{"eventVersion":"1.08","userIdentity":{"type":"AWSService","invokedBy":"99.129.59.191"},"eventTime":"2024-08-01T05:04:32Z","eventSource":"sts.amazonaws.com","eventName":"AssumeRole","awsRegion":"us-east-1","sourceIPAddress":"99.129.59.191","userAgent":"99.129.59.191","requestParameters":{"roleArn":"arn:aws:iam::733177541390:role/s3crr_role_for_acme-nviprocprd-backups","roleSessionName":"s3-replication","durationSeconds":3600},"responseElements":{"credentials":{"accessKeyId":"ASIA2VNGJOMHDZRBGTUK","sessionToken":"IQoJb3JpZ2luX2VjEIb//////////wEaCXVzLWVhc3QtMSJIMEYCIQDwRJwK9Ph5KuWN6Y0dAJMw+lT1WgJXQ4kpydWwoBLV6AIhAKcqxTkY+QhE2ho0DfOIM30OQIcILiBUGg2V8QRYJG2xKskCCG4QABoMNzMzMTc3NTQxMzkwIgzA9acDSCYZOpKtlSwqpgIl8e+FJxll78p9JToOp8eTmxXaugr1FlWKvyfUHPEbKgjYZWAw523EWTB/hFHoot02dO5/SC1FjgM2HYePOCXnFK/MKFyBiSQbKTdIVsaLn3R+YSOjyUKdItx5BKNbVRnhvgrashJiltNrw0XnrXsOCj0rl2IT1A6sKplmt7mb8C/uii3imCkydn3TYknwlAe3xMjXps5XYP4JT0cjQCwJ4lC8stbsShfojAzKuhkpY8vBlydU6NZg+nq1P3oH9BoEr5MnQN4booG//8tFZVg8Pl4AtgMsz9rhSiRE28K9QknwsczXb8xFxAb5cNKKc3EUNWJDw8gJ9SpfMhqqPjbqKZt2W1LMbAMesUauvb+HXmytuhzhM8u0aE/xZmyC4g+ukKxc4ykw4K6stQY6vgGE/xoHIMU3N4aLQ+iAMBaI4N/ONYmWePbgluhdOKUl/lAawYLsosuHr3p6U7jF/zkeWIPQp5KD+MD+weaPSStdDVU2uuhfePYtgoW3atS+nv11bnHxF4ilw8NN6ST1UgCQM1mxcL39lQEbUwYjrRTdrQulLZ6pHbJJOz2BmD5LVzxqJDR+feN6GAnryyQdP2/VyNJnV2MHzlRoaeONAYbeiL8N4Hwa+zy8gbWUPOi0wFrpRORLVY2BkXNqGheG","expiration":"Aug 1, 2024, 6:04:32 AM"},"assumedRoleUser":{"assumedRoleId":"AROA2VNGJOMHORUVORWGL:s3-replication","arn":"arn:aws:sts::733177541390:assumed-role/s3crr_role_for_acme-nviprocprd-backups/s3-replication"}},"requestID":"bd2211c7-f73f-40f0-abd6-12b64fd36966","eventID":"4877e57e-c30b-32b5-b566-10811814747e","readOnly":true,"resources":[{"accountId":"733177541390","type":"AWS::IAM::Role","ARN":"arn:aws:iam::733177541390:role/s3crr_role_for_acme-nviprocprd-backups"}],"eventType":"AwsApiCall","managementEvent":true,"recipientAccountId":"733177541390","sharedEventID":"9d5d2c24-d3ca-4881-ba5a-5c817b333d09","eventCategory":"Management"}
This is a syslog message from a product called aws_cloud_trail by aws_cloud_trail. The following fields were extracted from the message:
clientIP: 99.129.59.191
fieldExtractorName: aws_cloud_trail
messageType: audit_log
ruleCategory: AwsApiCall
ruleName: AssumeRole
senderHost: 733177541390_CloudTrail_us-east-1_3
sensitivity: normal
sourceInfo: unknown
streamName: aws_cloud_trail
tags: ['us-east-1', 'aws_cloud_trail', 'audit_log']
vendorCode: sts.amazonaws.com