AWS Transfer Family

eventName	Description	Sample	Rule
any	Catch-all entry for AWS Transfer Family rules that match the service but not a specific eventName.	N	N
CreateAccess	Used by administrators to choose which groups in the directory should have access to upload and download files over the enabled protocols using Transfer Family. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
CreateAgreement	Creates an agreement. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
CreateConnector	Creates the connector, which captures the parameters for a connection for the AS2 or SFTP protocol. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
CreateProfile	Creates the local or partner profile to use for AS2 transfers. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
CreateServer	Instantiates an auto-scaling virtual server based on the selected file transfer protocol in Amazon Web Services.	Y	N
CreateUser	Creates a user and associates them with an existing file transfer protocol-enabled server.	Y	N
CreateWebApp	Creates a web app based on specified parameters, and returns the ID for the new web app. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
CreateWorkflow	Allows you to create a workflow with specified steps and step details the workflow invokes after file transfer completes. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
DeleteAccess	Allows you to delete the access specified in the ServerID and ExternalID parameters. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
DeleteAgreement	Delete the agreement that's specified in the provided AgreementId. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
DeleteCertificate	Deletes the certificate that's specified in the CertificateId parameter. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
DeleteConnector	Deletes the connector that's specified in the provided ConnectorId. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
DeleteHostKey	Deletes the host key that's specified in the HostKeyId parameter. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
DeleteProfile	Deletes the profile that's specified in the ProfileId parameter. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
DeleteServer	Deletes the file transfer protocol-enabled server that you specify. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
DeleteSshPublicKey	Deletes a user's Secure Shell (SSH) public key. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
DeleteUser	Deletes the user belonging to a file transfer protocol-enabled server you specify. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
DeleteWebApp	Deletes the specified web app. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
DeleteWebAppCustomization	Deletes the WebAppCustomization object that corresponds to the web app ID specified. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
DeleteWorkflow	Deletes the specified workflow. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
DescribeAccess	Describes the access that is assigned to the specific file transfer protocol-enabled server, as identified by its ServerId property and its ExternalId. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
DescribeAgreement	Describes the agreement that's identified by the AgreementId. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
DescribeCertificate	Describes the certificate that's identified by the CertificateId. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
DescribeConnector	Describes the connector that's identified by the ConnectorId. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
DescribeExecution	You can use DescribeExecution to check the details of the execution of the specified workflow. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
DescribeHostKey	Returns the details of the host key that's specified by the HostKeyId and ServerId. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record.	N	N
DescribeProfile	Returns the details of the profile that's specified by the ProfileId. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
DescribeSecurityPolicy	Describes the security policy that is attached to your server or SFTP connector. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record.	N	N
DescribeServer	Describes a file transfer protocol-enabled server that you specify by passing the ServerId parameter. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record.	N	N
DescribeUser	Describes the user assigned to the specific file transfer protocol-enabled server, as identified by its ServerId property. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
DescribeWebApp	Describes the web app that's identified by WebAppId. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
DescribeWebAppCustomization	Describes the web app customization object that's identified by WebAppId. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
DescribeWorkflow	Describes the specified workflow. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
ImportCertificate	Imports the signing and encryption certificates that you need to create local (AS2) profiles and partner profiles. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
ImportHostKey	Adds a host key to the server that's specified by the ServerId parameter. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
ImportSshPublicKey	Adds a Secure Shell (SSH) public key to a Transfer Family user identified by a UserName value assigned to the specific file transfer protocol-enabled server, identified by ServerId. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
ListAccesses	Lists the details for all the accesses you have on your server. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
ListAgreements	Returns a list of the agreements for the server that's identified by the ServerId that you supply. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record.	N	N
ListCertificates	Returns a list of the current certificates that have been imported into Transfer Family. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
ListConnectors	Lists the connectors for the specified Region. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
ListExecutions	Lists all in-progress executions for the specified workflow. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
ListFileTransferResults	Returns real-time updates and detailed information on the status of each individual file being transferred in a specific file transfer operation. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
ListHostKeys	Returns a list of host keys for the server that's specified by the ServerId parameter. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record.	N	N
ListProfiles	Returns a list of the profiles for your system. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
ListSecurityPolicies	Lists the security policies that are attached to your servers and SFTP connectors. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
ListServers	Lists the file transfer protocol-enabled servers that are associated with your Amazon Web Services account.	Y	N
ListTagsForResource	Lists all of the tags associated with the Amazon Resource Name (ARN) that you specify. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
ListUsers	Lists the users for a file transfer protocol-enabled server that you specify by passing the ServerId parameter. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
ListWebApps	Lists all web apps associated with your Amazon Web Services account for your current region. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record.	N	N
ListWorkflows	Lists all workflows associated with your Amazon Web Services account for your current region. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record.	N	N
SendWorkflowStepState	Sends a callback for asynchronous custom steps. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
StartDirectoryListing	Retrieves a list of the contents of a directory from a remote SFTP server. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
StartFileTransfer	Begins a file transfer between local Amazon Web Services storage and a remote AS2 or SFTP server. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
StartRemoteDelete	Deletes a file or directory on the remote SFTP server. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
StartRemoteMove	Moves or renames a file or directory on the remote SFTP server. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
StartServer	Changes the state of a file transfer protocol-enabled server from OFFLINE to ONLINE. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
StopServer	Changes the state of a file transfer protocol-enabled server from ONLINE to OFFLINE. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
TagResource	Attaches a key-value pair to a resource, as identified by its Amazon Resource Name (ARN). Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
TestConnection	Tests whether your SFTP connector is set up successfully. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
TestIdentityProvider	If the IdentityProviderType of a file transfer protocol-enabled server is AWS_DIRECTORY_SERVICE or API_Gateway, tests whether your identity provider is set up successfully. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
UntagResource	Detaches a key-value pair from a resource, as identified by its Amazon Resource Name (ARN). Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
UpdateAccess	Allows you to update parameters for the access specified in the ServerID and ExternalID parameters. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
UpdateAgreement	Updates some of the parameters for an existing agreement. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
UpdateCertificate	Updates the active and inactive dates for a certificate. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
UpdateConnector	Updates some of the parameters for an existing connector. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
UpdateHostKey	Updates the description for the host key that's specified by the ServerId and HostKeyId parameters. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
UpdateProfile	Updates some of the parameters for an existing profile. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
UpdateServer	Updates the file transfer protocol-enabled server's properties after that server has been created. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
UpdateUser	Assigns new properties to a user. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
UpdateWebApp	Assigns new properties to a web app. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
UpdateWebAppCustomization	Assigns new customization properties to a web app. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N

