Service Quotas

eventName	Description	Sample	Rule
any	Catch-all entry for Service Quotas rules that match the service but not a specific eventName.	N	N
GetServiceQuota	Returns the applied quota value for the specified service and quota, including any quota increase request.	Y	Y
AssociateServiceQuotaTemplate	Associates your quota request template with your organization.	N	N
CreateSupportCase	Creates a Support case for an existing quota increase request.	N	N
DeleteServiceQuotaIncreaseRequestFromTemplate	Deletes the quota increase request for the specified quota from your quota request template.	Y	N
DisassociateServiceQuotaTemplate	Disables your quota request template.	Y	N
GetAssociationForServiceQuotaTemplate	Retrieves the status of the association for the quota request template.	Y	N
GetAutoManagementConfiguration	Retrieves information about your Service Quotas Automatic Management configuration.	Y	N
GetAWSDefaultServiceQuota	Retrieves the default value for the specified quota.	Y	N
GetQuotaUtilizationReport	Retrieves the quota utilization report for your Amazon Web Services account.	Y	N
GetRequestedServiceQuotaChange	Retrieves information about the specified quota increase request.	Y	N
GetServiceQuotaIncreaseRequestFromTemplate	Retrieves information about the specified quota increase request in your quota request template.	Y	N
ListAWSDefaultServiceQuotas	Lists the default values for the quotas for the specified Amazon Web Services service.	Y	N
ListRequestedServiceQuotaChangeHistory	Retrieves the quota increase requests for the specified Amazon Web Services service.	Y	N
ListRequestedServiceQuotaChangeHistoryByQuota	Retrieves the quota increase requests for the specified quota.	Y	N
ListServiceQuotaIncreaseRequestsInTemplate	Lists the quota increase requests in the specified quota request template.	Y	N
ListServiceQuotas	Lists the applied quota values for the specified Amazon Web Services service.	Y	N
ListServices	Lists the names and codes for the Amazon Web Services services integrated with Service Quotas.	Y	N
ListTagsForResource	Returns a list of the tags assigned to the specified applied quota.	N	N
PutServiceQuotaIncreaseRequestIntoTemplate	Adds a quota increase request to your quota request template.	N	N
RequestServiceQuotaIncrease	Submits a quota increase request for the specified quota at the account or resource level.	Y	N
StartAutoManagement	Starts Service Quotas Automatic Management for an Amazon Web Services account, including notification preferences and excluded quotas configurations.	Y	N
StartQuotaUtilizationReport	Initiates the generation of a quota utilization report for your Amazon Web Services account.	Y	N
StopAutoManagement	Stops Service Quotas Automatic Management for an Amazon Web Services account and removes all associated configurations.	Y	N
TagResource	Adds tags to the specified applied quota.	N	N
UntagResource	Removes tags from the specified applied quota.	N	N
UpdateAutoManagement	Updates your Service Quotas Automatic Management configuration, including notification preferences and excluded quotas.	Y	N
RequestServiceQuotaIncreaseForNewAccount	RequestServiceQuotaIncreaseForNewAccount recorded by CloudTrail for Service Quotas. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.	N	N
UpdateServiceQuotaIncreaseRequestStatus	UpdateServiceQuotaIncreaseRequestStatus recorded by CloudTrail for Service Quotas. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.	N	N

any: Service Quotas (catch-all)

Service: servicequotas

Description

Catch-all entry for Service Quotas rules that match the service but not a specific eventName.

GetServiceQuota

Service: servicequotas

Description

Returns the applied quota value for the specified service and quota, including any quota increase request.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "NoSuchResourceException",
  "errorMessage": "The request failed because the specified quota and service do not exist.",
  "eventCategory": "Management",
  "eventID": "5d1d4023-37dd-4295-9894-28a17902a323",
  "eventName": "GetServiceQuota",
  "eventSource": "servicequotas.amazonaws.com",
  "eventTime": "2026-06-29T18:46:10Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.10",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "adf265a2-13cb-4ae4-879a-a263d570acec",
  "requestParameters": {
    "quotaCode": "ddddd",
    "serviceCode": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "servicequotas.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`Esql.cloud_region_count_distinct` (elastic rule field)	ge	`10`	1 rule	elastic
`Esql.event_count` (elastic rule field)	ge	`10`	1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Service Quotas Multi-Region GetServiceQuota Requests source low: Identifies when a single AWS principal makes GetServiceQuota API calls for the EC2 service quota L-1216C47A, across more than 10 AWS regions within a 30-second window. This quota represents the vCPU limit for on-demand EC2 instances. Adversaries commonly enumerate this quota across regions to assess capacity for large-scale instance deployment, including cryptocurrency mining, malware hosting, or command-and-control infrastructure. This behavior may indicate cloud infrastructure discovery using compromised credentials or a compromised workload.T1526, T1580

