why is ListExports readonly false in cloudtrail events

The classification of the ListExports event as readOnly: false in CloudTrail logs may seem counterintuitive, but it aligns with how AWS categorizes certain API calls. While ListExports is primarily a read operation, CloudTrail's event categorization is based on the potential impact of the API call rather than just its immediate action.

In CloudTrail, events are categorized as read-only (true) or write (false) based on their potential to modify the state of AWS resources, either directly or indirectly. Some list or describe operations, which appear to be read-only, may be classified as write events if they have the potential to trigger subsequent actions that could modify resources.

For example, if listing exports could potentially lead to actions that modify the AWS environment, such as initiating new exports or making configuration changes based on the listed information, CloudTrail may categorize it as a write event (readOnly: false).

It's important to note that CloudTrail's event categorization doesn't always perfectly align with the semantic meaning of individual API actions. AWS may have internal criteria for categorizing events that go beyond the immediate action of the API call.

If you need to filter for truly read-only events in CloudTrail, you can use advanced event selectors to specifically include events where readOnly is set to true. This will capture events that AWS considers as not having the potential to change the state of your resources.
Sources
ListInsights Event tagged as readOlny False | AWS re:Post
Logging data events - AWS CloudTrail