AWS user-subscriptions

eventName	Description	Sample	Rule
any	Catch-all entry for AWS user-subscriptions rules that match the service but not a specific eventName.	N	N
CreateClaim	CreateClaim recorded by CloudTrail for AWS user-subscriptions. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.	N	N
ListApplicationClaims	ListApplicationClaims recorded by CloudTrail for AWS user-subscriptions. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.	N	N
ListUserSubscriptions	ListUserSubscriptions recorded by CloudTrail for AWS user-subscriptions. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.	N	N

any: AWS user-subscriptions (catch-all)

#

Service: user-subscriptions

Description

Catch-all entry for AWS user-subscriptions rules that match the service but not a specific eventName.

CreateClaim

#

Service: user-subscriptions

Description

CreateClaim recorded by CloudTrail for AWS user-subscriptions. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.

Example CloudTrail Event #

This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.

{
  "eventVersion": "1.11",
  "eventID": "61b30cb1-9f19-4f48-b7e1-f0796eaee436",
  "eventSource": "user-subscriptions.amazonaws.com",
  "eventName": "CreateClaim",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "readOnly": false,
  "managementEvent": true,
  "requestID": "0221c719-7b47-4428-8bb8-b7d4ccec093d",
  "userAgent": "q.amazonaws.com"
}

ListApplicationClaims

#

Service: user-subscriptions

Description

ListApplicationClaims recorded by CloudTrail for AWS user-subscriptions. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.

Example CloudTrail Event #

This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.

{
  "eventVersion": "1.11",
  "eventID": "8063db9e-1243-4628-b66e-c72cb40ffe51",
  "eventSource": "user-subscriptions.amazonaws.com",
  "eventName": "ListApplicationClaims",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "998e1592-8c3b-4a7b-94e8-913dc70120b8",
  "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:153.0) Gecko/20100101 Firefox/153.0",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "example.us-east-1.amazonaws.com"
  }
}

ListUserSubscriptions

#

Service: user-subscriptions

Description

ListUserSubscriptions recorded by CloudTrail for AWS user-subscriptions. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.

Example CloudTrail Event #

This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.

{
  "eventVersion": "1.11",
  "eventID": "e9a63290-0b8f-49d2-94eb-eaf2dd5be9b0",
  "eventSource": "user-subscriptions.amazonaws.com",
  "eventName": "ListUserSubscriptions",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "7fe4bc56-1db1-4d5f-983f-294381044332",
  "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:153.0) Gecko/20100101 Firefox/153.0",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "example.us-east-1.amazonaws.com"
  }
}