AssociateServiceQuotaTemplate

Service: servicequotas

Description

Associates your quota request template with your organization.

CreateSupportCase

Service: servicequotas

Description

Creates a Support case for an existing quota increase request.

DeleteServiceQuotaIncreaseRequestFromTemplate

Service: servicequotas

Description

Deletes the quota increase request for the specified quota from your quota request template.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "TemplatesNotAvailableInRegionException",
  "errorMessage": "Quota templates are not available in Region 'us-west-1'. To use quota templates, make your request in us-east-1.",
  "eventCategory": "Management",
  "eventID": "0f2f2093-c14e-4e44-b08d-307afda19bcc",
  "eventName": "DeleteServiceQuotaIncreaseRequestFromTemplate",
  "eventSource": "servicequotas.amazonaws.com",
  "eventTime": "2026-06-29T19:26:40Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.10",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "4d7cf5e6-e8e0-4c35-b15c-57705eb328be",
  "requestParameters": {
    "awsRegion": "ddddd",
    "quotaCode": "ddddd",
    "serviceCode": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "servicequotas.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DisassociateServiceQuotaTemplate

Service: servicequotas

Description

Disables your quota request template.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "TemplatesNotAvailableInRegionException",
  "errorMessage": "Quota templates are not available in Region 'us-west-1'. To use quota templates, make your request in us-east-1.",
  "eventCategory": "Management",
  "eventID": "761b5e4c-94cb-401f-bcdb-8a8366c2db66",
  "eventName": "DisassociateServiceQuotaTemplate",
  "eventSource": "servicequotas.amazonaws.com",
  "eventTime": "2026-06-29T19:45:33Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.10",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "bf2b5680-772d-421f-ab8a-630543e41e0b",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "servicequotas.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,Z,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetAssociationForServiceQuotaTemplate

Service: servicequotas

Description

Retrieves the status of the association for the quota request template.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "TemplatesNotAvailableInRegionException",
  "errorMessage": "Quota templates are not available in Region 'us-west-1'. To use quota templates, make your request in us-east-1.",
  "eventCategory": "Management",
  "eventID": "986e09ba-6f3a-4411-a3bb-ed9558f5f9d6",
  "eventName": "GetAssociationForServiceQuotaTemplate",
  "eventSource": "servicequotas.amazonaws.com",
  "eventTime": "2026-06-29T18:32:44Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.10",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "cf4118e9-360e-4838-a5ad-d5055f55e183",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "servicequotas.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetAutoManagementConfiguration

Service: servicequotas

Description

Retrieves information about your Service Quotas Automatic Management configuration.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "b5be3fb1-e47d-4296-aa2a-479faae6b1f8",
  "eventName": "GetAutoManagementConfiguration",
  "eventSource": "servicequotas.amazonaws.com",
  "eventTime": "2026-06-29T18:32:44Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.10",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "049f2038-0d82-4538-afd1-bab3e57c3c9c",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "servicequotas.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetAWSDefaultServiceQuota

Service: servicequotas

Description

Retrieves the default value for the specified quota.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "NoSuchResourceException",
  "eventCategory": "Management",
  "eventID": "e72a211d-221b-4759-93e0-2ae6c2e66e94",
  "eventName": "GetAWSDefaultServiceQuota",
  "eventSource": "servicequotas.amazonaws.com",
  "eventTime": "2026-06-29T18:46:10Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.10",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "3d16edcf-bff8-49dd-852d-0eb4fd0faf2e",
  "requestParameters": {
    "quotaCode": "ddddd",
    "serviceCode": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "servicequotas.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetQuotaUtilizationReport

