AWS Resource and Action References
This catalog groups authored AWS rule references by resource type and action. It does not identify deployed resources or establish that a matching event was observed.
For an event-first view, see AWS coverage. These rules have retained AWS conditions that do not identify a resource and action reference here.Resource types and actions
account.amazonaws.com
Other resource references
EnableRegionAmazon EC2
EC2 security group
AuthorizeSecurityGroupEgressRevokeSecurityGroupEgressRevokeSecurityGroupIngressOther resource references
CreateInstanceExportTaskCreateNetworkAclCreateRouteTableCreateSecurityGroupCreateStoreImageTaskCreateTrafficMirrorSessionDeleteFlowLogsDeleteNetworkAclDeleteNetworkAclEntryDeleteRouteDeleteRouteTableDescribeImagesDescribeInstanceAttributeDisableEbsEncryptionByDefaultDisassociateRouteTableEnableSerialConsoleAccessExportImageImportKeyPairModifyImageAttributeModifyInstanceAttributeModifySecurityGroupRulesModifySnapshotAttributeReplaceNetworkAclEntryReplaceRouteReplaceRouteTableAssociationAmazon S3
Other resource references
(operation unconstrained)DeleteBucketCorsDeleteBucketEncryptionDeleteBucketLifecycleDeleteBucketPolicyDeleteBucketReplicationListBucketsPutBucketLoggingPutBucketReplicationPutBucketVersioningPutBucketWebsitePutEncryptionConfigurationPutLifecycleConfigurationPutReplicationConfigurationReplicateObjectRestoreObjectS3 object
DeleteObjectAWS CloudTrail
CloudTrail trail
CreateTrailOther resource references
PutEventSelectorsAWS Identity and Access Management (IAM)
IAM access key
IAM inline policy
IAM managed policy
AttachRolePolicyIAM role
AttachRolePolicyOther resource references
(operation unconstrained)CreateGroupCreateOpenIDConnectProviderCreateSAMLProviderDeactivateMFADeviceDeleteAccountPasswordPolicyDeleteLoginProfileDeleteRolePermissionsBoundaryDeleteSAMLProviderDeleteUserPermissionsBoundaryGetAccountSummaryGetLoginProfileListAccountAliasesListRolesListUsersPutGroupPolicyPutRolePermissionsBoundaryPutUserPermissionsBoundaryUpdateAssumeRolePolicyUpdateSAMLProviderAWS Lambda
Lambda function
UpdateFunctionCode*Other resource references
CreateFunctionUrlConfigDeleteFunctionbackup.amazonaws.com
Other resource references
DeleteBackupVaultDeleteBackupVaultLockConfigurationDeleteRecoveryPointDescribeBackupJobDescribeRecoveryPointGetBackupPlanGetBackupVaultAccessPolicyListBackupJobsListBackupPlansListBackupVaultsListProtectedResourcesListRecoveryPointsByBackupVaultbatch.amazonaws.com
Other resource references
bedrock.amazonaws.com
Other resource references
AssociateAgentCollaboratorAssociateAgentKnowledgeBaseCreateAgentCreateAgentActionGroupCreateAgentAliasCreateCustomModelDeploymentCreateDataSourceCreateFoundationModelAgreementCreateMarketplaceModelEndpointCreateModelImportJobCreateProvisionedModelThroughputDeleteAutomatedReasoningPolicyDeleteDataSourceDeleteEnforcedGuardrailConfigurationDeleteKnowledgeBaseDocumentsDeleteModelInvocationLoggingConfigurationDeleteProvisionedModelThroughputIngestKnowledgeBaseDocumentsInvokeModelListFoundationModelsPrepareAgentPutEnforcedGuardrailConfigurationPutModelInvocationLoggingConfigurationRegisterMarketplaceModelEndpointStartIngestionJobUpdateAgentUpdateAgentActionGroupUpdateAgentAliasUpdateAgentCollaboratorUpdateAgentKnowledgeBaseUpdateAutomatedReasoningPolicyUpdateAutomatedReasoningPolicyAnnotationsUpdateDataSourceUpdateKnowledgeBaseUpdateProvisionedModelThroughputcloudformation.amazonaws.com
Other resource references
CreateStackCreateStackInstancescloudshell.amazonaws.com
Other resource references
CreateEnvironmentcognito-identity.amazonaws.com
Other resource references
