC.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "ResolverRuleAssociation \"ddddd\" does not Exist.",
  "eventCategory": "Management",
  "eventID": "acc114d9-b29f-4846-9cde-06ab276980b4",
  "eventName": "GetResolverRuleAssociation",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T18:46:06Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "274d4d46-1e59-42e4-95a8-d12bcf126dde",
  "requestParameters": {
    "resolverRuleAssociationId": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetResolverRulePolicy

Service: route53resolver

Description

Gets information about the Resolver rule policy for a specified rule.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::123456789012:user/sample-user is not authorized to perform: route53resolver:GetResolverRulePolicy on resource: arn:aws:iam::123456789012:role/dw-probe",
  "eventCategory": "Management",
  "eventID": "a8a146cd-497d-49fa-b126-96c7720d4d6d",
  "eventName": "GetResolverRulePolicy",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T18:46:06Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "97a4c29f-013d-47a3-b9bb-1d9a3ffafbc3",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ImportFirewallDomains

Service: route53resolver

Description

Imports domain names from a file into a domain list, for use in a DNS firewall rule group.

ListFirewallConfigs

Service: route53resolver

Description

Retrieves the firewall configurations that you have defined.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "5347eb83-a150-44f7-b74a-a2ccf3622f98",
  "eventName": "ListFirewallConfigs",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T18:32:36Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "e7c848da-0c25-4ccd-90ec-e435ff55fa7d",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListFirewallDomainLists

Service: route53resolver

Description

Retrieves the firewall domain lists that you have defined.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "c7e7aeab-f49f-4754-9bd5-fe83670fa5df",
  "eventName": "ListFirewallDomainLists",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T18:32:36Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "91914ace-65c0-403a-8e50-32264665f257",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListFirewallDomains

Service: route53resolver

Description

Retrieves the domains that you have defined for the specified firewall domain list.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "[RSLVR-02025] Can’t find the resource with ID \"ddddd\". Trace Id: \"1-6a42bd6e-69d341205c495cca7a812ef3\"",
  "eventCategory": "Management",
  "eventID": "516ed27a-3fe3-40f6-8abf-3aae2812c87a",
  "eventName": "ListFirewallDomains",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T18:46:06Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "546bc371-205e-4013-8782-4d83c6a88b68",
  "requestParameters": {
    "firewallDomainListId": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListFirewallRuleGroupAssociations

Service: route53resolver

Description

Retrieves the firewall rule group associations that you have defined.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "755801a0-a480-4038-a196-69232e924b83",
  "eventName": "ListFirewallRuleGroupAssociations",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2023-07-10T12:13:32Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123837392027",
  "requestID": "c9797465-28d3-4ec3-9980-1e499dc14add",
  "requestParameters": {
    "maxResults": 100,
    "vpcId": "vpc-098ff30ff74b36f73"
  },
  "responseElements": null,
  "sessionCredentialFromConsole": "true",
  "sourceIPAddress": "10.8.8.10",
  "userAgent": "AWS Internal",
  "userIdentity": {
    "accessKeyId": "ASIATFQR7NSCSUD2OWV6",
    "accountId": "123837392027",
    "arn": "arn:aws:iam::123837392027:user/bert-jan",
    "principalId": "AIDATFQR7NSC5AU2ZV3IE",
    "sessionContext": {
      "attributes": {
        "creationDate": "2023-07-10T12:13:16Z",
        "mfaAuthenticated": "true"
      },
      "sessionIssuer": {},
      "webIdFederationData": {}
    },
    "type": "IAMUser",
    "userName": "bert-jan"
  }
}

References #

Sample log: invictus-ir/aws_dataset

ListFirewallRuleGroups

Service: route53resolver

Description

Retrieves the minimal high-level information for the rule groups that you have defined.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "0a33cb39-4f55-4194-af91-6810ea16063e",
  "eventName": "ListFirewallRuleGroups",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T18:32:36Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "37e15bc5-7a09-4cbf-80ff-27417f5630b6",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListFirewallRules

Service: route53resolver

Description

Retrieves the firewall rules that you have defined for the specified firewall rule group.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "[RSLVR-02025] Can’t find the resource with ID \"ddddd\". Trace Id: \"1-6a42bd6e-3f4c68c853894d1b73839401\"",
  "eventCategory": "Management",
  "eventID": "8e4de134-0361-43ef-837e-6ee09da321c3",
  "eventName": "ListFirewallRules",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T18:46:06Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "b31fa28e-f434-4d80-99a7-b9480a3b58a8",
  "requestParameters": {
    "firewallRuleGroupId": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListFirewallRuleTypes

Service: route53resolver

Description

Retrieves the rule-type variants that can be used in the FirewallRuleType field of CreateFirewallRule and UpdateFirewallRule.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "f2b9d753-82e5-40b1-9a01-3603e8152c24",
  "eventName": "ListFirewallRuleTypes",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T18:32:36Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "bd9242db-34f3-441d-8dd1-5e2ae86d320d",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListOutpostResolvers

Service: route53resolver

Description

Lists all the Resolvers on Outposts that were created using the current Amazon Web Services account.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "9aa17397-3e59-4c24-afd1-4bd63200366b",
  "eventName": "ListOutpostResolvers",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T18:32:36Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "79d957ed-84e6-49bb-aa5b-c3626ad80640",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListResolverConfigs

Service: route53resolver

Description

Retrieves the Resolver configurations that you have defined.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "84d9a41f-4e8c-4298-b5e1-11f92fe56580",
  "eventName": "ListResolverConfigs",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T18:32:36Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "64d056ef-4516-48d9-aa04-ddd36dc75b26",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListResolverDnssecConfigs

Service: route53resolver

Description

Lists the configurations for DNSSEC validation that are associated with the current Amazon Web Services account.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "d2aa3ca5-f7cd-4250-a174-50b97d90086d",
  "eventName": "ListResolverDnssecConfigs",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T18:32:36Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "672d2a88-6191-452e-9b4c-62d44fd0fb61",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListResolverEndpointIpAddresses

Service: route53resolver

Description

Gets the IP addresses for a specified Resolver endpoint.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "[RSLVR-00501] Resolver endpoint with ID \"ddddd\" does not exist.",
  "eventCategory": "Management",
  "eventID": "dc78039c-fbb5-49c2-96f1-27419a2d91a1",
  "eventName": "ListResolverEndpointIpAddresses",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T18:46:06Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "4aab2ea9-8a0d-49f8-8e02-390759eae636",
  "requestParameters": {
    "resolverEndpointId": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListResolverEndpoints

Service: route53resolver

Description

Lists all the Resolver endpoints that were created using the current Amazon Web Services account.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "eventID": "872dc91b-2f80-4816-89dc-5b57bfe9814a",
  "eventName": "ListResolverEndpoints",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2019-07-25T09:41:04Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "5c8e6008-b969-42de-9e19-d435488e6c6f",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "248.251.245.4",
  "userAgent": "Boto3/1.9.39 Python/2.7.16 Linux/4.19.0-kali5-amd64 Botocore/1.12.86",
  "userIdentity": {
    "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/Level6",
    "principalId": "AIDADO2GQD0K8TEF7KW1V",
    "type": "IAMUser",
    "userName": "Level6"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

ListResolverQueryLogConfigAssociations

Service: route53resolver

Description

Lists information about associations between Amazon VPCs and query logging configurations.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "17712aea-1c2a-4fad-9dd7-c659a2829ff3",
  "eventName": "ListResolverQueryLogConfigAssociations",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T18:32:36Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "9b2a930e-d461-4324-8a5f-f137784c96d6",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListResolverQueryLogConfigs

Service: route53resolver

Description

Lists information about the specified query logging configurations.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "05e22b3a-c834-47cb-bf08-0e802e7e9ce6",
  "eventName": "ListResolverQueryLogConfigs",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T18:32:36Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "5831c828-5fa7-4a4e-af30-477f3b486178",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListResolverRuleAssociations

Service: route53resolver

Description

Lists the associations that were created between Resolver rules and VPCs using the current Amazon Web Services account.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "eventID": "078c8994-9e16-4fa1-8e9a-51060b014694",
  "eventName": "ListResolverRuleAssociations",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2019-07-25T09:41:08Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "b12c0752-ef5c-407e-9117-62cf0068b892",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "248.251.245.4",
  "userAgent": "Boto3/1.9.39 Python/2.7.16 Linux/4.19.0-kali5-amd64 Botocore/1.12.86",
  "userIdentity": {
    "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/Level6",
    "principalId": "AIDADO2GQD0K8TEF7KW1V",
    "type": "IAMUser",
    "userName": "Level6"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

ListResolverRules

Service: route53resolver

Description

Lists the Resolver rules that were created using the current Amazon Web Services account.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "eventID": "1efec865-87c2-4298-8c50-49dd94297fc",
  "eventName": "ListResolverRules",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2019-07-25T09:41:04Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "26334b95-848f-4a0b-a59e-12dc20abc5b5",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "248.251.245.4",
  "userAgent": "Boto3/1.9.39 Python/2.7.16 Linux/4.19.0-kali5-amd64 Botocore/1.12.86",
  "userIdentity": {
    "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/Level6",
    "principalId": "AIDADO2GQD0K8TEF7KW1V",
    "type": "IAMUser",
    "userName": "Level6"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

ListTagsForResource

Service: route53resolver

Description

Lists the tags that you associated with the specified resource.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::123456789012:user/sample-user is not authorized to perform: route53resolver:ListTagsForResource on resource: arn:aws:iam::123456789012:role/dw-probe",
  "eventCategory": "Management",
  "eventID": "8ed70f34-1a2e-4095-ad69-e23b191e8993",
  "eventName": "ListTagsForResource",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T18:46:06Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "a93595df-662e-46ff-8387-1a442ac71763",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

PutFirewallRuleGroupPolicy

Service: route53resolver

Description

Attaches an Identity and Access Management (Amazon Web Services IAM) policy for sharing the rule group.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "[RSLVR-02035] The specified IAM policy isn't valid: \"{\"Version\": \"2012-10-17\", \"Statement\": [{\"Sid\": \"DenyExternalShare\", \"Effect\": \"Deny\", \"Principal\": \"*\", \"Action\": \"route53resolver:GetFirewallRuleGroup\", \"Resource\": \"arn:aws:route53resolver:us-west-1:123456789012:firewall-rule-group/rslvr-frg-81dc088dd0314635\"}]}\". Provide a valid policy that allows a DNS Firewall rule group to be shared with another AWS account. Trace Id: \"1-6a42dd01-6a46c2410052a2a06cc9fc42\"",
  "eventCategory": "Management",
  "eventID": "7273d5b5-7d5b-4654-ba7c-1d24646775a0",
  "eventName": "PutFirewallRuleGroupPolicy",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T21:00:49Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "30013acb-0721-4cbc-930f-e034184a56ff",
  "requestParameters": {
    "arn": "arn:aws:route53resolver:us-west-1:123456789012:firewall-rule-group/rslvr-frg-81dc088dd0314635",
    "firewallRuleGroupPolicy": {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Sid": "DenyExternalShare",
          "Effect": "Deny",
          "Principal": "*",
          "Action": "route53resolver:GetFirewallRuleGroup",
          "Resource": "arn:aws:route53resolver:us-west-1:123456789012:firewall-rule-group/rslvr-frg-81dc088dd0314635"
        }
      ]
    }
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,n,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

PutResolverQueryLogConfigPolicy

Service: route53resolver

Description

Specifies an Amazon Web Services account that you want to share a query logging configuration with, the query logging configuration that you want to share, and the operations that you want the account to be able to perform on the configurat.