Service: servicequotas

Description

Retrieves the quota utilization report for your Amazon Web Services account.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "NoSuchResourceException",
  "errorMessage": "Report not found: ddddd",
  "eventCategory": "Management",
  "eventID": "bc1af506-9bf8-4419-809e-24a585112f54",
  "eventName": "GetQuotaUtilizationReport",
  "eventSource": "servicequotas.amazonaws.com",
  "eventTime": "2026-06-29T18:46:10Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.10",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "c6ff1880-3584-4573-aa64-d94347a44faa",
  "requestParameters": {
    "reportId": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "servicequotas.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetRequestedServiceQuotaChange

Service: servicequotas

Description

Retrieves information about the specified quota increase request.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "NoSuchResourceException",
  "errorMessage": "The request failed because the specified requestId to increase the service quota does not exist.",
  "eventCategory": "Management",
  "eventID": "2afae885-597a-40a7-ba64-fe464150985a",
  "eventName": "GetRequestedServiceQuotaChange",
  "eventSource": "servicequotas.amazonaws.com",
  "eventTime": "2026-06-29T18:46:10Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.10",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "c2f9f76e-fef0-4151-a7f3-a3a1f6fede71",
  "requestParameters": {
    "requestId": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "servicequotas.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetServiceQuotaIncreaseRequestFromTemplate

Service: servicequotas

Description

Retrieves information about the specified quota increase request in your quota request template.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "TemplatesNotAvailableInRegionException",
  "errorMessage": "Quota templates are not available in Region 'us-west-1'. To use quota templates, make your request in us-east-1.",
  "eventCategory": "Management",
  "eventID": "833f8bc4-0e0f-4a87-9351-bfc2c21af384",
  "eventName": "GetServiceQuotaIncreaseRequestFromTemplate",
  "eventSource": "servicequotas.amazonaws.com",
  "eventTime": "2026-06-29T18:46:10Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.10",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "d582e8ae-1a1b-41ce-86f9-0bcdf8bc29b4",
  "requestParameters": {
    "awsRegion": "ddddd",
    "quotaCode": "ddddd",
    "serviceCode": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "servicequotas.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListAWSDefaultServiceQuotas

Service: servicequotas

Description

Lists the default values for the quotas for the specified Amazon Web Services service.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "NoSuchResourceException",
  "errorMessage": "This service is not available in the current Region. Choose a different Region or a different service. ",
  "eventCategory": "Management",
  "eventID": "12177ab0-a1c1-400a-b838-ddd0d4d3ddd7",
  "eventName": "ListAWSDefaultServiceQuotas",
  "eventSource": "servicequotas.amazonaws.com",
  "eventTime": "2026-06-29T18:46:10Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.10",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "04064bb9-f895-48a7-ac1d-baa7f08a444b",
  "requestParameters": {
    "serviceCode": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "servicequotas.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListRequestedServiceQuotaChangeHistory

Service: servicequotas

Description

Retrieves the quota increase requests for the specified Amazon Web Services service.

Example CloudTrail Event #

{
  "awsRegion": "us-west-2",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a is not authorized to perform: servicequotas:ListRequestedServiceQuotaChangeHistory",
  "eventID": "fdb7282e-7d08-481c-a83a-d146502b736c",
  "eventName": "ListRequestedServiceQuotaChangeHistory",
  "eventSource": "servicequotas.amazonaws.com",
  "eventTime": "2019-09-18T04:40:37Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "readOnly": true,
  "recipientAccountId": "811596193553",
  "requestID": "0372a4e6-437b-4400-8370-e31f397a568d",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "6.237.76.238",
  "userAgent": "aws-internal/3 aws-sdk-java/1.11.571 Linux/4.9.184-0.1.ac.235.83.329.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.212-b03 java/1.8.0_212 vendor/Oracle_Corporation",
  "userIdentity": {
    "accessKeyId": "ASIAH52YGDTMID1F3K9R",
    "accountId": "811596193553",
    "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a",
    "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a",
    "sessionContext": {
      "attributes": {
        "creationDate": "2019-09-18T04:29:51Z",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {
        "accountId": "811596193553",
        "arn": "arn:aws:iam::811596193553:role/flaws",
        "principalId": "AROACW5CSA8C8WHOB3O7Q",
        "type": "Role",
        "userName": "flaws"
      },
      "webIdFederationData": {}
    },
    "type": "AssumedRole"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

