CloudTrail Lake: eventTime is UTC

The field is already a universal time

eventTime is the time CloudTrail recorded for the call, in UTC. A value that shows 17:12 is 17:12 UTC, not 17:12 in the office. Adding or removing hours and leaving the same field name makes a different time that the row did not contain.

If you show a local time for a reader, label it as converted and show the offset. Keep the original eventTime beside it so the row can still be found.

A query window uses the same clock

A WHERE clause on eventTime is also UTC. A window you wrote in local time without converting it does not bound the hours you think it does. Write the bounds as you sent them, and write the zone you meant if you converted.

Two rows an hour apart in UTC are an hour apart. Do not describe them as “the same minute” because both display as 09:00 on different local clocks you did not state.

What to file

File eventTime as printed and the word UTC. If you add a local equivalent, label that line with the zone. File the query’s time bounds as sent. Do not replace eventTime with a shifted number.

Worked case: 17:12 read as local

A sandbox row has eventTime 2026-11-03T17:12:00Z. The office is eight hours behind UTC. A draft writes 17:12 local and schedules a follow-up for that office hour. The call was 09:12 in that office, which is the converted time, not the digits moved under the same label.

The note keeps 17:12 UTC as eventTime and adds “09:12 in the office, UTC−8” as a conversion. The follow-up window uses the UTC bounds. The unlabeled 17:12 local line is removed.

eventTime: 2026-11-03T17:12:00Z  (UTC, as returned)
office: 09:12, UTC-8, labeled as a conversion
query bounds: sent in UTC
not: eventTime rewritten to 17:12 local