any: AWS Transfer Family (catch-all)

Service: transfer

Description

Catch-all entry for AWS Transfer Family rules that match the service but not a specific eventName.

CreateAccess

Service: transfer

Description

Used by administrators to choose which groups in the directory should have access to upload and download files over the enabled protocols using Transfer Family. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

CreateAgreement

Service: transfer

Description

Creates an agreement. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

CreateConnector

Service: transfer

Description

Creates the connector, which captures the parameters for a connection for the AS2 or SFTP protocol. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

CreateProfile

Service: transfer

Description

Creates the local or partner profile to use for AS2 transfers. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

CreateServer

Service: transfer

Description

Instantiates an auto-scaling virtual server based on the selected file transfer protocol in Amazon Web Services.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::123456789012:user/TrailDiscover is not authorized to perform: transfer:CreateServer on resource: arn:aws:transfer:us-east-1:192374575148:server/* because no identity-based policy allows the transfer:CreateServer action",
  "eventCategory": "Management",
  "eventID": "b9c1c5d3-0e4b-435b-8bb6-41f4b80c0153",
  "eventName": "CreateServer",
  "eventSource": "transfer.amazonaws.com",
  "eventTime": "2024-08-18T12:37:12Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.09",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "5d98a82d-6013-48bd-ad1b-8f06c04b67b6",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "0.0.0.0",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "transfer.us-east-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "aws-cli/2.17.32 md/awscrt#0.21.2 ua/2.0 os/linux#0.0.0.0-microsoft-standard-WSL2 md/arch#x86_64 lang/python#3.11.9 md/pyimpl#CPython exec-env/grimoire_f5f74818-3600-483a-9fea-ac8f8fec662e cfg/retry-mode#standard md/installer#exe md/distrib#ubuntu.24 md/prompt#off md/command#transfer.create-server",
  "userIdentity": {
    "accessKeyId": "AKIA****************",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/TrailDiscover",
    "principalId": "AROA****************:User",
    "type": "IAMUser",
    "userName": "TrailDiscover"
  }
}

References #

Sample log: TrailDiscover (CC-BY-4.0)

