{"eventVersion":"1.08","userIdentity":{"type":"AWSService","invokedBy":"142.131.40.163"},"eventTime":"2024-07-31T23:59:54Z","eventSource":"sts.amazonaws.com","eventName":"AssumeRole","awsRegion":"us-east-2","sourceIPAddress":"142.131.40.163","userAgent":"142.131.40.163","requestParameters":{"roleArn":"arn:aws:iam::733177541390:role/aws-service-role/142.131.40.163/AWSServiceRoleForTrustedAdvisor","roleSessionName":"TrustedAdvisor_733177541390_44e434ee-5ea3-4e8c-a766-3802fc850229","durationSeconds":900},"responseElements":{"credentials":{"accessKeyId":"ASIA2VNGJOMHJ222CHNJ","sessionToken":"IQoJb3JpZ2luX2VjEID//////////wEaCXVzLWVhc3QtMiJHMEUCIQCNE/K/w/18wpRv1au0aQpL8nu91LROfWdMqze8BbpHzQIgKQUVqzQhcL/QM4rQwodc1SuzfGVGHJgQaZt8CTpl4IUqkwMIaRAAGgw3MzMxNzc1NDEzOTAiDGBHEwaGsAPaNcT/fSrwAtQ2gGH1kVEDg5iu2K4sWij1bQSAPA7LAxHCZf5/sFGEeqyWIVRcsPnDXhrwPEk9kXN+sYEH2DaUG6p3w+9xAnrJ4gbtKU4g7yAi923P9PjeZELe3kxtbUWb/lghkdyyRS6h42P04hakRdj5Kte7FSTEMw9zMdU/13GUczyTLJlKcExD5LeqXaXVdqapcfmGxiAKvahDjC8x1zZbnYBHCf0zIIvqX2RQ/bVogNjvDpxLVh4KuojZaQ4uXuXK86CE2pchcWEgkfpadU+RUJbrDXIqr1c/6hTABJH4s1U9wK9MJwr6gATlv62/e04UdJfMwBqKQmzpb+fggQKl324l9ZWWP8UOiaAhft9NVevg4eCdiZUduReUGU4NJgoXNfO5mNRwYUge7i4XWvkBltLZPFA3+DQj5rOVcYN/5utnqsI5fgZJcyLs/mjKsgE6XFegquGwxv5DqMODTDHdRq2XkUbre0/Z+jPb8pe2aq9aY57wMPqfq7UGOr8BpDqgX4lahHzGiRmVL17CHTxMFB4xWyArlCgod5WmXMoR7HMPGhR0XP2IYLNN1mXxUJpGuQM8de5HhJqSW80KP2BO2xc4PrVz0OHC5IQhx5rgr5kBbK+502rxsRzi8zladMlHSmMKj4OfljyUTvq03OvqCXwI21qagu3YChyvF30JV0AV1THgr+YD/DG95c2g6rhycKk88tiMbw9HX7leMleC+XgKAcRbLmg5HSYNhVUKAfbSjvSTX4RC9tH1eN4=","expiration":"Aug 1, 2024, 12:14:54 AM"},"assumedRoleUser":{"assumedRoleId":"AROAI4TSRELAFLOMQOMX6:TrustedAdvisor_733177541390_44e434ee-5ea3-4e8c-a766-3802fc850229","arn":"arn:aws:sts::733177541390:assumed-role/AWSServiceRoleForTrustedAdvisor/TrustedAdvisor_733177541390_44e434ee-5ea3-4e8c-a766-3802fc850229"}},"requestID":"14f5cefa-69fd-45c1-8707-8824824c5a3e","eventID":"d359b0eb-33c9-3ed5-a564-d19dcd799c87","readOnly":true,"resources":[{"accountId":"733177541390","type":"AWS::IAM::Role","ARN":"arn:aws:iam::733177541390:role/aws-service-role/142.131.40.163/AWSServiceRoleForTrustedAdvisor"}],"eventType":"AwsApiCall","managementEvent":true,"recipientAccountId":"733177541390","sharedEventID":"b17f7594-2bdd-491d-8f29-778fee36e184","eventCategory":"Management"}
This is a syslog message from a product called aws_cloud_trail by aws_cloud_trail. The following fields were extracted from the message:
clientIP: 142.131.40.163
fieldExtractorName: aws_cloud_trail
messageType: audit_log
ruleCategory: AwsApiCall
ruleName: AssumeRole
senderHost: 733177541390_CloudTrail_us-east-1
sensitivity: normal
sourceInfo: unknown
streamName: aws_cloud_trail
tags: ['us-east-2', 'aws_cloud_trail', 'audit_log']
vendorCode: sts.amazonaws.com