{"eventVersion":"1.08","userIdentity":{"type":"AWSService","invokedBy":"180.27.234.229"},"eventTime":"2024-07-31T23:59:48Z","eventSource":"sts.amazonaws.com","eventName":"AssumeRole","awsRegion":"us-east-2","sourceIPAddress":"180.27.234.229","userAgent":"180.27.234.229","requestParameters":{"roleArn":"arn:aws:iam::733177541390:role/aws-service-role/180.27.234.229/AWSServiceRoleForTrustedAdvisor","roleSessionName":"TrustedAdvisor_733177541390_a98614fb-d825-486d-884e-285de84d02d6","durationSeconds":900},"responseElements":{"credentials":{"accessKeyId":"ASIA2VNGJOMHKNDF56AH","sessionToken":"IQoJb3JpZ2luX2VjEID//////////wEaCXVzLWVhc3QtMiJGMEQCIHTQr4OknwO9AIHbdBkg3JaNOUq+b7gp01OTcqbZyo8zAiB/APQ1EU0/DYtkaDXxoti+c53TDM9B5eg/mDy4Qm0jeCqTAwhpEAAaDDczMzE3NzU0MTM5MCIMLVtx6hAmgH1IfPrdKvACElv++hhBw/FL7XXZYuLnFarhDpL4WstEHZ1XG4hhEfrGpw+wsuktbWxBDDW9vQTklKRf21nVd83FaJeHU2phyPFbL7TMK4xoUNYt+EFB7bGWyhpftQfAXb7zASwVb9aRUx0wtAd77hNRo7bNjuKAgIq9Uh0TkreRYpl293uuNmbYhCeAXailceh4yEaFqvgec0vcoLLXlANzpIOGUQi1zVWvn74l+ad5yfqQ/SeORzNKfvkyuYJg7Ux9jnDmVwr0qt69bkPG3xLgus4AsgBqRsfjTHHSCPYpyTAp5bbp1LOdIlNSVFA1j25gUeTQbjq6KAB2cM6EclBNzDU59zGZCbZQAoTgsWPX+Xi7cvPVuT34p+01fErxJuIfi4bWNRX5keVcAXgP+7umWo6won5Uena+GiVz7K5ihXbK4UUbWZ8ex61MI5gSYYXTE83+rm14ZyhArHW+7CQa5NSz3G6imj8Oo1cUAixIBc24fJnF6UAw9J+rtQY6wAGxp6/fNrJs4lx5FW+0J2MMjQh81Yf1m+9l7Nvsp1TQvWC7H3t6dgFdTwUgjlpqMzP99+J+YSv0acdD43GTRGDge+MBOqmIrycsS1Uo9LOsIR3j8E14kev6sQAt0+3atSw3vIuZPGXEXdMOYYTY/mQRo5sMoo/tOVVbwTTgvRKZ8hN4DeaBKji0kS1nTCiIkG5kqMTkHUKr1NCWm6uvFshcpIQifLxcCIm10zzcroRR+pU2V1K2k96CUrmQupyPYJY=","expiration":"Aug 1, 2024, 12:14:48 AM"},"assumedRoleUser":{"assumedRoleId":"AROAI4TSRELAFLOMQOMX6:TrustedAdvisor_733177541390_a98614fb-d825-486d-884e-285de84d02d6","arn":"arn:aws:sts::733177541390:assumed-role/AWSServiceRoleForTrustedAdvisor/TrustedAdvisor_733177541390_a98614fb-d825-486d-884e-285de84d02d6"}},"requestID":"535d683e-efeb-47b9-8ee0-6103c7598938","eventID":"d38f0c80-755f-33ed-b62a-bcdb8a2b3c79","readOnly":true,"resources":[{"accountId":"733177541390","type":"AWS::IAM::Role","ARN":"arn:aws:iam::733177541390:role/aws-service-role/180.27.234.229/AWSServiceRoleForTrustedAdvisor"}],"eventType":"AwsApiCall","managementEvent":true,"recipientAccountId":"733177541390","sharedEventID":"83ecd992-0595-4f6f-a6c5-bdc5fbe86f64","eventCategory":"Management"}
This is a syslog message from a product called aws_cloud_trail by aws_cloud_trail. The following fields were extracted from the message:
clientIP: 180.27.234.229
fieldExtractorName: aws_cloud_trail
messageType: audit_log
ruleCategory: AwsApiCall
ruleName: AssumeRole
senderHost: 733177541390_CloudTrail_us-east-1
sensitivity: normal
sourceInfo: unknown
streamName: aws_cloud_trail
tags: ['us-east-2', 'aws_cloud_trail', 'audit_log']
vendorCode: sts.amazonaws.com