CreateUser

Service: transfer

Description

Creates a user and associates them with an existing file transfer protocol-enabled server.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "AccessDenied",
  "errorMessage": "Cross-account pass role is not allowed.",
  "eventCategory": "Management",
  "eventID": "6767a11f-587b-4e37-ad22-084ac0fee82f",
  "eventName": "CreateUser",
  "eventSource": "transfer.amazonaws.com",
  "eventTime": "2024-08-18T12:36:33Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.09",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "0292344a-9064-4632-bf0e-9228ee74fbd6",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "0.0.0.0",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "transfer.us-east-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "aws-cli/2.17.32 md/awscrt#0.21.2 ua/2.0 os/linux#0.0.0.0-microsoft-standard-WSL2 md/arch#x86_64 lang/python#3.11.9 md/pyimpl#CPython exec-env/grimoire_be81702c-81d3-448a-bf0f-86c39d6fef99 cfg/retry-mode#standard md/installer#exe md/distrib#ubuntu.24 md/prompt#off md/command#transfer.create-user",
  "userIdentity": {
    "accessKeyId": "AKIA****************",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/TrailDiscover",
    "principalId": "AROA****************:User",
    "type": "IAMUser",
    "userName": "TrailDiscover"
  }
}

References #

Sample log: TrailDiscover (CC-BY-4.0)

CreateWebApp

Service: transfer

Description

Creates a web app based on specified parameters, and returns the ID for the new web app. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

CreateWorkflow

Service: transfer

Description

Allows you to create a workflow with specified steps and step details the workflow invokes after file transfer completes. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

DeleteAccess

Service: transfer

Description

Allows you to delete the access specified in the ServerID and ExternalID parameters. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

DeleteAgreement

Service: transfer

Description

Delete the agreement that's specified in the provided AgreementId. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

DeleteCertificate

Service: transfer

Description

Deletes the certificate that's specified in the CertificateId parameter. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

DeleteConnector

Service: transfer

Description

Deletes the connector that's specified in the provided ConnectorId. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

DeleteHostKey

Service: transfer

Description

Deletes the host key that's specified in the HostKeyId parameter. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

DeleteProfile

Service: transfer

Description

Deletes the profile that's specified in the ProfileId parameter. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

DeleteServer

Service: transfer

Description

Deletes the file transfer protocol-enabled server that you specify. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

DeleteSshPublicKey

Service: transfer

Description

Deletes a user's Secure Shell (SSH) public key. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

DeleteUser

Service: transfer

Description

Deletes the user belonging to a file transfer protocol-enabled server you specify. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

DeleteWebApp

Service: transfer

Description

Deletes the specified web app. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

DeleteWebAppCustomization

Service: transfer

Description

Deletes the WebAppCustomization object that corresponds to the web app ID specified. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

DeleteWorkflow

Service: transfer

Description

Deletes the specified workflow. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

DescribeAccess

Service: transfer

Description

Describes the access that is assigned to the specific file transfer protocol-enabled server, as identified by its ServerId property and its ExternalId. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

DescribeAgreement

Service: transfer

Description

Describes the agreement that's identified by the AgreementId. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

DescribeCertificate

Service: transfer

Description

Describes the certificate that's identified by the CertificateId. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

DescribeConnector

Service: transfer

Description

Describes the connector that's identified by the ConnectorId. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

DescribeExecution

Service: transfer

Description

You can use DescribeExecution to check the details of the execution of the specified workflow. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

DescribeHostKey

Service: transfer

Description

Returns the details of the host key that's specified by the HostKeyId and ServerId. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record.

Example CloudTrail Event #

This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.

{
  "eventVersion": "1.11",
  "eventID": "3abe7724-5936-4a5b-aa46-3df6ff248e4d",
  "eventSource": "transfer.amazonaws.com",
  "eventName": "DescribeHostKey",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "d2e5d9a7-5ec5-411e-bb44-30225d0e80b2",
  "userAgent": "Botocore/1.35.95 ua/2.0 os/linux#5.10.245-245.983.amzn2.x86_64 md/arch#x86_64 lang/python#3.9.23 md/pyimpl#CPython cfg/retry-mode#standard",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "transfer.us-east-1.amazonaws.com"
  }
}

DescribeProfile

Service: transfer

Description

Returns the details of the profile that's specified by the ProfileId. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

DescribeSecurityPolicy

Service: transfer

Description

Describes the security policy that is attached to your server or SFTP connector. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "6949a425-3620-497f-a8c0-62a38f0a0ee4",
  "eventSource": "transfer.amazonaws.com",
  "eventName": "DescribeSecurityPolicy",
  "awsRegion": "eu-west-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "7e29e1f2-f4b4-42dc-a9f5-c3409fa12dae",
  "userAgent": "Botocore/1.35.95 ua/2.0 os/linux#5.10.245-245.983.amzn2.x86_64 md/arch#x86_64 lang/python#3.9.23 md/pyimpl#CPython cfg/retry-mode#standard",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "transfer.eu-west-1.amazonaws.com"
  }
}

