Vendors / Amazon Web Services / CloudTrail / CloudTrail Delete Trail Event

Event type

CloudTrail Delete Trail Event

Management API call to delete a CloudTrail trail

AWS CloudTrail DeleteTrail management event

JSON 10 fields Low Generator

aws cloudtrail management delete audit compliance

Preview Sample View Schema

CLI Install

meltr templates install aws

Overview

What this event covers

Records when an AWS CloudTrail trail is deleted via the DeleteTrail API. The event is the native CloudTrail management record. DeleteTrail returns an empty body, so responseElements is null.

When generated

›When a user or service deletes a CloudTrail trail via AWS Console
›When DeleteTrail API is called programmatically
›During automated cleanup processes
›When trails are removed due to cost optimization

Security relevance

High

Compliance

SOC 2 PCI DSS HIPAA SOX FedRAMP

Frequency notes

Low frequency event - trail deletions are typically infrequent administrative actions

Resources

Docs and tools

CloudTrail record contents official DeleteTrail API official CloudTrail userIdentity element official AWS CloudTrail Console Web interface for managing CloudTrail trails and viewing events AWS CLI Command-line interface for AWS services including CloudTrail

Generation

Configuration

Base frequency: 5 events/hour
Time patterns: business_hours night_hours weekend
Business hours: 2.0x
Night hours: 0.3x
Weekend: 0.1x

Schema

Field definitions

Field reference for this event type — types, requirements, examples, and allowed values.

eventVersion

String Required

CloudTrail event format version

Source: 1.08 or 1.10, the versions in published DeleteTrail records. Both include eventCategory and tlsDetails.

Example 1.08

Values

1.08 DeleteTrail sample with TLSv1.2
1.10 DeleteTrail sample with TLSv1.3

userIdentity.principalId

String Required

Unique identifier for the principal

Source: IAM user is AIDA plus 17 characters. Assumed role is AROA plus 17 characters, a colon, and the session name.

Example AIDAYTOGP2RLEHRX5YWNV

eventName

String Required

The CloudTrail API operation name

Source: Static value

Example DeleteTrail

requestParameters.name

String Required

Name of the trail sent to DeleteTrail. The API also accepts a trail ARN. Published records use the trail name.

Source: Random selection from common trail names

Example redatomictesttrail

responseElements

Object Required

DeleteTrail returns HTTP 200 with an empty body, so this is null on success and on error.

Source: Static null

Example null

errorCode

String Optional

Error code when the delete fails

Source: Random selection when an error occurs

Example TrailNotFoundException

Values

TrailNotFoundException The named trail does not exist
InvalidTrailNameException The trail name is not valid
AccessDenied The caller is not allowed to delete the trail

awsRegion

String Required

Region where DeleteTrail was called. The call must be made in the trail home region.

Source: Random commercial region

Example us-west-2

sourceIPAddress

String Required

IP address of the API caller

Source: Public address. vpcEndpointId is omitted.

Example 192.184.242.57

tlsDetails

Object Optional

TLS details for a direct client call

Source: tlsVersion 1.2 uses an ECDHE-RSA cipher. tlsVersion 1.3 uses a TLS_AES cipher.

Example

{"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "cloudtrail.us-west-2.amazonaws.com"}

managementEvent

Boolean Required

DeleteTrail is a management event

Source: Static true

Example true