Example
You create an event selector for a trail and specify that you want write-only events.
The EC2 GetConsoleOutput
and RunInstances
API operations occur in your account.
CloudTrail evaluates whether the events match your event selectors.
The RunInstances
is a write-only event and it matches your event selector. The trail logs the event.
The GetConsoleOutput
is a read-only event but it doesn't match your event selector. The trail doesn't log the event.
The PutEventSelectors
operation must be called from the region in which the trail was created; otherwise, an InvalidHomeRegionException
is thrown.
You can configure up to five event selectors for each trail. For more information, see Configuring Event Selectors for Trails in the AWS CloudTrail User Guide.