本文為英文版的機器翻譯版本，如內容有任何歧義或不一致之處，概以英文版為準。

# 事件資料存放區的受支援 SQL 結構描述
<a name="query-supported-event-schemas"></a>

**注意**  
AWS CloudTrail Lake 自 2026 年 5 月 31 日起不再向新客戶開放。如果您想要使用 CloudTrail Lake，請在該日期之前註冊。現有客戶可以繼續正常使用該服務。如需詳細資訊，請參閱[CloudTrail Lake 可用性變更](cloudtrail-lake-service-availability-change.md)。

下列各節提供每種事件資料存放區類型的受支援 SQL 結構描述。

**Topics**
+ [支援的 CloudTrail 事件記錄欄位結構描述](#query-supported-event-schema)
+ [CloudTrail Insights 事件記錄欄位的受支援結構描述](#query-supported-insights-schema)
+ [AWS Config 支援組態項目記錄欄位的結構描述](#query-supported-config-items-schema)
+ [AWS Audit Manager 證據記錄欄位支援的結構描述](#query-supported-event-schema-audit-manager)
+ [非AWS 事件欄位支援的結構描述](#query-supported-event-schema-integration)

## 支援的 CloudTrail 事件記錄欄位結構描述
<a name="query-supported-event-schema"></a>

以下是 CloudTrail 管理、資料和網路活動事件記錄欄位的有效 SQL 結構描述。如需有關 CloudTrail 事件記錄欄位的詳細資訊，請參閱 [CloudTrail 記錄管理、資料和網路活動事件的內容](cloudtrail-event-reference-record-contents.md)。

```
[
    {
        "Name": "eventversion",
        "Type": "string"
    },
    {
        "Name": "useridentity",
        "Type": "struct<type:string,principalid:string,arn:string,accountid:string,accesskeyid:string,
                 username:string,sessioncontext:struct<attributes:struct<creationdate:timestamp,
                 mfaauthenticated:string>,sessionissuer:struct<type:string,principalid:string,arn:string,
                 accountid:string,username:string>,webidfederationdata:struct<federatedprovider:string,
                 attributes:map<string,string>>,sourceidentity:string,ec2roledelivery:string,
                 ec2issuedinvpc:string>,onbehalfof:struct<userid:string,identitystorearn:string>,
                 inscopeof:struct<sourcearn:string,sourceaccount:string,issuertype:string,
                 credentiaisissuedto:string>,invokedby:string,identityprovider:string>"
    },
    {
        "Name": "eventtime",
        "Type": "timestamp"
    },
    {
        "Name": "eventsource",
        "Type": "string"
    },
    {
        "Name": "eventname",
        "Type": "string"
    },
    {
        "Name": "awsregion",
        "Type": "string"
    },
    {
        "Name": "sourceipaddress",
        "Type": "string"
    },
    {
        "Name": "useragent",
        "Type": "string"
    },
    {
        "Name": "errorcode",
        "Type": "string"
    },
    {
        "Name": "errormessage",
        "Type": "string"
    },
    {
        "Name": "requestparameters",
        "Type": "map<string,string>"
    },
    {
        "Name": "responseelements",
        "Type": "map<string,string>"
    },
    {
        "Name": "additionaleventdata",
        "Type": "map<string,string>"
    },
    {
        "Name": "requestid",
        "Type": "string"
    },
    {
        "Name": "eventid",
        "Type": "string"
    },
    {
        "Name": "readonly",
        "Type": "boolean"
    },
    {
        "Name": "resources",
        "Type": "array<struct<accountid:string,type:string,arn:string,arnprefix:string>>"
    },
    {
        "Name": "eventtype",
        "Type": "string"
    },
    {
        "Name": "apiversion",
        "Type": "string"
    },
    {
        "Name": "managementevent",
        "Type": "boolean"
    },
    {
        "Name": "recipientaccountid",
        "Type": "string"
    },
    {
        "Name": "sharedeventid",
        "Type": "string"
    },
    {
        "Name": "annotation",
        "Type": "string"
    },
    {
        "Name": "vpcendpointid",
        "Type": "string"
    },
    {
        "Name": "vpcendpointaccountid",
        "Type": "string"
    },
    {
        "Name": "serviceeventdetails",
        "Type": "map<string,string>"
    },
    {
        "Name": "addendum",
        "Type": "map<string,string>"
    },
    {
        "Name": "edgedevicedetails",
        "Type": "map<string,string>"
    },
    {
        "Name": "insightdetails",
        "Type": "map<string,string>"
    },
    {
        "Name": "eventcategory",
        "Type": "string"
    },
    {
        "Name": "tlsdetails",
        "Type": "struct<tlsversion:string,ciphersuite:string,clientprovidedhostheader:string>"
    },
    {
        "Name": "sessioncredentialfromconsole",
        "Type": "string"
    },
    {
        "Name": "eventjson",
        "Type": "string"
    }
    {
        "Name": "eventjsonchecksum",
        "Type": "string"
    }
]
```

