AWS IAM Identity Center Directory
| eventName | Description | Sample | Rule |
|---|---|---|---|
| any | Catch-all entry for AWS IAM Identity Center Directory rules that match the service but not a specific eventName. | N | N |
| Disable | Disables an external identity provider configuration for an IAM Identity Center directory. | N | Y |
| Enable | Enables an external identity provider configuration for an IAM Identity Center directory. | N | Y |
| Add | AddMemberToGroup recorded by CloudTrail for AWS IAM Identity Center Directory. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK. | N | N |
| Create | CreateGroup recorded by CloudTrail for AWS IAM Identity Center Directory. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK. | N | N |
| Describe | DescribeDirectory recorded by CloudTrail for AWS IAM Identity Center Directory. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK. | N | N |
| Describe | DescribeGroups recorded by CloudTrail for AWS IAM Identity Center Directory. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK. | N | N |
| List | ListBearerTokens recorded by CloudTrail for AWS IAM Identity Center Directory. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK. | N | N |
| List | ListExternalIdPCertificates recorded by CloudTrail for AWS IAM Identity Center Directory. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK. | N | N |
| List | ListExternalIdPConfigurationsForDirectory recorded by CloudTrail for AWS IAM Identity Center Directory. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK. | N | N |
| List | ListMembersInGroup recorded by CloudTrail for AWS IAM Identity Center Directory. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK. | N | N |
| List | ListMfaDevicesForUser recorded by CloudTrail for AWS IAM Identity Center Directory. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK. | N | N |
| List | ListProvisioningTenants recorded by CloudTrail for AWS IAM Identity Center Directory. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK. | N | N |
| Remove | RemoveMemberFromGroup recorded by CloudTrail for AWS IAM Identity Center Directory. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK. | N | N |
| Search | SearchGroups recorded by CloudTrail for AWS IAM Identity Center Directory. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK. | N | N |
| Search | SearchUsers recorded by CloudTrail for AWS IAM Identity Center Directory. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK. | N | N |
| Update | UpdateGroupDisplayName recorded by CloudTrail for AWS IAM Identity Center Directory. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK. | N | N |
any: AWS IAM Identity Center Directory (catch-all)
#Description
Catch-all entry for AWS IAM Identity Center Directory rules that match the service but not a specific eventName.
DisableExternalIdPConfigurationForDirectory
#Description
Disables an external identity provider configuration for an IAM Identity Center directory.
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
T1556↳ also matches EnableExternalIdPConfigurationForDirectory
EnableExternalIdPConfigurationForDirectory
#Description
Enables an external identity provider configuration for an IAM Identity Center directory.
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
T1556↳ also matches DisableExternalIdPConfigurationForDirectory
AddMemberToGroup
#Description
AddMemberToGroup recorded by CloudTrail for AWS IAM Identity Center Directory. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.
Example CloudTrail Event #
This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.
{
"eventVersion": "1.11",
"eventID": "690142dc-4d89-43ac-bb4e-47c842474877",
"eventSource": "sso-directory.amazonaws.com",
"eventName": "AddMemberToGroup",
"awsRegion": "us-east-1",
"eventType": "AwsApiCall",
"readOnly": false,
"managementEvent": true,
"requestID": "a35bef64-18ef-49b0-b5ba-73278b50b95e",
"tlsDetails": {
"tlsVersion": "TLSv1.3",
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "example.us-east-1.amazonaws.com"
}
}
CreateGroup
#Description
CreateGroup recorded by CloudTrail for AWS IAM Identity Center Directory. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.
Example CloudTrail Event #
This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.
{
"eventVersion": "1.11",
"eventID": "7d898f39-bf30-4772-899b-b64468e852bd",
"eventSource": "sso-directory.amazonaws.com",
"eventName": "CreateGroup",
"awsRegion": "us-east-1",
"eventType": "AwsApiCall",
"readOnly": false,
"managementEvent": true,
"requestID": "0e9cfaf7-ce5a-4e89-8e5e-cd362d55bfe6",
"tlsDetails": {
"tlsVersion": "TLSv1.3",
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "example.us-east-1.amazonaws.com"
}
}
DescribeDirectory
#Description
DescribeDirectory recorded by CloudTrail for AWS IAM Identity Center Directory. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.
Example CloudTrail Event #
This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.