PutResolverRulePolicy

Service: route53resolver

Description

Specifies an Amazon Web Services rule that you want to share with another account, the account that you want to share the rule with, and the operations that you want the account to be able to perform on the rule.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "InvalidPolicyDocument",
  "errorMessage": "[RSLVR-00312] Invalid Policy",
  "eventCategory": "Management",
  "eventID": "1f8758e2-f7f9-40fd-a03b-1d54b3c07e8d",
  "eventName": "PutResolverRulePolicy",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T21:00:49Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "3926f161-91a1-4f9c-9827-680a5651e933",
  "requestParameters": {
    "arn": "arn:aws:route53resolver:us-west-1:123456789012:resolver-rule/rslvr-rr-129d1a22688545a09",
    "resolverRulePolicy": {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Sid": "DenyExternalShare",
          "Effect": "Deny",
          "Principal": "*",
          "Action": "route53resolver:GetResolverRule",
          "Resource": "arn:aws:route53resolver:us-west-1:123456789012:resolver-rule/rslvr-rr-129d1a22688545a09"
        }
      ]
    }
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,n,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

TagResource

Service: route53resolver

Description

Adds one or more tags to a specified resource.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "279cdd17-cee5-499a-acb1-65fdb83bdb21",
  "eventName": "TagResource",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T21:00:49Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "ff4df31c-eb62-4515-9ed3-d071d9607de9",
  "requestParameters": {
    "resourceArn": "arn:aws:route53resolver:us-west-1:123456789012:firewall-rule-group/rslvr-frg-81dc088dd0314635",
    "tags": [
      {
        "key": "Purpose",
        "value": "dw-sample-collection"
      }
    ]
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,n,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UntagResource

Service: route53resolver

Description

Removes one or more tags from a specified resource.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::123456789012:user/sample-user is not authorized to perform: route53resolver:UntagResource on resource: arn:aws:iam::123456789012:role/dw-probe",
  "eventCategory": "Management",
  "eventID": "caa1d26f-4516-4a4e-a95c-33591f3e69b6",
  "eventName": "UntagResource",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T19:26:34Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "84333b9c-a744-4b5a-8814-f6586d6219c4",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateFirewallConfig

Service: route53resolver

Description

Updates the configuration of the firewall behavior provided by DNS Firewall for a single VPC from Amazon Virtual Private Cloud (Amazon VPC).

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "[RSLVR-00916] The ID of the resource is invalid. Trace Id: \"1-6a42c6eb-21977bde4ab0a8332f1db9aa\"",
  "eventCategory": "Management",
  "eventID": "f2a4658e-e87a-42ce-90bf-c6fb818dd51a",
  "eventName": "UpdateFirewallConfig",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T19:26:35Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "3c872ea4-2c99-428b-b820-7c82532892f3",
  "requestParameters": {
    "firewallFailOpen": "ENABLED",
    "resourceId": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateFirewallDomains

Service: route53resolver

Description

Updates the firewall domain list from an array of domain specifications.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "[RSLVR-02025] Can’t find the resource with ID \"ddddd\". Trace Id: \"1-6a42c6eb-759a662039d155e459900a48\"",
  "eventCategory": "Management",
  "eventID": "5365c525-da14-46ee-a672-ed0f7241d802",
  "eventName": "UpdateFirewallDomains",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T19:26:35Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "9be9a4de-973e-43a6-b0bd-7eb4a70945a3",
  "requestParameters": {
    "domains": [
      "ddddd"
    ],
    "firewallDomainListId": "ddddd",
    "operation": "ADD"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateFirewallRule

