{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://api-evangelist.com/schemas/amazon/cloudtrail/event.json",
  "title": "Amazon CloudTrail Event",
  "description": "Represents a CloudTrail event record containing information about an API call or account activity.",
  "type": "object",
  "required": ["eventVersion", "eventSource", "eventName"],
  "properties": {
    "eventVersion": {
      "type": "string",
      "description": "The version of the event log format."
    },
    "userIdentity": {
      "type": "object",
      "description": "Information about the user that made the request.",
      "properties": {
        "type": {
          "type": "string",
          "description": "The type of the identity.",
          "enum": ["Root", "IAMUser", "AssumedRole", "FederatedUser", "AWSService", "AWSAccount"]
        },
        "principalId": {
          "type": "string",
          "description": "A unique identifier for the entity that made the call."
        },
        "arn": {
          "type": "string",
          "description": "The ARN of the principal that made the call."
        },
        "accountId": {
          "type": "string",
          "description": "The account that owns the entity that made the call."
        },
        "userName": {
          "type": "string",
          "description": "The friendly name of the identity."
        }
      }
    },
    "eventTime": {
      "type": "string",
      "format": "date-time",
      "description": "The date and time the request was made."
    },
    "eventSource": {
      "type": "string",
      "description": "The service that the request was made to."
    },
    "eventName": {
      "type": "string",
      "description": "The requested action (API operation name)."
    },
    "awsRegion": {
      "type": "string",
      "description": "The AWS Region that the request was made to."
    },
    "sourceIPAddress": {
      "type": "string",
      "description": "The IP address that the request was made from."
    },
    "userAgent": {
      "type": "string",
      "description": "The agent through which the request was made."
    },
    "errorCode": {
      "type": "string",
      "description": "The AWS service error if the request returned an error."
    },
    "errorMessage": {
      "type": "string",
      "description": "The error message if the request returned an error."
    },
    "requestParameters": {
      "type": "object",
      "description": "The parameters sent with the request.",
      "additionalProperties": true
    },
    "responseElements": {
      "type": "object",
      "description": "The response element for actions that make changes.",
      "additionalProperties": true
    },
    "eventID": {
      "type": "string",
      "description": "A GUID generated by CloudTrail to uniquely identify each event."
    },
    "eventType": {
      "type": "string",
      "description": "Identifies the type of event that generated the event record.",
      "enum": ["AwsApiCall", "AwsServiceEvent", "AwsConsoleAction", "AwsConsoleSignIn"]
    },
    "readOnly": {
      "type": "boolean",
      "description": "Whether the event is a read-only event."
    },
    "managementEvent": {
      "type": "boolean",
      "description": "Whether the event is a management event."
    }
  },
  "additionalProperties": true
}