{"eventVersion":"1.08","userIdentity":{"type":"AWSService","invokedBy":"162.203.66.157"},"eventTime":"2024-07-31T23:59:49Z","eventSource":"sts.amazonaws.com","eventName":"AssumeRole","awsRegion":"us-east-2","sourceIPAddress":"162.203.66.157","userAgent":"162.203.66.157","requestParameters":{"roleArn":"arn:aws:iam::733177541390:role/aws-service-role/162.203.66.157/AWSServiceRoleForTrustedAdvisor","roleSessionName":"TrustedAdvisor_733177541390_89d27f12-7ab8-4939-9fb1-b9ac3ab02462","durationSeconds":900},"responseElements":{"credentials":{"accessKeyId":"ASIA2VNGJOMHDYI5WBGH","sessionToken":"IQoJb3JpZ2luX2VjEID//////////wEaCXVzLWVhc3QtMiJGMEQCIHZLqNNT21RMXazW8Kqm4XDElScxlOTxo4S+BhFJdingAiBrVncMLs0ejHTSo4UO+3zr3z6ZiiVmE1xAhcE/qWpK3SqTAwhpEAAaDDczMzE3NzU0MTM5MCIMmpMUL8dBa4rRxDfIKvAC2fDnWbrIgUUSjDs0MtPzztuPb5XtzvPv3gOpsHrCsU1cBV+Teje6P1vxDouokEnUnLBVWTgGDdtZlJlZUht29oma+HjJ86ziWs5GcZ+bbx3HGRbO2cbFnOj71mZiwMV1ul2VMsMXPwN0IOq3p8ujQlb3JXkJo8slEmsS6sMq4Ed/W4InQUv7sDZi5WfONHezgXkF0mEWBjJmkLqkHjIdExOROyZ2xbDhR9vXVPaGOady2skjVz6e2Tpew2MeXGrAJQ9NU3fO0Kxvv7AOnO5uPPuvJ1i18m3+gy+keV3WzPLn9vrlHleJLg6sh5v1OgSTaZlUVF4SgMs8Tq6DG4psJvrLpKQjRk3H0Ec7unz+AZjyN1t0SknNGAEhXSjNOoL22Mqgja74tN/csTcIGDoBp3pUU9/LKpp4ni4nSy/hMr5QgJgoy3CFr6pbPpjUYj3Lqo0Me0f+lzAtEfU4GhjveNGLWJa+R9Lva+e3g/elCOsw9Z+rtQY6wAEy01YtBGPr6SHQUeNJLIpEN5hZsFOVFM9qR/s2RWsRhh8RpPaOzp/SAWCMkRHRbquK3n6rbkisTpW75ELsrdbsQQGhti1HBtOS5YENSXy5jxAGrxRu82X5h+mMaBRgFYixLt6LUKK+l6AJJxhnSB3ZkAPGUQH6Xkmjn8owWh9PKP47BalZ9u0oqkiGKxUYnWW7PRO5TT1sqAArd3IXfCRVwMgENk2SEJNUaGHYTGbUAmla/JUKh2k6vUufdEc79os=","expiration":"Aug 1, 2024, 12:14:49 AM"},"assumedRoleUser":{"assumedRoleId":"AROAI4TSRELAFLOMQOMX6:TrustedAdvisor_733177541390_89d27f12-7ab8-4939-9fb1-b9ac3ab02462","arn":"arn:aws:sts::733177541390:assumed-role/AWSServiceRoleForTrustedAdvisor/TrustedAdvisor_733177541390_89d27f12-7ab8-4939-9fb1-b9ac3ab02462"}},"requestID":"7e34ce5d-b9d4-46df-a96b-f932fd5eb5d6","eventID":"87bc5609-4144-3de9-904c-15be4f6805ed","readOnly":true,"resources":[{"accountId":"733177541390","type":"AWS::IAM::Role","ARN":"arn:aws:iam::733177541390:role/aws-service-role/162.203.66.157/AWSServiceRoleForTrustedAdvisor"}],"eventType":"AwsApiCall","managementEvent":true,"recipientAccountId":"733177541390","sharedEventID":"9223cde9-6a4d-4a04-a7eb-50f33e15e37c","eventCategory":"Management"}
This is a syslog message from a product called aws_cloud_trail by aws_cloud_trail. The following fields were extracted from the message:
clientIP: 162.203.66.157
fieldExtractorName: aws_cloud_trail
messageType: audit_log
ruleCategory: AwsApiCall
ruleName: AssumeRole
senderHost: 733177541390_CloudTrail_us-east-1
sensitivity: normal
sourceInfo: unknown
streamName: aws_cloud_trail
tags: ['us-east-2', 'aws_cloud_trail', 'audit_log']
vendorCode: sts.amazonaws.com