ListRequestedServiceQuotaChangeHistoryByQuota

Service: servicequotas

Description

Retrieves the quota increase requests for the specified quota.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "NoSuchResourceException",
  "errorMessage": "This service is not available in the current Region. Choose a different Region or a different service. ",
  "eventCategory": "Management",
  "eventID": "6a6a21bc-163d-42e0-aa8f-33623ba5b585",
  "eventName": "ListRequestedServiceQuotaChangeHistoryByQuota",
  "eventSource": "servicequotas.amazonaws.com",
  "eventTime": "2026-06-29T18:46:10Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.10",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "43f99df6-52da-475a-8d15-30f4039cd8d9",
  "requestParameters": {
    "quotaCode": "ddddd",
    "serviceCode": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "servicequotas.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListServiceQuotaIncreaseRequestsInTemplate

Service: servicequotas

Description

Lists the quota increase requests in the specified quota request template.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: servicequotas:ListServiceQuotaIncreaseRequestsInTemplate",
  "eventID": "eefe36b0-5195-4fbb-aae6-555a180777b13",
  "eventName": "ListServiceQuotaIncreaseRequestsInTemplate",
  "eventSource": "servicequotas.amazonaws.com",
  "eventTime": "2020-06-10T05:34:26Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "readOnly": true,
  "recipientAccountId": "811596193553",
  "requestID": "0b8a37ff-4155-4c34-ad87-5bff634de6dc",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "251.105.254.1",
  "userAgent": "Botocore/1.16.26 Python/2.7.18 Linux/5.4.0-2-amd64",
  "userIdentity": {
    "accessKeyId": "AKIA01U43UX3RBRDXF4Q",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/backup",
    "principalId": "AIDA9BO36HFBHKGJAO9C1",
    "type": "IAMUser",
    "userName": "backup"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

ListServiceQuotas

Service: servicequotas

Description

Lists the applied quota values for the specified Amazon Web Services service.

Example CloudTrail Event #

{
  "awsRegion": "sa-east-1",
  "eventCategory": "Management",
  "eventID": "00df9955-e785-479c-b4ba-c7fe4c2b5f10",
  "eventName": "ListServiceQuotas",
  "eventSource": "servicequotas.amazonaws.com",
  "eventTime": "2021-04-13T11:35:48Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "760111141337",
  "requestID": "a7084558-2990-4312-9698-3f18083a2b0b",
  "requestParameters": {
    "nextToken": "UFQCQUFBQUFBRUNBZ0I0MXgyeE5iTC82Q0psREZ2MVpRVDMwSXg1OEhLaGNUQVYyUmRabkJmQXBWUUJjSi9CaDZPQnhjMTdnU1dRR3JYeTVRQUFBckl3Z2dLdUJna3Foa2lHOXcwQkJ3YWdnZ0tmTUlJQ213SUJBRENDQXBRR0NTcUdTSWIzRFFFSEFUQWVCZ2xnaGtnQlpRTUVBUzR3RVFRTTMwWEUxLzhvaFMwS01EMlJBZ0VRZ0lJQ1plTkxFL29Mb0VzV3dkcVhmdXA3SG54S01NbHJaWTQ1MG1KWFZzcjYvakw0SFg3aUdIY29mcENvRVR0dEdkZEJvbW94d2JPOXZ1d3UzdEJTUEorSkVZU0FvUlRzNUlSR2JqNTFWR2pFMWxuczA4SU5pazVVbEl0V2N1ZVY1ckRtaWZLQVpoOWp3dnR3TEdRcGROWTZPZkNuWmcrNUU4VlRvQncvNDBtaU9kcFBQT3c1eFlKR255MGFkV1ZjbmtvTDRvUmMrc2M1dlErVXAvQUIwTDV6OEcrdFp4b0FmeGUzL1loenF0TENXU2ZCdGk1YnJkcnk2eDVjNUJnNVpaclBPVjgxNXJCUWtTNFVtY3hrSkZaaTF6RjhLaXp6Zm1pcC9vcmp4UUpUd3NJRzdpZnpvY3ZxSzNaN2h0MGdKb241VmZhTnFpNWxoeTM0YTdqdmhycUVUWC9vRVRkakNvY3RWOWw3cnBHdFh2M3QzVzN2ZU5FNjJsV1F1M01PVU9UYnFva0JHeTZkZDZoSjBTSWQ2NU5zNWpFcm0xcVFEUHNpN2ZhK0YzUUl3aGh6bE93SmpXQWdjUGRFT3ZEWEQvT0pXZG5xWm5IZkVMalg5RW81WDloSmFvTFlUK1E1c3ZITTF3MVBpaG1QUll4M0pDUzA5amJ0cDRrYzJYNGFVNGUrbjJ6MlFlamR4VDVKamx3eTZLc09RUlo1bVhzUFZnNnFxL3VybzlsT3JYYzBnQjNhVitta3BsWko2RXF4cDYyWnFrQW9EVllrQkhJK2NHZzFYSWZNSk03TTYzZDF3ZXhOZk9pU0c0S3lPS1p6eUZOd1o2Zm81aFAyS3NROTByVFkxK3MxQ3lKcytQOEJ0Rlp5L0FFaDdzVnU4YURudDlCOTY0THd0ZDBIVEZiaFh1MzYrY2FpUEJCU2VlWDc1Rk5FME5Wa3F3Sit3MkV3S3FUemhZNUJSekppeXZNTnFUb294WldjbVYzeXVKQmpPS2gxT0FFbk5NODg3QUR5a1VTaTRBUW9FMVlDdVZPeHBqU3ppd2w4a1RGY0RqclM5SW14bzV2djZpQi9CUWZITVo4MGZiTT0=",
    "serviceCode": "ec2"
  },
  "responseElements": null,
  "sourceIPAddress": "95.9.125.40",
  "userAgent": "aws-sdk-nodejs/2.885.0 linux/v14.16.1 callback",
  "userIdentity": {
    "accessKeyId": "AKIAYTOGP2RLGBSBSMH2",
    "accountId": "760111141337",
    "arn": "arn:aws:iam::760111141337:user/cloudsploit",
    "principalId": "AIDAYTOGP2RLMDEPWZWMJ",
    "type": "IAMUser",
    "userName": "cloudsploit"
  }
}

