{"eventVersion":"1.08","userIdentity":{"type":"AWSService","invokedBy":"240.128.46.121"},"eventTime":"2024-07-31T23:59:49Z","eventSource":"sts.amazonaws.com","eventName":"AssumeRole","awsRegion":"us-east-2","sourceIPAddress":"240.128.46.121","userAgent":"240.128.46.121","requestParameters":{"roleArn":"arn:aws:iam::733177541390:role/aws-service-role/240.128.46.121/AWSServiceRoleForTrustedAdvisor","roleSessionName":"TrustedAdvisor_733177541390_4240bccf-f8ed-4616-9aeb-dc5441dc8c9a","durationSeconds":900},"responseElements":{"credentials":{"accessKeyId":"ASIA2VNGJOMHFJELCW7P","sessionToken":"IQoJb3JpZ2luX2VjEID//////////wEaCXVzLWVhc3QtMiJHMEUCIQC4CesS+ZyGi7+EjZYMHdDDQFp33nyXQQpbENVIbjJn7QIgPYOBkbTeGZ5bO19yM7bxa0zqxyduLMIrQ1v6M7HGmpoqkwMIaRAAGgw3MzMxNzc1NDEzOTAiDEUH1ZH5S/cBdHMS8CrwAkyRtd2yZ5BQ/2oN2lgh6LOdNns1Wk2fgj75acdSRexv1+HdZPpFnIz40rRz/drmAnrqj5oC+ygiiInwDooWfU5O0/9QqlYg2U1Qyn93vBWAp0bAlf9RZSwgS1qAUBPxke9gDQ9MHTokz3D8esNrg7CfNhptwUCbgubIESXdee6AGesTTOfnbWcYY+QdB5JUa1+6gEJohJe7jz4drqmuqeMTWA6psSP4bj+sD25R29PrPd4+/wKVCEAadkyxLOwQz/WvkPqvCW8rboUDB4a0O9nQA5DrL0iz1Yv0Tt2wa8EhHhvX6c6c6V6LY2ZaCx0Yoo4YdZ5DUs7Mm6kFXfy43F668tPNgSgYdhUNDbqxvdUdkn7zVkSP24imgGJ1MY682vJ+zA5WtReVk3GydWdTbDmcPZZ2Ro9/tMjZ1K2ofWu08E0G8vJ57Vo0ojEXZZh4GGyM2QhqHDy4oR1z2NxTXV6aUS3+h20xgwZ8sTX2jLb5MPWfq7UGOr8Bt3UPoia5I0SDLyx02o1Y9i7wDetsaKLr1AJQpzhPR1RvXOJxgIK3rqPQCOnoCTtaGMflxtvsnmgNPeATTsvcXLOYhfKogNvABetKKdqbePzjVYE4K7O2tOvILWDQKPHDJim86VEiPANhWd5yQxnQuH12YWWGYTGFKHrekTJDvmXLSofafQTSV4l1InFZywyVCdDulwZUwv9HjjYYIlq7NKh409QrxoMJMJIwL/D5XiEYSsl4wyECeXzS1jrmI38=","expiration":"Aug 1, 2024, 12:14:49 AM"},"assumedRoleUser":{"assumedRoleId":"AROAI4TSRELAFLOMQOMX6:TrustedAdvisor_733177541390_4240bccf-f8ed-4616-9aeb-dc5441dc8c9a","arn":"arn:aws:sts::733177541390:assumed-role/AWSServiceRoleForTrustedAdvisor/TrustedAdvisor_733177541390_4240bccf-f8ed-4616-9aeb-dc5441dc8c9a"}},"requestID":"7ae8e902-9da0-45f1-bfdc-c95b28ab4384","eventID":"45f5cd88-6341-3225-8d78-621096d9c7c9","readOnly":true,"resources":[{"accountId":"733177541390","type":"AWS::IAM::Role","ARN":"arn:aws:iam::733177541390:role/aws-service-role/240.128.46.121/AWSServiceRoleForTrustedAdvisor"}],"eventType":"AwsApiCall","managementEvent":true,"recipientAccountId":"733177541390","sharedEventID":"520487e2-dd84-43df-b711-b6880a70b498","eventCategory":"Management"}
This is a syslog message from a product called aws_cloud_trail by aws_cloud_trail. The following fields were extracted from the message:
clientIP: 240.128.46.121
fieldExtractorName: aws_cloud_trail
messageType: audit_log
ruleCategory: AwsApiCall
ruleName: AssumeRole
senderHost: 733177541390_CloudTrail_us-east-1
sensitivity: normal
sourceInfo: unknown
streamName: aws_cloud_trail
tags: ['us-east-2', 'aws_cloud_trail', 'audit_log']
vendorCode: sts.amazonaws.com