AWS Resource Groups Tagging API
| eventName | Description | Sample | Rule |
|---|---|---|---|
| any | Catch-all entry for AWS Resource Groups Tagging API rules that match the service but not a specific eventName. | N | N |
| Get | GetResources recorded by CloudTrail for AWS Resource Groups Tagging API. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK. | N | N |
| Get | GetTagKeys recorded by CloudTrail for AWS Resource Groups Tagging API. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK. | Y | N |
| Tag | TagResources recorded by CloudTrail for AWS Resource Groups Tagging API. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK. | N | N |
any: AWS Resource Groups Tagging API (catch-all)
#Description
Catch-all entry for AWS Resource Groups Tagging API rules that match the service but not a specific eventName.
GetResources
#Description
GetResources recorded by CloudTrail for AWS Resource Groups Tagging API. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.
Example CloudTrail Event #
This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.
{
"eventVersion": "1.11",
"eventID": "a34e2a7b-e10c-4164-a6d1-a69d67fdb3b8",
"eventSource": "tagging.amazonaws.com",
"eventName": "GetResources",
"awsRegion": "us-east-2",
"eventType": "AwsApiCall",
"readOnly": true,
"managementEvent": true,
"requestID": "96ea5c9e-ee8a-4448-b6c3-06d8e48914d7",
"userAgent": "aws-sdk-java/2.46.19 md/io#sync md/http#Apache5 ua/2.1 api/Resource_Groups_Tagging_API#2.46.x os/Linux#6.1.175-219.359.amzn2023.x86_64 lang/java#25.0.3 md/OpenJDK_64-Bit_Server_VM#25.0.3+9-LTS md/vendor#Eclipse_Adoptium md/en_US m/D,AJ,h,k",
"tlsDetails": {
"clientProvidedHostHeader": "example.us-east-2.amazonaws.com"
}
}
GetTagKeys
#Description
GetTagKeys recorded by CloudTrail for AWS Resource Groups Tagging API. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.
Example CloudTrail Event #
{
"awsRegion": "ap-southeast-2",
"errorCode": "AccessDenied",
"errorMessage": "User: arn:aws:iam::731544447609:user/cloudsploit is not authorized to perform: tag:GetTagKeys",
"eventCategory": "Management",
"eventID": "1a7b9a45-7685-4db6-afe9-b121513c7d29",
"eventName": "GetTagKeys",
"eventSource": "tagging.amazonaws.com",
"eventTime": "2021-04-13T11:35:33Z",
"eventType": "AwsApiCall",
"eventVersion": "1.08",
"managementEvent": true,
"readOnly": true,
"recipientAccountId": "731544447609",
"requestID": "fd6d2df8-0e76-4510-87d8-e2818b505270",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "34.12.134.20",
"userAgent": "aws-sdk-nodejs/2.885.0 linux/v14.16.1 callback",
"userIdentity": {
"accessKeyId": "AKIAYTOGP2RLGBSBSMH2",
"accountId": "731544447609",
"arn": "arn:aws:iam::731544447609:user/cloudsploit",
"principalId": "AIDAYTOGP2RLMDEPWZWMJ",
"type": "IAMUser",
"userName": "cloudsploit"
}
}
References #
TagResources
#Description
TagResources recorded by CloudTrail for AWS Resource Groups Tagging API. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.
Example CloudTrail Event #
This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.
{
"eventVersion": "1.11",
"eventID": "6f75bc66-3216-422f-aded-8b26d55c56aa",
"eventSource": "tagging.amazonaws.com",
"eventName": "TagResources",
"awsRegion": "us-east-1",
"eventType": "AwsApiCall",
"readOnly": false,
"managementEvent": true,
"requestID": "f250bb60-ab75-47b1-ad67-e562f14e01f6",
"userAgent": "c7n/0.9.51 md/Botocore#1.43.57 ua/2.1 os/linux#6.8.0-1060-aws md/arch#aarch64 lang/python#3.14.6 md/pyimpl#CPython m/b,Z,D cfg/retry-mode#legacy c7n/policy#flag-stale-log-group",
"tlsDetails": {
"clientProvidedHostHeader": "example.us-east-1.amazonaws.com"
}
}