> For the complete documentation index, see [llms.txt](https://karansingh.gitbook.io/tutorialsdojo-wrong-answers-aws-sec-spec/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://karansingh.gitbook.io/tutorialsdojo-wrong-answers-aws-sec-spec/logging-and-monitoring-68/cloudtrail-management-and-data-events.md).

# CloudTrail Management & Data Events

## Data Events (Data Plane Operations)

* Data events provide visibility into the **resource operations performed on or within a resource**.
* They are **often high-volume activities**.<br>
* **For example:**
  * **S3 object-level API activity** (for example, `GetObject`, `DeleteObject`, `PutObject` )
  * **Lambda function execution activity (the `Invoke` API)**.

## Management Events (Control Plane Operations)

* Management events provide visibility into **management operations that are performed on resources in your AWS account**.<br>
* **For example:**
  * **Configuring security (for example, IAM `AttachRolePolicy`** API operations.)
  * **Registering devices (for example, EC2 `CreateDefaultVpc`** API operations.)
  * **Configuring rules for routing data (for example, EC2 `CreateSubnet`** API operations.)
  * **Setting up logging (for example, CloudTrail `CreateTrail`** API operations.)

## Read and Write Events

* When you **configure your trail to log management events**, you can **specify whether you want read-only events, write-only events, or both**.

* **Read (API operations that read your resources, but don't make changes):**
  * For example, the **EC2 `DescribeSecurityGroups` and `DescribeSubnets`**.<br>

* **Write (API operations that modify (or might modify) your resources):**
  * For example, the **EC2 `RunInstances` and `TerminateInstances`**.

## KMS Example

* **Read Events:**

  * **`Encrypt`, `Decrypt`, and `GenerateDataKey`**.

* **Write Events:**
  * **`Disable`, `Delete`, and `ScheduleKey`**.