{"eventVersion":"1.08","userIdentity":{"type":"AWSService","invokedBy":"205.221.137.250"},"eventTime":"2024-07-31T23:59:56Z","eventSource":"sts.amazonaws.com","eventName":"AssumeRole","awsRegion":"us-east-2","sourceIPAddress":"205.221.137.250","userAgent":"205.221.137.250","requestParameters":{"roleArn":"arn:aws:iam::733177541390:role/aws-service-role/205.221.137.250/AWSServiceRoleForTrustedAdvisor","roleSessionName":"TrustedAdvisor_733177541390_9dbeb0b7-9f69-469c-b88a-6d360c3e42d4","durationSeconds":900},"responseElements":{"credentials":{"accessKeyId":"ASIA2VNGJOMHC4TLYHOA","sessionToken":"IQoJb3JpZ2luX2VjEID//////////wEaCXVzLWVhc3QtMiJHMEUCIDcnumnT9ErRFUMQxbUHUqMyKO3aQkCuUBGn3sfwra7TAiEAk08q5GHcpeDaLyJD4ZQ2NPrDkhG0JIokOTZ7ktake9oqkwMIaRAAGgw3MzMxNzc1NDEzOTAiDNTr+NRgMR0zaXW17CrwAsUG4otZMDrjf9AXJuw6G02/TSq+EDW7Lnijp0qgzY+ggcbExVNmfSSc8zTCmUHhxLdBSFdLmEevxCP+UExWEtmkaotpAaXB8qr/od2WKbwCyl6/F2uLO4NdqNfcQoiD22tGTHouI1WlLYI/NBm7LHjX7a5HdFkuGk2FVX221lDQtevkwirOX98aaAyDgLHWxsoblzW6wGQ1xKw4Nh75RMKcagp6Osok8RRVFhJUO/YfetfdIozsZS82vyacPxpOIaf3DssLchRI/1Wk3eGy623OcCIoksz1A4gNGq5iSxgEh6fCaoel7G0b8j546EVOve9ebb5apgV6nxhPHFXYhN0LOwys9eGp1ehimXTYZsjCaVjm+8POh0jXJkp2nefCE3APCBmr5XH7fWtSyUy6IAnu5/OmkxYY5eXt/j0e81KbDPhu/Lj0b+9gCmgIzC7L5GTea+bOPuyM0x1GD1K63UXoE6SHZpP9nRHy5nPiGAw4MPyfq7UGOr8BxpOP62FUkQfGSWCDw4FJaa5Jbfzg6KQtUYS5X70G/o/1WyJBo1sp6BcwbbFBZIp7k4DsH65HfCp2o2ct1CLS8Oh+GhBDxvRxrEXvJrW68k9DGsH3kxLjAG7t42JkqsZTeIWtfrBNu4outX5S6hHQEqm6yG2PwEp4ljLZKw/91GQf/aq1knK59EVU3pK3OKlhPAGmDhcw6r9JEfAqHeE4D/MB7V/GJgS4hAGSjiE6s4wO/Hc3X/6Bqcb3wtWt30c=","expiration":"Aug 1, 2024, 12:14:56 AM"},"assumedRoleUser":{"assumedRoleId":"AROAI4TSRELAFLOMQOMX6:TrustedAdvisor_733177541390_9dbeb0b7-9f69-469c-b88a-6d360c3e42d4","arn":"arn:aws:sts::733177541390:assumed-role/AWSServiceRoleForTrustedAdvisor/TrustedAdvisor_733177541390_9dbeb0b7-9f69-469c-b88a-6d360c3e42d4"}},"requestID":"3dd5e842-996d-43d6-bff4-9968cec5602e","eventID":"81c5b69a-59b4-3cfd-860d-3976102bcf57","readOnly":true,"resources":[{"accountId":"733177541390","type":"AWS::IAM::Role","ARN":"arn:aws:iam::733177541390:role/aws-service-role/205.221.137.250/AWSServiceRoleForTrustedAdvisor"}],"eventType":"AwsApiCall","managementEvent":true,"recipientAccountId":"733177541390","sharedEventID":"44cd809b-c8a6-454b-9afc-3e2a0e1de8c8","eventCategory":"Management"}
This is a syslog message from a product called aws_cloud_trail by aws_cloud_trail. The following fields were extracted from the message:
clientIP: 205.221.137.250
fieldExtractorName: aws_cloud_trail
messageType: audit_log
ruleCategory: AwsApiCall
ruleName: AssumeRole
senderHost: 733177541390_CloudTrail_us-east-1
sensitivity: normal
sourceInfo: unknown
streamName: aws_cloud_trail
tags: ['us-east-2', 'aws_cloud_trail', 'audit_log']
vendorCode: sts.amazonaws.com