Introduction
Hi, I'm miruky.
CloudTrail Event history provides a searchable record of recent management activity without requiring a trail. A deletion investigation can start with the API event name, time, Region, resource name, and the AWS principal or session shown in the User name field.
This controlled Console run creates and deletes one generated SQS queue, then correlates its management event in N. Virginia.
Event history covers the most recent 90 days of management events in one account and Region, and it accepts one lookup attribute plus a time range. Viewing and searching that history has no additional CloudTrail charge under the current pricing page.
1. Create one uniquely named queue
Open the English SQS Console in N. Virginia. CloudTrail Event history is Regional, so the test API call and the later lookup both stay in us-east-1.
The header shows United States (N. Virginia) while the English SQS Console is open.
Open Amazon SQS and search for miruky-qnehvscrnwilwtac. The full-name filter should return no existing queue before the run.
The search bar reports 0 matches, and the empty results area confirms that the generated queue is not already present.
Choose Create queue, keep Standard selected, and enter the generated name. Review the queue settings and create it without adding a consumer or resource policy.
The form pairs the exact generated name with the Standard queue type before creation.
Open the newly created queue. Its generated name is the correlation key used later in Event history.
The details view confirms the same generated name that will be used for CloudTrail correlation.
2. Produce one deletion management event
Choose Delete and follow the acknowledgement prompt for the generated queue. This action exists here to generate one known control-plane event, not as a general queue-management recommendation.
The dialog identifies only the owned validation queue, shows that it contains zero messages, and requires the explicit confirm acknowledgement before deletion.
After the Console returns to the queue list, filter by the full name again. A zero result establishes that the resource deletion completed before the audit search begins.
The repeated full-name search is the deletion-completion evidence: it reports 0 matches and returns no queue.
Record the visible completion time privately. Event history is an audit lookup, not the transactional confirmation of deletion, so use the SQS absence check for completion and refresh CloudTrail separately.
3. Narrow Event history to DeleteQueue
Open CloudTrail, choose Event history, and keep the Region at N. Virginia. Set a short relative time range that includes the queue deletion.
Choose Event name as the lookup attribute and enter DeleteQueue. Event history allows one attribute filter at a time, so the time range supplies the additional narrowing dimension.
The search is now constrained by Event name = DeleteQueue and the visible time range.
Refresh until the row associated with miruky-qnehvscrnwilwtac appears. Compare the event time, sqs.amazonaws.com source, and generated resource name with the queue action rather than selecting an older deletion only because its event name matches.
The single row aligns DeleteQueue, sqs.amazonaws.com, the event time, and the visible miruky-qnehvscrnwilw... resource prefix. I hid the User name column before retaining that image. The next detail crop preserves the complete generated name while masking its account-scoped URL segment.
4. Read the actor field without publishing it
Open the matched event. The cropped summary should preserve the event name, event time, event source, AWS Region, and generated resource reference.
The summary preserves the event name, time, source, Region, and generated resource while excluding actor fields and raw JSON.
On your own screen, read the User name value for the same row or event. CloudTrail documents that this field can identify a user, role name, or service role; it is not always a person's name.
The lookup menu also exposes User name as a filter. After you have copied the exact value within your protected investigation record, you can switch the single lookup attribute from Event name to User name to find other recent events for that principal or session.
The menu confirms that User name is available as the next lookup attribute without exposing its value.
If the value represents a federated or assumed-role session, CloudTrail identifies the AWS session, not necessarily the human behind it. Map that session to identity-provider, workforce sign-in, or session-tag records before assigning individual responsibility.
Wrap-up
The useful result was not DeleteQueue alone. The generated resource name, Regional event history, event time, service source, and principal or session field together narrowed the deletion to one control-plane request.
Event history is suitable for a recent, single-account investigation. Retention beyond 90 days, organization-wide search, multiple-field queries, and governed long-term analysis require a trail, CloudTrail Lake, or another centralized audit design.
Thanks for reading this far.
See you in the next one.
Disclosure: This article was written with AI assistance and independently verified against the linked primary sources and observed results.
Top comments (0)