DescribeServer

Service: transfer

Description

Describes a file transfer protocol-enabled server that you specify by passing the ServerId parameter. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "4289ad8b-9665-4346-95b7-3b465bc63107",
  "eventSource": "transfer.amazonaws.com",
  "eventName": "DescribeServer",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "64f8fdea-89e3-4c9c-b0c7-0b36a4d0335f",
  "userAgent": "Botocore/1.35.95 ua/2.0 os/linux#5.10.245-245.983.amzn2.x86_64 md/arch#x86_64 lang/python#3.9.23 md/pyimpl#CPython cfg/retry-mode#standard",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "transfer.us-east-1.amazonaws.com"
  }
}

DescribeUser

Service: transfer

Description

Describes the user assigned to the specific file transfer protocol-enabled server, as identified by its ServerId property. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

DescribeWebApp

Service: transfer

Description

Describes the web app that's identified by WebAppId. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

DescribeWebAppCustomization

Service: transfer

Description

Describes the web app customization object that's identified by WebAppId. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

DescribeWorkflow

Service: transfer

Description

Describes the specified workflow. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

ImportCertificate

Service: transfer

Description

Imports the signing and encryption certificates that you need to create local (AS2) profiles and partner profiles. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

ImportHostKey

Service: transfer

Description

Adds a host key to the server that's specified by the ServerId parameter. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

ImportSshPublicKey

Service: transfer

Description

Adds a Secure Shell (SSH) public key to a Transfer Family user identified by a UserName value assigned to the specific file transfer protocol-enabled server, identified by ServerId. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

ListAccesses

Service: transfer

Description

Lists the details for all the accesses you have on your server. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

ListAgreements

Service: transfer

Description

Returns a list of the agreements for the server that's identified by the ServerId that you supply. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "30bbb304-9c1e-443f-af89-1426559930d8",
  "eventSource": "transfer.amazonaws.com",
  "eventName": "ListAgreements",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "74603067-ab4f-4f2d-85a9-176a313d1bbf",
  "userAgent": "Botocore/1.35.95 ua/2.0 os/linux#5.10.245-245.983.amzn2.x86_64 md/arch#x86_64 lang/python#3.9.23 md/pyimpl#CPython cfg/retry-mode#standard",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "transfer.us-east-1.amazonaws.com"
  }
}

ListCertificates

Service: transfer

Description

Returns a list of the current certificates that have been imported into Transfer Family. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

ListConnectors

Service: transfer

Description

Lists the connectors for the specified Region. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

ListExecutions

Service: transfer

Description

Lists all in-progress executions for the specified workflow. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

ListFileTransferResults

Service: transfer

Description

Returns real-time updates and detailed information on the status of each individual file being transferred in a specific file transfer operation. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

ListHostKeys

Service: transfer

Description

Returns a list of host keys for the server that's specified by the ServerId parameter. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "9fe5db56-13a9-4e34-8a79-e8faf356f272",
  "eventSource": "transfer.amazonaws.com",
  "eventName": "ListHostKeys",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "c8ee948a-e3ec-4c15-b197-c0d9dd8da534",
  "userAgent": "Botocore/1.35.95 ua/2.0 os/linux#5.10.245-245.983.amzn2.x86_64 md/arch#x86_64 lang/python#3.9.23 md/pyimpl#CPython cfg/retry-mode#standard",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "transfer.us-east-1.amazonaws.com"
  }
}

ListProfiles

Service: transfer

Description

Returns a list of the profiles for your system. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

ListSecurityPolicies

Service: transfer

Description

Lists the security policies that are attached to your servers and SFTP connectors. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

ListServers

Service: transfer

Description

Lists the file transfer protocol-enabled servers that are associated with your Amazon Web Services account.

