Top 500 values of event.action Count of records
InvokeExecution 5,076,546
Invoke 3,310,482
AssumeRole 1,505,236
AssumeRoleWithWebIdentity 1,227,378
GenerateDataKey 731,113
PutObject 414,918
Decrypt 287,670
Encrypt 105,060
GetBucketAcl 31,795
GetUser 7,424
HeadBucket 3,437
CreateLogStream 1,962
RetireGrant 1,369
UploadPart 1,198
GetObject 736
InitiateAuth 546
GetFunctionConfiguration20150331v2 360
DescribeKey 311
CompleteMultipartUpload 275
CreateMultipartUpload 275
CopyObject 146
AssumeRoleWithSAML 126
GenerateDataKeyWithoutPlaintext 101
BatchGetImage 69
CreateGrant 67
RespondToAuthChallenge 56
ReEncrypt 9
GetBucketLocation 1
Sample data available on request.
We are seeing reports that several CloudTrail event types are not mapping the
cloud.account.idfield fromaws.cloudtrail.recipient_account_id.One customer report displays the following counts of
event.actionwith the filternot cloud.account.id:*Sample data available on request.