{"eventVersion":"1.08","userIdentity":{"type":"AWSService","invokedBy":"201.237.39.191"},"eventTime":"2024-07-31T23:59:52Z","eventSource":"sts.amazonaws.com","eventName":"AssumeRole","awsRegion":"us-east-2","sourceIPAddress":"201.237.39.191","userAgent":"201.237.39.191","requestParameters":{"roleArn":"arn:aws:iam::733177541390:role/aws-service-role/201.237.39.191/AWSServiceRoleForTrustedAdvisor","roleSessionName":"TrustedAdvisor_733177541390_3f7071a5-6388-466c-83e0-275246193acf","durationSeconds":900},"responseElements":{"credentials":{"accessKeyId":"ASIA2VNGJOMHPVN32VBH","sessionToken":"IQoJb3JpZ2luX2VjEID//////////wEaCXVzLWVhc3QtMiJHMEUCIAgrUzpAMo75glC0e4VJ4v67LEW2xC1TgJPaLnPs4FgJAiEAzhYsB2hambGLGw/bWZ4IeoPEWTRiOfDkgtwgSA0cojkqkwMIaRAAGgw3MzMxNzc1NDEzOTAiDOAYCX3Uuu9WTR1AZSrwArNu2iMT3Jwx6YsXwb0m1b3Pz3qgIH+ec34V5Gcdy3bJnbaQ9/V7sofDCmcMi6VP/wvoL6A426uWjsTHJex8sIdGPIJ+oiF0LTouX2qtIpbc7OMxgyA+KdkyQ/c6Mb4xHi/3R6bhkPjjQpaHj2DzI9rYA6EIXxyX4nw7nsoIOIPmxk2q7xQHq7sskXNeKjitP3hueLxmWJgPnDz1asPP9Hsow0KC/VMyByldKNC+1JqicCzJ2gkdWkOse59Yw/Ki2cblWMzj0xH6FrRibGi0oDoa9gcjHJu4VxvWm1wloimQpLSHPn8CtpCfpmd96JTTORY432GKxBrjEoI1Gzw2rIl1GtgQdYW+zJYTW9Kq0TAKFLy09lFa7eYfoVO2CHkc4FvESAKg2Fht+L2jpaSYNV5+VQRddaKOd39la5r1mHfLNbIGp6hxS4w0dP9oeqhnXGGmc060FWhmAmXCbN5kxuRW+9d4GouHT5P9Hkz/tBh7MPifq7UGOr8BAtb/3fJQgaOcw1pP83EwvkmzwSKdOVtl48CDt6Nv4GIscfenYuui3NwjJnkO+7PXfXcgIT3W4oi+ukAh73Ciet8iKJbjLvJ63pP8CSN6eQH41hYbjd2Hvc8m4zuNBvrGJpC7lkpttXa03UtsleCT2JovIJakPKo6Xc263nSBOVakhU7ID480K7zNRyIct/oTgh0hf141IMORorNgrMgn/Ot7AfbjOcQKwrZRwGblgetfSzbt0IMRZsJX95Sd+AU=","expiration":"Aug 1, 2024, 12:14:52 AM"},"assumedRoleUser":{"assumedRoleId":"AROAI4TSRELAFLOMQOMX6:TrustedAdvisor_733177541390_3f7071a5-6388-466c-83e0-275246193acf","arn":"arn:aws:sts::733177541390:assumed-role/AWSServiceRoleForTrustedAdvisor/TrustedAdvisor_733177541390_3f7071a5-6388-466c-83e0-275246193acf"}},"requestID":"f0c4c30b-c4e3-4170-a099-7627f4004f5e","eventID":"a8b2a029-87ef-30d3-a32d-464da0f59f49","readOnly":true,"resources":[{"accountId":"733177541390","type":"AWS::IAM::Role","ARN":"arn:aws:iam::733177541390:role/aws-service-role/201.237.39.191/AWSServiceRoleForTrustedAdvisor"}],"eventType":"AwsApiCall","managementEvent":true,"recipientAccountId":"733177541390","sharedEventID":"7f9a11a0-5ad1-40a5-abbe-6516303bbac4","eventCategory":"Management"}
This is a syslog message from a product called aws_cloud_trail by aws_cloud_trail. The following fields were extracted from the message:
clientIP: 201.237.39.191
fieldExtractorName: aws_cloud_trail
messageType: audit_log
ruleCategory: AwsApiCall
ruleName: AssumeRole
senderHost: 733177541390_CloudTrail_us-east-1
sensitivity: normal
sourceInfo: unknown
streamName: aws_cloud_trail
tags: ['us-east-2', 'aws_cloud_trail', 'audit_log']
vendorCode: sts.amazonaws.com