References #

Sample log: splunk/attack_data

ListServices

Service: servicequotas

Description

Lists the names and codes for the Amazon Web Services services integrated with Service Quotas.

Example CloudTrail Event #

{
  "awsRegion": "us-west-2",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a is not authorized to perform: servicequotas:ListServices",
  "eventID": "534648bd7-7f8a-4f24-bc5e-c56cfaf5d50f",
  "eventName": "ListServices",
  "eventSource": "servicequotas.amazonaws.com",
  "eventTime": "2019-09-18T04:40:37Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "readOnly": true,
  "recipientAccountId": "811596193553",
  "requestID": "dd08200-c5b9-4d4b-83f4-4865f6ed6940",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "6.237.76.238",
  "userAgent": "aws-internal/3 aws-sdk-java/1.11.571 Linux/4.9.184-0.1.ac.235.83.329.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.212-b03 java/1.8.0_212 vendor/Oracle_Corporation",
  "userIdentity": {
    "accessKeyId": "ASIAH52YGDTMID1F3K9R",
    "accountId": "811596193553",
    "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a",
    "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a",
    "sessionContext": {
      "attributes": {
        "creationDate": "2019-09-18T04:29:51Z",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {
        "accountId": "811596193553",
        "arn": "arn:aws:iam::811596193553:role/flaws",
        "principalId": "AROACW5CSA8C8WHOB3O7Q",
        "type": "Role",
        "userName": "flaws"
      },
      "webIdFederationData": {}
    },
    "type": "AssumedRole"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

ListTagsForResource

Service: servicequotas

Description

Returns a list of the tags assigned to the specified applied quota.

PutServiceQuotaIncreaseRequestIntoTemplate

Service: servicequotas

Description

Adds a quota increase request to your quota request template.

