aws-cloudtrail-event-request-response-payload
CloudTrail preserves service request and response fields as JSON; services redact known secret fields, but arbitrary parameters, tags, URLs, and custom payloads can still leak sensitive data.
Where it sits
location LookupEvents.Events[].CloudTrailEvent (requestParameters / responseElements / additionalEventData)location kind log_fielddata kinds credential password api_key bearer_token session_token pii sensitive_data emits edge CanReadDataservice CloudTrail (aws:cloudtrail)
Collection recipe
access mode read_apioperation LookupEventsresponse path Events[].CloudTrailEventencoding jsonparams {"LookupAttributes": [{"AttributeKey": "EventName", "AttributeValue": "\u003cevent-name\u003e"}]}
Required permissions
cloudtrail:LookupEvents
Copy
References