## CloudTrail Insights 事件記錄欄位的受支援結構描述
<a name="query-supported-insights-schema"></a>

下列是 Insights 事件記錄欄位的有效 SQL 結構描述。對於 Insights 事件，`eventcategory` 的值為 `Insight`，`eventtype` 的值為 `AwsCloudTrailInsight`。如需這些欄位的說明，請參閱 [事件資料存放區的 Insights 事件 CloudTrail 記錄內容](cloudtrail-insights-fields-lake.md)。

**注意**  
欄位中`attributions`的 `insightvalue`、`baselinevalue`、 `insightaverage`和 `baselineaverage` 欄位`insightContext`將於 2025 年 6 月 23 日開始棄用。

```
[
    {
        "Name": "eventversion",
        "Type": "string"
    },
    {
        "Name": "eventcategory",
        "Type": "string"
    },
    {
        "Name": "eventtype",
        "Type": "string"
    },
        "Name": "eventid",
        "Type": "string"
    },
    {
        "Name": "eventtime",
        "Type": "timestamp"
    },
    {
        "Name": "awsregion",
        "Type": "string"
    },
    {
        "Name": "recipientaccountid",
        "Type": "string"
    },
    {
        "Name": "sharedeventid",
        "Type": "string"
    },
    {
        "Name": "addendum",
        "Type": "map<string,string>"
    },
    {
        "Name": "insightsource",
        "Type": "string"
    },
    {
        "Name": "insightstate",
        "Type": "string"
    },
    {
        "Name": "insighteventsource",
        "Type": "string"
    },
    {
        "Name": "insighteventname",
        "Type": "string"
    },
    {
        "Name": "insighterrorcode",
        "Type": "string"
    },
    {
        "Name": "insighttype",
        "Type": "string"
    },
    {
        "Name": "insightContext",
        "Type": "struct<baselineaverage:double,insightaverage:double,
                 baselineduration:integer,insightduration:integer,
                 attributions:struct<attribute:string,insightvalue:string,
                 insightaverage:double,baselinevalue:string,baselineaverage:double,
                 insight:struct<value:string,average:double>,
                 baseline:struct<value:string,average:double>>>"
    }
]
```

## AWS Config 支援組態項目記錄欄位的結構描述
<a name="query-supported-config-items-schema"></a>

以下是組態項目記錄欄位的有效 SQL 結構描述。對於組態項目，`eventcategory` 的值為 `ConfigurationItem`，`eventtype` 的值為 `AwsConfigurationItem`。

```
[
    {
        "Name": "eventversion",
        "Type": "string"
    },
    {
        "Name": "eventcategory",
        "Type": "string"
    },
    {
        "Name": "eventtype",
        "Type": "string"
    },
        "Name": "eventid",
        "Type": "string"
    },
    {
        "Name": "eventtime",
        "Type": "timestamp"
    },
    {
        "Name": "awsregion",
        "Type": "string"
    },
    {
        "Name": "recipientaccountid",
        "Type": "string"
    },
    {
        "Name": "addendum",
        "Type": "map<string,string>"
    },
    {
        "Name": "eventdata",
        "Type": "struct<configurationitemversion:string,configurationitemcapturetime:
                 string,configurationitemstatus:string,configurationitemstateid:string,accountid:string,
                 resourcetype:string,resourceid:string,resourcename:string,arn:string,awsregion:string,
                 availabilityzone:string,resourcecreationtime:string,configuration:map<string,string>,
                 supplementaryconfiguration:map<string,string>,relatedevents:string,
                 relationships:struct<name:string,resourcetype:string,resourceid:string,
                 resourcename:string>,tags:map<string,string>>"
    }
]
```