RequestServiceQuotaIncrease

Service: servicequotas

Description

Submits a quota increase request for the specified quota at the account or resource level.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "NoSuchResourceException",
  "errorMessage": "The request failed because the specified quota and service do not exist.",
  "eventCategory": "Management",
  "eventID": "201bfbe3-da2d-45a1-bd07-f2b317fcddf0",
  "eventName": "RequestServiceQuotaIncrease",
  "eventSource": "servicequotas.amazonaws.com",
  "eventTime": "2026-06-29T20:58:53Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.10",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "03fbbd00-075d-4c5a-9e01-a632193980c7",
  "requestParameters": {
    "desiredValue": 21.0,
    "quotaCode": "L-F678F1CE",
    "serviceCode": "servicequotas",
    "supportCaseAllowed": false
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "servicequotas.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,n,b,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

StartAutoManagement

Service: servicequotas

Description

Starts Service Quotas Automatic Management for an Amazon Web Services account, including notification preferences and excluded quotas configurations.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "652b48e4-3679-400c-ba30-9627bf1c1c94",
  "eventName": "StartAutoManagement",
  "eventSource": "servicequotas.amazonaws.com",
  "eventTime": "2026-06-29T20:58:53Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.10",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "ddea954b-2b38-4946-9b25-0b77bffa8e2d",
  "requestParameters": {
    "optInLevel": "ACCOUNT",
    "optInType": "NotifyOnly"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "servicequotas.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,n,b,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

StartQuotaUtilizationReport

Service: servicequotas

Description

Initiates the generation of a quota utilization report for your Amazon Web Services account.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "21b217c3-0928-41df-b130-d2b020dc4050",
  "eventName": "StartQuotaUtilizationReport",
  "eventSource": "servicequotas.amazonaws.com",
  "eventTime": "2026-06-29T20:58:53Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.10",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "987ab00e-5e3c-4412-b8bf-8bf1c6a93271",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "servicequotas.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,n,b,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

StopAutoManagement

Service: servicequotas

Description

Stops Service Quotas Automatic Management for an Amazon Web Services account and removes all associated configurations.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "NoSuchResourceException",
  "errorMessage": "Resource not found for subjectId: 123456789012",
  "eventCategory": "Management",
  "eventID": "c5ee3489-f365-4820-847c-7fe822ac281d",
  "eventName": "StopAutoManagement",
  "eventSource": "servicequotas.amazonaws.com",
  "eventTime": "2026-06-29T19:45:33Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.10",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "bc9a5c9f-446b-4353-9d49-57939fc64c5f",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "servicequotas.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,Z,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

TagResource

Service: servicequotas

Description

Adds tags to the specified applied quota.

UntagResource

Service: servicequotas

Description

Removes tags from the specified applied quota.

UpdateAutoManagement

Service: servicequotas

Description

Updates your Service Quotas Automatic Management configuration, including notification preferences and excluded quotas.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "3a938b67-7d29-48bc-9636-bf3a5c487e67",
  "eventName": "UpdateAutoManagement",
  "eventSource": "servicequotas.amazonaws.com",
  "eventTime": "2026-06-29T20:58:53Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.10",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "8437ffbc-e0a5-4c86-bec8-cdc3aa473de5",
  "requestParameters": {
    "optInType": "NotifyOnly"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "servicequotas.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,n,b,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

RequestServiceQuotaIncreaseForNewAccount

Service: servicequotas

Description

RequestServiceQuotaIncreaseForNewAccount recorded by CloudTrail for Service Quotas. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.

Example CloudTrail Event #

This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.

{
  "eventVersion": "1.10",
  "eventID": "e360ed3e-6fb0-42cd-a867-df5a439b10a3",
  "eventSource": "servicequotas.amazonaws.com",
  "eventName": "RequestServiceQuotaIncreaseForNewAccount",
  "awsRegion": "us-east-1",
  "eventType": "AwsServiceEvent",
  "readOnly": false,
  "managementEvent": true,
  "userAgent": "servicequotas.amazonaws.com"
}

UpdateServiceQuotaIncreaseRequestStatus

Service: servicequotas

Description

UpdateServiceQuotaIncreaseRequestStatus recorded by CloudTrail for Service Quotas. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.

Example CloudTrail Event #

{
  "eventVersion": "1.10",
  "eventID": "29b20347-911b-4171-be3a-1b31ee55bc41",
  "eventSource": "servicequotas.amazonaws.com",
  "eventName": "UpdateServiceQuotaIncreaseRequestStatus",
  "awsRegion": "us-east-1",
  "eventType": "AwsServiceEvent",
  "readOnly": false,
  "managementEvent": true,
  "userAgent": "servicequotas.amazonaws.com"
}