{"eventVersion":"1.08","userIdentity":{"type":"AWSService","invokedBy":"29.116.213.59"},"eventTime":"2024-07-31T23:59:55Z","eventSource":"sts.amazonaws.com","eventName":"AssumeRole","awsRegion":"us-east-2","sourceIPAddress":"29.116.213.59","userAgent":"29.116.213.59","requestParameters":{"roleArn":"arn:aws:iam::733177541390:role/aws-service-role/29.116.213.59/AWSServiceRoleForTrustedAdvisor","roleSessionName":"TrustedAdvisor_733177541390_930ed127-cdc3-4647-9263-cb6df136d721","durationSeconds":900},"responseElements":{"credentials":{"accessKeyId":"ASIA2VNGJOMHH7H567MS","sessionToken":"IQoJb3JpZ2luX2VjEID//////////wEaCXVzLWVhc3QtMiJGMEQCIEj/382/lqoo2XWQiRE09bBLdjTaCcNPCt0PJRen5GSGAiBJgM2V5Rxz+ExfdRJv1qaRhJh8p5nNRxS6EJ/FLNfJiCqTAwhpEAAaDDczMzE3NzU0MTM5MCIMjIkX5e8HA5ik4I4zKvAC5Qeuiq9+bc0q7TaTXbaeahnu93NNbSEg/kyepMBz1jVOxsCnT4pR7xROYNP56cQGdNVDRiRvbfxuzOUKnGgpIRgheeKRajpKyogaP131VeM2uAsDE1AkMuVYerLKs9b/3VlJNdeUDB/E7v3Ig6pf3OJMT4MlmciwXQF2nvbuZeKbNJ7cl1+T54R7rCo1DlvI/u9z5FYupjWw26Z1CfRqLPJ1WaqEj+FZSpsF/rD4k51rK8Jk5cnrrcKmFkpVxfkv0O0niMppBKuQEi8hF65KLi1rChJQUUyj0ooCcrbj4Vr1idS83WlVDD42mCu+uiJ/cj33Kbq4pnmABpBkexLfKuk1NYuc9dywVs0B5YdHz1nvCRiszZ/Ony0NLmTheENQBpa+KepPKtvmNF91+kkMRP7bm67mj8ZWilMop0cPoZWz4rDL6kSB+A2fhbqvHkbQqRZSSCV2Yvz2z/t3kuR7ZV1jrCX/GYKeZLCF5cM9EFUw+5+rtQY6wAFk6xHu4QR9Y6yKIKuCQix9l4+6cP7UMy8SYj9XufOBLUEVHu6t3m+1yavgTpQW4kuUfgtLC9h7G/BiLY41wrpymMPIEXu/yzwzdxx4jeB+nKij7wrT+IQQowbLQcJRaT0tHh81TfXulWzUBKOEm1PGac0PqNrlYesqBYyii5ksZisEfbDDSZEJFxZUO8pfWygBMazeAahz+8V8S32XJYrum00Wokaixi72it5An/kvx8/IypEnlnj02TYL0rt47Mk=","expiration":"Aug 1, 2024, 12:14:55 AM"},"assumedRoleUser":{"assumedRoleId":"AROAI4TSRELAFLOMQOMX6:TrustedAdvisor_733177541390_930ed127-cdc3-4647-9263-cb6df136d721","arn":"arn:aws:sts::733177541390:assumed-role/AWSServiceRoleForTrustedAdvisor/TrustedAdvisor_733177541390_930ed127-cdc3-4647-9263-cb6df136d721"}},"requestID":"6b41bb98-14ea-4c5b-ac3e-49963847cd2b","eventID":"8b925e48-cfd7-3ff1-94f2-142c2ec19e60","readOnly":true,"resources":[{"accountId":"733177541390","type":"AWS::IAM::Role","ARN":"arn:aws:iam::733177541390:role/aws-service-role/29.116.213.59/AWSServiceRoleForTrustedAdvisor"}],"eventType":"AwsApiCall","managementEvent":true,"recipientAccountId":"733177541390","sharedEventID":"f71c1fb7-b609-47e3-9712-abec81ae1d70","eventCategory":"Management"}
This is a syslog message from a product called aws_cloud_trail by aws_cloud_trail. The following fields were extracted from the message:
clientIP: 29.116.213.59
fieldExtractorName: aws_cloud_trail
messageType: audit_log
ruleCategory: AwsApiCall
ruleName: AssumeRole
senderHost: 733177541390_CloudTrail_us-east-1
sensitivity: normal
sourceInfo: unknown
streamName: aws_cloud_trail
tags: ['us-east-2', 'aws_cloud_trail', 'audit_log']
vendorCode: sts.amazonaws.com