Service: route53resolver

Description

Updates the specified firewall rule.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "[RSLVR-02049] Missing parameter to identify the rule within the firewall rule group Trace Id: \"1-6a42c6eb-723503b85e005b4c0344eff6\"",
  "eventCategory": "Management",
  "eventID": "d1bfd376-1ff6-4520-a833-07e7b002bcb9",
  "eventName": "UpdateFirewallRule",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T19:26:35Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "84e65c4e-99bd-4baf-93ff-537b54151290",
  "requestParameters": {
    "firewallRuleGroupId": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateFirewallRuleGroupAssociation

Service: route53resolver

Description

Changes the association of a FirewallRuleGroup with a VPC.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "[RSLVR-02005] At least one attribute is required. Trace Id: \"1-6a42c6eb-4a1951d5299ab872238a35cf\"",
  "eventCategory": "Management",
  "eventID": "95c5e60a-a36d-49b1-bd65-f21b4855c415",
  "eventName": "UpdateFirewallRuleGroupAssociation",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T19:26:35Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "cfec0713-0e0d-41b7-94f4-2e4f73b84c97",
  "requestParameters": {
    "firewallRuleGroupAssociationId": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateOutpostResolver

Service: route53resolver

Description

You can use UpdateOutpostResolver to update the instance count, type, or name of a Resolver on an Outpost.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "[RSLVR-03200] You need to provide at least one attribute to update the resource.",
  "eventCategory": "Management",
  "eventID": "13a6f33c-f3c4-4cae-9354-f7684eb7b5ce",
  "eventName": "UpdateOutpostResolver",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T19:26:35Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "89ebf4ed-6929-41d4-bc5b-c33a40e8400b",
  "requestParameters": {
    "id": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateResolverConfig

Service: route53resolver

Description

Updates the behavior configuration of Route 53 Resolver behavior for a single VPC from Amazon Virtual Private Cloud.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "[RSLVR-00916] The ID of the resource is invalid.",
  "eventCategory": "Management",
  "eventID": "3a613408-553b-4488-b29e-9373847e450d",
  "eventName": "UpdateResolverConfig",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T19:26:35Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "a84c928d-0be1-4561-ad8f-4b284de1a361",
  "requestParameters": {
    "autodefinedReverseFlag": "ENABLE",
    "resourceId": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateResolverDnssecConfig

Service: route53resolver

Description

Updates an existing DNSSEC validation configuration.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "InvalidParameterException",
  "errorMessage": "The ID of the resource is invalid. Trace Id: \"1-6a42c6eb-5c31ad6171e88caa602b71e7\"",
  "eventCategory": "Management",
  "eventID": "80563822-47bb-4e3f-b5ec-0016800f2762",
  "eventName": "UpdateResolverDnssecConfig",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T19:26:35Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "413d0f84-7f19-4811-a05a-0463c244b7db",
  "requestParameters": {
    "resourceId": "ddddd",
    "validation": "ENABLE"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateResolverEndpoint

Service: route53resolver

Description

Updates the name, or endpoint type for an inbound or an outbound Resolver endpoint.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "[RSLVR-00501] Resolver endpoint with ID \"ddddd\" does not exist.",
  "eventCategory": "Management",
  "eventID": "53919f7f-a922-4bc1-8a77-e1ef0f414a17",
  "eventName": "UpdateResolverEndpoint",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T19:26:35Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "1e5e81ff-63d6-44eb-9871-f2c8cbf503ff",
  "requestParameters": {
    "resolverEndpointId": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateResolverRule

Service: route53resolver

Description

Updates settings for a specified Resolver rule.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "[RSLVR-00703] Resolver rule with ID \"ddddd\" does not exist.",
  "eventCategory": "Management",
  "eventID": "b5bf99a6-7978-451b-99ee-b9da7550a866",
  "eventName": "UpdateResolverRule",
  "eventSource": "route53resolver.amazonaws.com",
  "eventTime": "2026-06-29T19:26:35Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "9329726a-8a98-4b24-b681-ad99a82f59e3",
  "requestParameters": {
    "config": {},
    "resolverRuleId": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53resolver.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}