{"eventVersion":"1.08","userIdentity":{"type":"AWSService","invokedBy":"92.15.205.131"},"eventTime":"2024-07-31T23:59:47Z","eventSource":"sts.amazonaws.com","eventName":"AssumeRole","awsRegion":"us-east-2","sourceIPAddress":"92.15.205.131","userAgent":"92.15.205.131","requestParameters":{"roleArn":"arn:aws:iam::733177541390:role/aws-service-role/92.15.205.131/AWSServiceRoleForTrustedAdvisor","roleSessionName":"TrustedAdvisor_733177541390_2723c46f-6645-46ce-a17f-72ccf5a4aa6f","durationSeconds":900},"responseElements":{"credentials":{"accessKeyId":"ASIA2VNGJOMHJCMAQM42","sessionToken":"IQoJb3JpZ2luX2VjEID//////////wEaCXVzLWVhc3QtMiJGMEQCIFZKN1xpXkFAO3eRUqw4ATsFq757BcyzBUnykdd8qgkKAiAZhpZM5+hv0Y2O2lHNWzl8c4wjxDsS0gtsxLz2JO5RiiqTAwhpEAAaDDczMzE3NzU0MTM5MCIMZV5PNsLu+3ASgWHuKvACaJ/43zLxv1rxSu9XDPWG20esvGWCJdOcHms6Eqg2QxBkM2CQ17/UVelvrZrwYyUGEAWz84phkR25pIod4q/WtMozBYtavK5n4UNQIHtLHa3VaOLSuMte41meS+FzqvQ98l6F4gsVXu0tlzcT0FtrUSxGYwYJ6UmXBSIPo8BR9i24EsCMHs1qacGZQIdiiqlEyEqlqV/P1vlWZSC4+r+G6ZbFEJ/2Tc46IuNlI4ZfrwJp36iW2cH0onZ49rxKD18N7KfgrVDUm0rAUcKJZP3pRwQvL71apT1PFesXwT7nReQpD0hsKYo3wblFr+96lp7uw+qVsNa18VL5v7VOE1FWbRzeP0Sn8snvC5yo7IY81jHCCmQbp4hzoF7PBsxyp20vWur6xOcG7mmVG7uWBGhmH+P5u4/9e7IHzIOsr9S/Ymk7h1iDwI9yq+wLi69qUBAbiwTK7dB3BBSyAoU7fVNrI2+Xq3LInCQt9ib9Paj9WHEw85+rtQY6wAHPB4jGCg0z6cnNZ2hf0bhjlb6YzwCeabCHqMua13JY2OmIIDkYYblEGisTFhoN7Yb4uwOhsqJFy8/504IDSQO5L7oPTaimWqRC+Wwcozrt51iFZwTwlIaumhawI4DxK565BX3kfopEaCEjOn9SlObxUDyHz+s+39A3wZMraCeQjTO5Fncvbb5oMdijfiiZC+2evfmMusBf0+vfJFyL1B6IY9Z/a8Ti8vvNFOcsZyHWSuvY13v0g3tepuR/DE7VFIo=","expiration":"Aug 1, 2024, 12:14:47 AM"},"assumedRoleUser":{"assumedRoleId":"AROAI4TSRELAFLOMQOMX6:TrustedAdvisor_733177541390_2723c46f-6645-46ce-a17f-72ccf5a4aa6f","arn":"arn:aws:sts::733177541390:assumed-role/AWSServiceRoleForTrustedAdvisor/TrustedAdvisor_733177541390_2723c46f-6645-46ce-a17f-72ccf5a4aa6f"}},"requestID":"c51131dd-9380-4907-bf86-5650fc99f861","eventID":"7a07f16e-0daf-3e7f-a45a-aaefb6957253","readOnly":true,"resources":[{"accountId":"733177541390","type":"AWS::IAM::Role","ARN":"arn:aws:iam::733177541390:role/aws-service-role/92.15.205.131/AWSServiceRoleForTrustedAdvisor"}],"eventType":"AwsApiCall","managementEvent":true,"recipientAccountId":"733177541390","sharedEventID":"46b43389-b88b-4d81-96d5-d8a7c663d82e","eventCategory":"Management"}
This is a syslog message from a product called aws_cloud_trail by aws_cloud_trail. The following fields were extracted from the message:
clientIP: 92.15.205.131
fieldExtractorName: aws_cloud_trail
messageType: audit_log
ruleCategory: AwsApiCall
ruleName: AssumeRole
senderHost: 733177541390_CloudTrail_us-east-1
sensitivity: normal
sourceInfo: unknown
streamName: aws_cloud_trail
tags: ['us-east-2', 'aws_cloud_trail', 'audit_log']
vendorCode: sts.amazonaws.com