MELTr
Home Vendors Search Download
Login
Vendors / Amazon Web Services / CloudTrail / EC2 Create Snapshot
Amazon Web Services logo

Event type

EC2 Create Snapshot

EBS volume snapshot creation event

AWS EC2 CreateSnapshot API call for creating EBS volume snapshots

JSON 14 fields High Generator

aws ec2 ebs snapshot backup data-protection
Preview Sample View Schema
CLI Install
meltr templates install aws

Overview

What this event covers

Records when AWS EC2 EBS volume snapshots are created via the CreateSnapshot API. Snapshots are point-in-time copies of EBS volumes used for backup, disaster recovery, and data migration.

When generated

  • ›During automated backup processes (typically nights/weekends)
  • ›Before major system updates or deployments
  • ›For disaster recovery preparation
  • ›When migrating data between regions or accounts
  • ›During security testing (red team activities)
  • ›For development environment provisioning
  • ›Before risky maintenance operations

Security relevance

Medium

Compliance

SOC 2 PCI DSS HIPAA GDPR SOX ISO 27001

Frequency notes

High frequency - automated backup systems create many snapshots, especially during off-hours

Resources

Docs and tools

CloudTrail record contents official CloudTrail userIdentity element official AWS EC2 CreateSnapshot API Reference official EBS Snapshot Best Practices official EBS Snapshot Encryption official AWS EC2 Console Web interface for managing EC2 instances and EBS resources AWS CLI EC2 Commands Command-line interface for EC2 snapshot operations AWS Backup Centralized backup service for AWS resources

Generation

Configuration

Base frequency
45 events/hour
Time patterns
business_hours night_hours weekend
Business hours
1.5x
Night hours
2.0x
Weekend
1.2x

Schema

Field definitions

Field reference for this event type — types, requirements, examples, and allowed values.

requestParameters.volumeId
String Required

ID of the EBS volume being snapshotted

Source: Generated with proper vol- prefix

Format vol-[17 character hex string]
Example vol-0363e53e12f67c9b7
responseElements.snapshotId
String Optional

ID of the created snapshot (on success)

Source: Generated with proper snap- prefix

Format snap-[17 character hex string]
Example snap-02effb3bb62786b18
responseElements.status
String Optional

Initial status of the snapshot

Source: Static value (always pending for new snapshots)

Example pending
responseElements.volumeSize
String Optional

Size of the volume in GB

Source: Random selection from common EBS sizes

Example 100
Values
  • 1 Minimum EBS volume size (testing)
  • 8 Default EC2 instance root volume
  • 100 Common application volume size
  • 500 Large application volume
  • 1000 Database or large storage volume
responseElements.encrypted
Boolean Optional

Whether the snapshot is encrypted. Encrypted snapshots include responseElements.kmsKeyId.

Source: Random boolean (encryption adoption varies)

Example true
requestParameters.tagSpecificationSet
Object Optional

Tags to apply to the created snapshot

Source: Random selection from common tagging patterns

Example {"items": [{"resourceType": "snapshot", "tags": [{"key": "Environment", "value": "prod"}]}]}
errorCode
String Optional

Error code when snapshot creation fails

Source: Random selection when error occurs (1 in 8 chance)

Example Client.InvalidVolume.NotFound
Values
  • Client.InvalidVolume.NotFound Volume does not exist
  • Client.IncorrectState Volume not in snapshotable state
  • Client.UnauthorizedOperation Insufficient permissions
userAgent
String Required

Client application used for the API call

Source: Random selection from realistic EC2 user agents

Example APN/1.0 HashiCorp/1.0 Terraform/1.1.2
Values
  • terraform-provider-aws/* Infrastructure as Code deployments
  • aws-cli/* Command line automation
  • console.ec2.amazonaws.com Manual AWS Console operations
  • aws-sdk-python/* Python automation scripts
  • stratus-red-team_* Security testing tool
eventTime
String Required

UTC time the API call completed

Source: current_timestamp() as UTC

Format yyyy-MM-ddTHH:mm:ssZ
Example 2023-03-20T22:31:18Z
responseElements.startTime
Integer Optional

Snapshot start time as Unix epoch milliseconds

Source: eventTime converted to epoch milliseconds

Format Unix timestamp in milliseconds
Example 1679351478226
userIdentity.principalId
String Required

IAM unique id. AssumedRole values are the role id, a colon, and the session name.

Source: AIDA or AROA prefix plus 17 characters. AssumedRole appends the session name.

Example AROAIDPPEZS35WEXAMPLE:mwaddams@initech.com
awsRegion
String Required

AWS region where the snapshot was created

Source: Random selection from common AWS regions

Example us-west-2
userIdentity.type
String Required

Type of AWS identity creating the snapshot

Source: Random selection (IAMUser vs AssumedRole)

Example AssumedRole
Values
  • IAMUser Direct IAM user (often service accounts)
  • AssumedRole Role assumption (federated or automation)
tlsDetails
Object Optional

TLS connection details for the service API call

Source: tlsVersion 1.2 uses an ECDHE-RSA cipher. tlsVersion 1.3 uses a TLS_AES cipher.

Example {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256"}