{"eventVersion":"1.08","userIdentity":{"type":"AWSService","invokedBy":"226.234.218.252"},"eventTime":"2024-07-31T23:59:50Z","eventSource":"sts.amazonaws.com","eventName":"AssumeRole","awsRegion":"us-east-2","sourceIPAddress":"226.234.218.252","userAgent":"226.234.218.252","requestParameters":{"roleArn":"arn:aws:iam::733177541390:role/aws-service-role/226.234.218.252/AWSServiceRoleForTrustedAdvisor","roleSessionName":"TrustedAdvisor_733177541390_1df22b6c-39cb-479f-ab54-8a542db76fe8","durationSeconds":900},"responseElements":{"credentials":{"accessKeyId":"ASIA2VNGJOMHJI65SVOJ","sessionToken":"IQoJb3JpZ2luX2VjEID//////////wEaCXVzLWVhc3QtMiJIMEYCIQCVAfUJjuRPQpcxRC855f0zxcCJzalNIBNQfSgfoej3HwIhAOHp4Jct5IKG7l8ceRT9O01xrusaL0Z6rv+LNPbt7AIaKpMDCGkQABoMNzMzMTc3NTQxMzkwIgzBXWpZpgXVkj51uRoq8AJ0TLeRlCxB64i8nZyq1tdjLXke+mf8PK4X+SSKeEZ7Jv3SldjwwAHdak9chYRgu3Uhtvu5zqFdCTzKyB1FjTZsvsGg8fIApRVbROwHYMCqIgtqVWr1HoXV738LRAPWinscdRwCngjOYSq1g1Dtp6L3HLk7rLWSvm3NGg+jh6tz/eO3V4ddJ4HAMdjZOyXxbuZV/gs3kvjW8Xj8AgICVo82EiJ0YfR3tKNE95lkRZgFmz1mU8K6Huvqtx/9uOHumw+OKUWv9oo/mUcuma9JhKiC+3kyTp+7JQiLQTY1PTE1ATYYz9WyR9IhJuyB/DWou4Ydl/m/jyRc07xF3lV7X/1LqK0BoL/ZDRWUUdbiQppFzcgrwE4yyIq4R4Tj7AadrsKbxxVbfn2Mta8aPA3jrRNkvHmAWVQeHX5im+kT08ySTzqOAL9zlOkV6IDsq/OFDzp3qdMpx9f3YFM3JX197ytMwNX9ozEGx1aRj/YmRY+EtzD2n6u1Bjq+AanB8SjcCRq0SZbyrpliWVAY0KVsOtlzLXTxAd+472b7ZRqoTrgadl3D3y25tDsNLSTGzd8XsH8PNxMvDifzsMt4ALyYspoJILuMzkqqkZUkn/eE4ZEmZUszaRdKYX/p8OEZSNf2jp4Mnah0HSrI3JHusbXQvz1RGH4bsDYstXi+NudBuHtuZLUkSqmtDIeiWuvnra41oxy/BDcMXYdNVHpHvpNkF/mCgK1KEqm5U4tC+MrsTzyxdqeZ6SwMogQ=","expiration":"Aug 1, 2024, 12:14:50 AM"},"assumedRoleUser":{"assumedRoleId":"AROAI4TSRELAFLOMQOMX6:TrustedAdvisor_733177541390_1df22b6c-39cb-479f-ab54-8a542db76fe8","arn":"arn:aws:sts::733177541390:assumed-role/AWSServiceRoleForTrustedAdvisor/TrustedAdvisor_733177541390_1df22b6c-39cb-479f-ab54-8a542db76fe8"}},"requestID":"f4fce44f-1db5-403a-bf6a-b2f8dace0779","eventID":"26af8a32-382e-3313-9078-bdf4fa23ac82","readOnly":true,"resources":[{"accountId":"733177541390","type":"AWS::IAM::Role","ARN":"arn:aws:iam::733177541390:role/aws-service-role/226.234.218.252/AWSServiceRoleForTrustedAdvisor"}],"eventType":"AwsApiCall","managementEvent":true,"recipientAccountId":"733177541390","sharedEventID":"6f360cda-e723-4d2c-9015-aa5a7c8c5c57","eventCategory":"Management"}
This is a syslog message from a product called aws_cloud_trail by aws_cloud_trail. The following fields were extracted from the message:
clientIP: 226.234.218.252
fieldExtractorName: aws_cloud_trail
messageType: audit_log
ruleCategory: AwsApiCall
ruleName: AssumeRole
senderHost: 733177541390_CloudTrail_us-east-1
sensitivity: normal
sourceInfo: unknown
streamName: aws_cloud_trail
tags: ['us-east-2', 'aws_cloud_trail', 'audit_log']
vendorCode: sts.amazonaws.com