GetCredentialsForIdentityconfig.amazonaws.com
Other resource references
DeleteConfigRuleDeleteConfigurationAggregatorDeleteConfigurationRecorderDeleteConformancePackDeleteDeliveryChannelDeleteOrganizationConfigRuleDeleteOrganizationConformancePackDeleteRemediationConfigurationDeleteRetentionConfigurationStopConfigurationRecorderdatasync.amazonaws.com
Other resource references
CreateTaskdetective.amazonaws.com
Other resource references
DeleteGraphdynamodb.amazonaws.com
Other resource references
ExportTableToPointInTimeec2-instance-connect.amazonaws.com
Other resource references
SendSerialConsoleSSHPublicKeySendSSHPublicKeyecr.amazonaws.com
Other resource references
ecs.amazonaws.com
Other resource references
DescribeTaskDefinitionRegisterTaskDefinitioneks.amazonaws.com
Other resource references
AssociateAccessPolicyCreateAccessEntryCreateClusterDeleteAccessEntryDeleteClusterDisassociateAccessPolicyUpdateAccessEntryUpdateClusterConfigelasticache.amazonaws.com
Other resource references
CreateCacheSecurityGroupelasticfilesystem.amazonaws.com
Other resource references
DeleteFileSystemDeleteMountTargetelasticloadbalancing.amazonaws.com
Other resource references
ApplySecurityGroupsToLoadBalancerSetSecurityGroupsevents.amazonaws.com
Other resource references
DeleteRuleDisableRuleglue.amazonaws.com
Other resource references
CreateDevEndpointDeleteDevEndpointUpdateDevEndpointguardduty.amazonaws.com
Other resource references
CreateThreatIntelSetDeleteInvitationsDeleteMembersDeletePublishingDestinationDeleteThreatIntelSetDisassociateFromAdministratorAccountDisassociateMembersStopMonitoringMembersUpdateDetectorUpdateIPSetUpdateThreatIntelSetkms.amazonaws.com
Other resource references
DeleteImportedKeyMaterialImportKeyMaterialPutKeyPolicyScheduleKeyDeletionlogs.amazonaws.com
Other resource references
DeleteLogStreammonitoring.amazonaws.com
Other resource references
DeleteAlarmsorganizations.amazonaws.com
Other resource references
LeaveOrganizationRegisterDelegatedAdministratorrds.amazonaws.com
Other resource references
AuthorizeDBSecurityGroupIngressCreateDBClusterSnapshotCreateDBSecurityGroupCreateDBSnapshotDeleteDBInstanceDeleteDBSecurityGroupDeleteGlobalClusterModifyDBClusterRestoreDBInstanceFromDBSnapshotRestoreDBInstanceFromS3RevokeDBSecurityGroupIngressStartExportTaskrolesanywhere.amazonaws.com
Other resource references
CreateProfileroute53.amazonaws.com
Other resource references
AssociateVPCWithHostedZoneroute53domains.amazonaws.com
Other resource references
DisableDomainTransferLockTransferDomainToAnotherAwsAccountroute53resolver.amazonaws.com
Other resource references
DeleteResolverQueryLogConfigsecretsmanager.amazonaws.com
Other resource references
securityhub.amazonaws.com
Other resource references
BatchUpdateFindingsDeleteInsightDisableSecurityHubUpdateFindingsUpdateInsightservicequotas.amazonaws.com
Other resource references
RequestServiceQuotaIncreaseses.amazonaws.com
Other resource references
DeleteIdentityDescribeActiveReceiptRuleSetGetAccountSendingEnabledGetEmailIdentityGetSendQuotaListEmailIdentitiesListIdentitiesListReceiptRuleSetsPutAccountSendingAttributesUpdateAccountSendingEnabledsignin.amazonaws.com
Other resource references
ConsoleLoginPasswordRecoveryRequestedsns.amazonaws.com
Other resource references
CreateTopicsqs.amazonaws.com
Other resource references
PurgeQueuessm.amazonaws.com
Other resource references
CreateAssociationCreateDocumentDescribeInstancePatchesGetInventoryGetInventorySchemaListCommandsListInventoryEntriesStartSessionsts.amazonaws.com
Other resource references
AssumeRoleWithSAMLAssumeRoleWithWebIdentityGetSessionTokenOther rule references