flosell/trailscraper

Document Unsupported Events

flosell opened this issue · 2 comments

flosell commented

CloudTrail Logs doesn't seem to show all events, e.g.

  • iam:PassRole
  • sts:AssumeRole
  • apigateway:POST on resource: arn:aws:apigateway:eu-central-1::/domainnames (probably fixed by #17)
  • ...

Verify that those reallly don't show up and document the result

Also, CloudTrail Event History (the API), seems to show only "create, modify, and delete API calls." (https://docs.aws.amazon.com/awscloudtrail/latest/userguide/view-cloudtrail-events-supported-services.html)

flosell commented

Some of those events might just have been in us-east-1, not in eu-central-1 where I looked

flosell commented

Mentioned events were either fixed or were there on closer look. Also, map_to_iam_sanity_test documents API calls that don't map to anything that we know.