{"eventVersion":"1.08","userIdentity":{"type":"AWSService","invokedBy":"219.186.253.93"},"eventTime":"2024-07-31T23:59:54Z","eventSource":"sts.amazonaws.com","eventName":"AssumeRole","awsRegion":"us-east-2","sourceIPAddress":"219.186.253.93","userAgent":"219.186.253.93","requestParameters":{"roleArn":"arn:aws:iam::733177541390:role/aws-service-role/219.186.253.93/AWSServiceRoleForTrustedAdvisor","roleSessionName":"TrustedAdvisor_733177541390_3f70ce4f-ca1b-47c7-a716-3505892dba3b","durationSeconds":900},"responseElements":{"credentials":{"accessKeyId":"ASIA2VNGJOMHJUUE25M2","sessionToken":"IQoJb3JpZ2luX2VjEID//////////wEaCXVzLWVhc3QtMiJIMEYCIQDgaU0hxcJ3V0bakvX3zpgnvYMnjajSYon68sOcCb8/IQIhAKt4PHh9iiTxP+RaO8Np9FFuk4SShMcRHM3kDyUDLaL8KpMDCGkQABoMNzMzMTc3NTQxMzkwIgyseCRYlaOuf9rWfNsq8AKMB9meuFK/HvlAgVESzy4Myro8PuG6yU1fwI4B4ElUTiuG2F61PpEkQ486UEskEgd+ZJxchOqcxhvekdHbD1kuwsIK9jmI3goZfIyDtPenwwYmuDmziXhWfRIgXsMY7mTpFBiUN94IZWQRowVixyi8b9tGNxzVec7aemXozU8YkfUW1XiHHuj3a+OGWoX94u79sg1RjrNg/rjMF0vPGYVBiaThhCHFjYBOyOiXDhPB44NGkBOSgbJ22RGHklg34lsMFThQzkSXlNnYBJZwwbfRoMeFkUNg5jaiVp/KdVabR0mBHwtqtd5rC6B0QfaMDXlcpV+93DOBdJvKoyOlaqOMPqU7aYHDH+cuOdluqmZn2LjLizZaoQ3tRqsqH3VLcDXeBNsjAYpUO/+mdwzzwbrz3d/KNUU0FgGylYMXdCHb7HtW+YeKn1qBFg9z4+TfQU0da31HdB+c6GrRwlFX834tUWtau9Slnn6MbkJQQzgcijD6n6u1Bjq+AV00x39iW8gad+uv8khjzvL8OuFywo4xA1pl2TQHwBUjTdhNqTfHNsZEdi6E64GLXZB0pi5YaWcKjCIZJRKQ/w+49UDP3iuD7wR7Hk5gyV5IiZYvDHb+XFpGENdYJU9g34GWL6zaQdE/A9+pAyFWW/gp8FpaVDoXJbA+FMLeQjrw7MCu9LcS4rOhrHlk+QJY+MusIqPOTppwYo4NwDVGlcsmxLSoIIcl9ahK+MMLxpi4Bg9wG+fy+/zuSN3huCk=","expiration":"Aug 1, 2024, 12:14:54 AM"},"assumedRoleUser":{"assumedRoleId":"AROAI4TSRELAFLOMQOMX6:TrustedAdvisor_733177541390_3f70ce4f-ca1b-47c7-a716-3505892dba3b","arn":"arn:aws:sts::733177541390:assumed-role/AWSServiceRoleForTrustedAdvisor/TrustedAdvisor_733177541390_3f70ce4f-ca1b-47c7-a716-3505892dba3b"}},"requestID":"86265055-1441-4da0-a7d0-a885c367b31e","eventID":"c5612fe3-979b-3afe-a8f4-b758716378da","readOnly":true,"resources":[{"accountId":"733177541390","type":"AWS::IAM::Role","ARN":"arn:aws:iam::733177541390:role/aws-service-role/219.186.253.93/AWSServiceRoleForTrustedAdvisor"}],"eventType":"AwsApiCall","managementEvent":true,"recipientAccountId":"733177541390","sharedEventID":"52796a64-99cd-425f-afab-5aa3d21c736f","eventCategory":"Management"}
This is a syslog message from a product called aws_cloud_trail by aws_cloud_trail. The following fields were extracted from the message:
clientIP: 219.186.253.93
fieldExtractorName: aws_cloud_trail
messageType: audit_log
ruleCategory: AwsApiCall
ruleName: AssumeRole
senderHost: 733177541390_CloudTrail_us-east-1
sensitivity: normal
sourceInfo: unknown
streamName: aws_cloud_trail
tags: ['us-east-2', 'aws_cloud_trail', 'audit_log']
vendorCode: sts.amazonaws.com