MELTr
Home Vendors Search Download
Login
Vendors / Amazon Web Services / CloudTrail / IAM Delete Policy Event
Amazon Web Services logo

Event type

IAM Delete Policy Event

Management API call to delete an IAM policy

AWS IAM DeletePolicy API call event with error handling and identity type variations

JSON 12 fields Low Generator

aws iam policy delete security permissions
Preview Sample View Schema
CLI Install
meltr templates install aws

Overview

What this event covers

Records when an AWS IAM policy is deleted via the DeletePolicy API operation. This is a critical security event as it permanently removes permission definitions that may be attached to users, groups, or roles.

When generated

  • ›When an administrator deletes an IAM policy via AWS Console
  • ›When DeletePolicy API is called programmatically (CLI, SDK, Terraform)
  • ›During automated policy cleanup processes
  • ›When cleaning up test or temporary policies
  • ›During security incident response (removing compromised policies)

Security relevance

Critical

Compliance

SOC 2 PCI DSS HIPAA SOX ISO 27001 NIST

Frequency notes

Low frequency event - policy deletions are infrequent but critical administrative actions

Resources

Docs and tools

AWS IAM DeletePolicy API Reference official AWS CloudTrail Event Reference official IAM Policy Management Best Practices official AWS IAM Console Web interface for managing IAM policies, users, and roles AWS CLI IAM Commands Command-line interface for IAM operations IAM Policy Simulator Tool for testing and validating IAM policies

Generation

Configuration

Base frequency
3 events/hour
Time patterns
business_hours night_hours weekend
Business hours
3.0x
Night hours
0.2x
Weekend
0.1x

Schema

Field definitions

Field reference for this event type — types, requirements, examples, and allowed values.

eventVersion
String Required

CloudTrail event format version

Source: 1.08 or 1.09. Both include eventCategory.

Example 1.08
Values
  • 1.08 CloudTrail format that introduced tlsDetails
  • 1.09 CloudTrail format used by later DeletePolicy samples
userIdentity.type
String Required

Type of identity that made the API call

Source: Random selection between IAMUser and AssumedRole

Example AssumedRole
Values
  • IAMUser Direct IAM user authentication
  • AssumedRole Role-based authentication (federated or cross-account)
userIdentity.principalId
String Required

Unique identifier for the principal

Source: IAM user is AIDA plus 17 characters. Assumed role is AROA plus 17 characters, a colon, and the session name.

Example AIDACKCEVSQ6C2EXAMPLE
eventName
String Required

The IAM API operation name

Source: Static value

Example DeletePolicy
requestParameters.policyArn
String Required

ARN of the policy being deleted

Source: Constructed ARN with account ID and policy name

Example arn:aws:iam::123456789012:policy/AdminPolicy
errorCode
String Optional

Error code if the operation failed

Source: Random selection when error occurs

Example DeleteConflictException
Values
  • NoSuchEntityException Policy does not exist
  • DeleteConflictException Policy cannot be deleted due to dependencies
  • AccessDenied Insufficient permissions to delete policy
errorMessage
String Optional

Detailed error message when operation fails

Source: Conditional message based on error code

Example Cannot delete a policy attached to entities.
sourceIPAddress
String Required

IP address of the API caller

Source: Public address. vpcEndpointId is omitted.

Example 203.0.113.42
userAgent
String Required

User agent string indicating the client tool used

Source: Random selection from realistic AWS client user agents

Example aws-cli/2.0.62 Python/3.9.2 Darwin/19.6.0
Values
  • aws-cli/* AWS Command Line Interface
  • console.amazonaws.com AWS Management Console
  • aws-sdk-go/* AWS SDK for Go (often Terraform)
  • aws-sdk-python/* AWS SDK for Python (boto3)
userIdentity.sessionContext.attributes.mfaAuthenticated
String Optional

Whether the session used multi-factor authentication

Source: Random boolean as string

Example true
awsRegion
String Required

AWS region where the API call was made

Source: IAM is global, so CloudTrail records the event in us-east-1.

Example us-east-1
managementEvent
Boolean Required

Indicates this is a management plane event

Source: Static value (always true for IAM operations)

Example true