Example CloudTrail Event #

{
  "awsRegion": "eu-west-3",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::731544447609:user/cloudsploit is not authorized to perform: transfer:ListServers on resource: arn:aws:transfer:eu-west-3:731544447609:server/*",
  "eventCategory": "Management",
  "eventID": "f5b1b117-c326-4e26-bedc-3fed33902e00",
  "eventName": "ListServers",
  "eventSource": "transfer.amazonaws.com",
  "eventTime": "2021-04-13T11:35:43Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "731544447609",
  "requestID": "0755b642-ec9c-4716-899d-94423c062080",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "34.12.134.20",
  "userAgent": "aws-sdk-nodejs/2.885.0 linux/v14.16.1 callback",
  "userIdentity": {
    "accessKeyId": "AKIAYTOGP2RLGBSBSMH2",
    "accountId": "731544447609",
    "arn": "arn:aws:iam::731544447609:user/cloudsploit",
    "principalId": "AIDAYTOGP2RLMDEPWZWMJ",
    "type": "IAMUser",
    "userName": "cloudsploit"
  }
}

References #

Sample log: splunk/attack_data

ListTagsForResource

Service: transfer

Description

Lists all of the tags associated with the Amazon Resource Name (ARN) that you specify. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

ListUsers

Service: transfer

Description

Lists the users for a file transfer protocol-enabled server that you specify by passing the ServerId parameter. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

ListWebApps

Service: transfer

Description

Lists all web apps associated with your Amazon Web Services account for your current region. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "cacbd14a-8555-40c6-9fa2-cc8a96c115c5",
  "eventSource": "transfer.amazonaws.com",
  "eventName": "ListWebApps",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "603a1f0b-b6f4-4ced-808c-ef5ffb2ee30a",
  "userAgent": "Botocore/1.35.95 ua/2.0 os/linux#5.10.245-245.983.amzn2.x86_64 md/arch#x86_64 lang/python#3.9.23 md/pyimpl#CPython cfg/retry-mode#standard",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "transfer.us-east-1.amazonaws.com"
  }
}

ListWorkflows

Service: transfer

Description

Lists all workflows associated with your Amazon Web Services account for your current region. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "4655a55c-517f-4579-8e14-4ffb70a58681",
  "eventSource": "transfer.amazonaws.com",
  "eventName": "ListWorkflows",
  "awsRegion": "us-west-2",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "7cd3b99e-afe8-4659-afac-1a584b601985",
  "userAgent": "Botocore/1.35.95 ua/2.0 os/linux#5.10.245-245.983.amzn2.x86_64 md/arch#x86_64 lang/python#3.9.23 md/pyimpl#CPython cfg/retry-mode#standard",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "transfer.us-west-2.amazonaws.com"
  }
}

SendWorkflowStepState

Service: transfer

Description

Sends a callback for asynchronous custom steps. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

StartDirectoryListing

Service: transfer

Description

Retrieves a list of the contents of a directory from a remote SFTP server. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

StartFileTransfer

Service: transfer

Description

Begins a file transfer between local Amazon Web Services storage and a remote AS2 or SFTP server. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

StartRemoteDelete

Service: transfer

Description

Deletes a file or directory on the remote SFTP server. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

StartRemoteMove

Service: transfer

Description

Moves or renames a file or directory on the remote SFTP server. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

StartServer

Service: transfer

Description

Changes the state of a file transfer protocol-enabled server from OFFLINE to ONLINE. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

StopServer

Service: transfer

Description

Changes the state of a file transfer protocol-enabled server from ONLINE to OFFLINE. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

TagResource

Service: transfer

Description

Attaches a key-value pair to a resource, as identified by its Amazon Resource Name (ARN). Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

TestConnection

Service: transfer

Description

Tests whether your SFTP connector is set up successfully. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

TestIdentityProvider

Service: transfer

Description

If the IdentityProviderType of a file transfer protocol-enabled server is AWS_DIRECTORY_SERVICE or API_Gateway, tests whether your identity provider is set up successfully. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

UntagResource

Service: transfer

Description

Detaches a key-value pair from a resource, as identified by its Amazon Resource Name (ARN). Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

UpdateAccess

Service: transfer

Description

Allows you to update parameters for the access specified in the ServerID and ExternalID parameters. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

UpdateAgreement

Service: transfer

Description

Updates some of the parameters for an existing agreement. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

UpdateCertificate

Service: transfer

Description

Updates the active and inactive dates for a certificate. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

UpdateConnector

Service: transfer

Description

Updates some of the parameters for an existing connector. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

UpdateHostKey

Service: transfer

Description

Updates the description for the host key that's specified by the ServerId and HostKeyId parameters. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

UpdateProfile

Service: transfer

Description

Updates some of the parameters for an existing profile. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

UpdateServer

Service: transfer

Description

Updates the file transfer protocol-enabled server's properties after that server has been created. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

UpdateUser

Service: transfer

Description

Assigns new properties to a user. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

UpdateWebApp

Service: transfer

Description

Assigns new properties to a web app. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

UpdateWebAppCustomization

Service: transfer

Description

Assigns new customization properties to a web app. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.