## AWS Audit Manager 證據記錄欄位支援的結構描述
<a name="query-supported-event-schema-audit-manager"></a>

以下是 Audit Manager 證據記錄欄位的有效 SQL 結構描述。對於 Audit Manager 證據記錄欄位，`eventcategory` 的值為 `Evidence`，`eventtype` 的值為 `AwsAuditManagerEvidence`。如需有關使用 Audit Manager 在 CloudTrail Lake 中彙總證據的詳細資訊，請參閱 *AWS Audit Manager 使用者指南*中的[證據搜尋工具](https://docs.aws.amazon.com/audit-manager/latest/userguide/evidence-finder.html)。

```
[
    {
        "Name": "eventversion",
        "Type": "string"
    },
    {
        "Name": "eventcategory",
        "Type": "string"
    },
    {
        "Name": "eventtype",
        "Type": "string"
    },
        "Name": "eventid",
        "Type": "string"
    },
    {
        "Name": "eventtime",
        "Type": "timestamp"
    },
    {
        "Name": "awsregion",
        "Type": "string"
    },
    {
        "Name": "recipientaccountid",
        "Type": "string"
    },
    {
        "Name": "addendum",
        "Type": "map<string,string>"
    },
    {
        "Name": "eventdata",
        "Type": "struct<attributes:map<string,string>,awsaccountid:string,awsorganization:string,
                 compliancecheck:string,datasource:string,eventname:string,eventsource:string,
                 evidenceawsaccountid:string,evidencebytype:string,iamid:string,evidenceid:string,
                 time:timestamp,assessmentid:string,controlsetid:string,controlid:string,
                 controlname:string,controldomainname:string,frameworkname:string,frameworkid:string,
                 service:string,servicecategory:string,resourcearn:string,resourcetype:string,
                 evidencefolderid:string,description:string,manualevidences3resourcepath:string,
                 evidencefoldername:string,resourcecompliancecheck:string>"
    }
]
```

## 非AWS 事件欄位支援的結構描述
<a name="query-supported-event-schema-integration"></a>

以下是非AWS 事件的有效 SQL 結構描述。對於非AWS 事件， 的值`eventcategory`為 `ActivityAuditLog`，而 的值`eventtype`為 `ActivityLog`。

```
[
    {
        "Name": "eventversion",
        "Type": "string"
    },
    {
        "Name": "eventcategory",
        "Type": "string"
    },
    {
        "Name": "eventtype",
        "Type": "string"
    },
        "Name": "eventid",
        "Type": "string"
    },
    {
        "Name": "eventtime",
        "Type": "timestamp"
    },
    {
        "Name": "awsregion",
        "Type": "string"
    },
    {
        "Name": "recipientaccountid",
        "Type": "string"
    },
    {
        "Name": "addendum",
        "Type": "struct<reason:string,updatedfields:string,originalUID:string,originaleventid:string>"
    },
    {
        "Name": "metadata",
        "Type": "struct<ingestiontime:string,channelarn:string>"
    },
    {
        "Name": "eventdata",
        "Type": "struct<version:string,useridentity:struct<type:string,
                 principalid:string,details:map<string,string>>,useragent:string,eventsource:string,
                 eventname:string,eventtime:string,uid:string,requestparameters:map<string,string>>,
                 responseelements":map<string,string>>,errorcode:string,errormssage:string,sourceipaddress:string,
                 recipientaccountid:string,additionaleventdata":map<string,string>>"
    }
]
```