{
"eventVersion": "1.11",
"eventID": "b62a52b2-c4f0-4434-822f-d59c05e12f2d",
"eventSource": "sso-directory.amazonaws.com",
"eventName": "DescribeDirectory",
"awsRegion": "us-east-1",
"eventType": "AwsApiCall",
"readOnly": true,
"managementEvent": true,
"requestID": "a7790a6b-203a-49cb-a3ba-5bb392c99af8",
"userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36",
"tlsDetails": {
"tlsVersion": "TLSv1.3",
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "example.us-east-1.amazonaws.com"
}
}
DescribeGroups
#Description
DescribeGroups recorded by CloudTrail for AWS IAM Identity Center Directory. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.
Example CloudTrail Event #
This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.
{
"eventVersion": "1.11",
"eventID": "26867351-fb24-4102-b79e-8743d53e9914",
"eventSource": "sso-directory.amazonaws.com",
"eventName": "DescribeGroups",
"awsRegion": "us-east-1",
"eventType": "AwsApiCall",
"readOnly": true,
"managementEvent": true,
"requestID": "a3102ba4-edbd-4ebc-8976-504d77bca9f7",
"userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:153.0) Gecko/20100101 Firefox/153.0",
"tlsDetails": {
"tlsVersion": "TLSv1.3",
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "example.us-east-1.amazonaws.com"
}
}
ListBearerTokens
#Description
ListBearerTokens recorded by CloudTrail for AWS IAM Identity Center Directory. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.
Example CloudTrail Event #
This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.
{
"eventVersion": "1.11",
"eventID": "21367e1d-d88f-4d85-a932-173e77c26d84",
"eventSource": "sso-directory.amazonaws.com",
"eventName": "ListBearerTokens",
"awsRegion": "us-east-1",
"eventType": "AwsApiCall",
"readOnly": true,
"managementEvent": true,
"requestID": "2348aeec-b9be-48f5-9ee8-aef1245bf1a8",
"userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36",
"tlsDetails": {
"tlsVersion": "TLSv1.3",
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "example.us-east-1.amazonaws.com"
}
}
ListExternalIdPCertificates
#Description
ListExternalIdPCertificates recorded by CloudTrail for AWS IAM Identity Center Directory. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.
Example CloudTrail Event #
This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.
{
"eventVersion": "1.09",
"eventID": "667f7ef0-c376-4637-bf94-25754afcd953",
"eventSource": "sso-directory.amazonaws.com",
"eventName": "ListExternalIdPCertificates",
"awsRegion": "us-east-1",
"eventType": "AwsApiCall",
"readOnly": true,
"managementEvent": true,
"requestID": "29bfbf9b-67ba-460c-8a79-b38a3e4e5f2e",
"userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36",
"tlsDetails": {
"clientProvidedHostHeader": "example.aws.a2z.com"
},
"resources": [
{
"accountId": "123456789012",
"type": "AWS::SSO::Instance",
"ARN": "arn:aws:sso:::EXAMPLE"
}
]
}
ListExternalIdPConfigurationsForDirectory
#Description
ListExternalIdPConfigurationsForDirectory recorded by CloudTrail for AWS IAM Identity Center Directory. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.
Example CloudTrail Event #
This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.
{
"eventVersion": "1.09",
"eventID": "592c45ae-1d82-4964-ad0c-e8b8ca24a402",
"eventSource": "sso-directory.amazonaws.com",
"eventName": "ListExternalIdPConfigurationsForDirectory",
"awsRegion": "us-east-1",
"eventType": "AwsApiCall",
"readOnly": true,
"managementEvent": true,
"requestID": "00239d81-bc17-4b84-88ee-c96207236ef2",
"userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36",
"tlsDetails": {
"clientProvidedHostHeader": "example.aws.a2z.com"
},
"resources": [
{
"accountId": "123456789012",
"type": "AWS::SSO::Instance",
"ARN": "arn:aws:sso:::EXAMPLE"
}
]
}
ListMembersInGroup
#Description
ListMembersInGroup recorded by CloudTrail for AWS IAM Identity Center Directory. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.
Example CloudTrail Event #
This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.
{
"eventVersion": "1.11",
"eventID": "2299f240-fb52-4947-ba40-8faaba49482c",
"eventSource": "sso-directory.amazonaws.com",
"eventName": "ListMembersInGroup",
"awsRegion": "us-east-1",
"eventType": "AwsApiCall",
"readOnly": true,
"managementEvent": true,
"requestID": "771071c1-6e74-430f-8e40-bbb202517e64",
"userAgent": "Okta SCIM Client 1.0.0",
"tlsDetails": {
"tlsVersion": "TLSv1.3",
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "example.us-east-1.amazonaws.com"
}
}
ListMfaDevicesForUser
#Description
ListMfaDevicesForUser recorded by CloudTrail for AWS IAM Identity Center Directory. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.
Example CloudTrail Event #
This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.
{
"eventVersion": "1.09",
"eventID": "9ef2a4bf-0e0c-43f6-8326-7691dd327e66",
"eventSource": "sso-directory.amazonaws.com",
"eventName": "ListMfaDevicesForUser",
"awsRegion": "us-east-1",
"eventType": "AwsApiCall",
"readOnly": true,
"managementEvent": true,
"requestID": "97b26db2-03fc-43cc-b97b-aefe570b0e76",
"userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36",
"tlsDetails": {
"clientProvidedHostHeader": "example.aws.a2z.com"
},
"resources": [
{
"accountId": "123456789012",
"type": "AWS::SSO::Instance",
"ARN": "arn:aws:sso:::EXAMPLE"
}
]
}
ListProvisioningTenants
#Description
ListProvisioningTenants recorded by CloudTrail for AWS IAM Identity Center Directory. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.
Example CloudTrail Event #
This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.
{
"eventVersion": "1.11",
"eventID": "cb422aa6-43e1-4282-b7e9-4492d65feffa",
"eventSource": "sso-directory.amazonaws.com",
"eventName": "ListProvisioningTenants",
"awsRegion": "us-east-1",
"eventType": "AwsApiCall",
"readOnly": true,
"managementEvent": true,
"requestID": "8f79b162-9ac4-412d-9188-5459fb80a2cf",
"userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36",
"tlsDetails": {
"tlsVersion": "TLSv1.3",
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "example.us-east-1.amazonaws.com"
}
}
RemoveMemberFromGroup
#Description
RemoveMemberFromGroup recorded by CloudTrail for AWS IAM Identity Center Directory. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.
Example CloudTrail Event #
This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.
{
"eventVersion": "1.11",
"eventID": "835dedda-80e7-4f08-9105-49a8791b5cc0",
"eventSource": "sso-directory.amazonaws.com",
"eventName": "RemoveMemberFromGroup",
"awsRegion": "us-east-1",
"eventType": "AwsApiCall",
"readOnly": false,
"managementEvent": true,
"requestID": "c77df000-ea34-42da-b3f9-35e0321efacc",
"userAgent": "Okta SCIM Client 1.0.0",
"tlsDetails": {
"tlsVersion": "TLSv1.3",
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "example.us-east-1.amazonaws.com"
}
}
SearchGroups
#Description
SearchGroups recorded by CloudTrail for AWS IAM Identity Center Directory. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.
Example CloudTrail Event #
This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.
{
"eventVersion": "1.11",
"eventID": "9261f939-0993-4d9e-89e2-74d1e6143242",
"eventSource": "sso-directory.amazonaws.com",
"eventName": "SearchGroups",
"awsRegion": "us-east-1",
"eventType": "AwsApiCall",
"readOnly": true,
"managementEvent": true,
"requestID": "d7a8ce79-3315-48ab-a081-5eddef7db485",
"tlsDetails": {
"tlsVersion": "TLSv1.3",
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "example.us-east-1.amazonaws.com"
}
}
SearchUsers
#Description
SearchUsers recorded by CloudTrail for AWS IAM Identity Center Directory. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.
Example CloudTrail Event #
This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.
{
"eventVersion": "1.11",
"eventID": "3fe749c8-ff66-4c0c-a5e5-303fc9f22c03",
"eventSource": "sso-directory.amazonaws.com",
"eventName": "SearchUsers",
"awsRegion": "us-east-1",
"eventType": "AwsApiCall",
"readOnly": true,
"managementEvent": true,
"requestID": "135df2df-2dff-483c-865d-3a1594ac0a9d",
"tlsDetails": {
"tlsVersion": "TLSv1.3",
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "example.us-east-1.amazonaws.com"
}
}
UpdateGroupDisplayName
#Description
UpdateGroupDisplayName recorded by CloudTrail for AWS IAM Identity Center Directory. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.
Example CloudTrail Event #
This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.
{
"eventVersion": "1.11",
"eventID": "7c6a8b2a-545c-4d6d-95f2-124e12e8acd1",
"eventSource": "sso-directory.amazonaws.com",
"eventName": "UpdateGroupDisplayName",
"awsRegion": "us-east-1",
"eventType": "AwsApiCall",
"readOnly": false,
"managementEvent": true,
"requestID": "473f727b-42d3-4713-8abb-4fe13f49827b",
"userAgent": "Okta SCIM Client 1.0.0",
"tlsDetails": {
"tlsVersion": "TLSv1.3",
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "example.us-east-1.amazonaws.com"
}
}