{"eventVersion":"1.08","userIdentity":{"type":"AWSService","invokedBy":"211.29.244.154"},"eventTime":"2024-07-31T23:59:50Z","eventSource":"sts.amazonaws.com","eventName":"AssumeRole","awsRegion":"us-east-2","sourceIPAddress":"211.29.244.154","userAgent":"211.29.244.154","requestParameters":{"roleArn":"arn:aws:iam::733177541390:role/aws-service-role/211.29.244.154/AWSServiceRoleForTrustedAdvisor","roleSessionName":"TrustedAdvisor_733177541390_bde4d8b1-4d13-4cfa-97b3-f7fd8c3fe4f2","durationSeconds":900},"responseElements":{"credentials":{"accessKeyId":"ASIA2VNGJOMHPSFL3DP7","sessionToken":"IQoJb3JpZ2luX2VjEID//////////wEaCXVzLWVhc3QtMiJIMEYCIQCWYTnA7ZwjSwvPE6lWhkmIFtRwcIhhaGiS16PY6/g7IgIhAJx+2l8YkNnKwz2k07nFEJH2myIWj0uyJiseFR3DUx37KpMDCGkQABoMNzMzMTc3NTQxMzkwIgzD3APdrri5dYNw3VQq8ALZV96H0vQK9K6LUOAcU3jC8t+HdvZ7bxOsb56LIqv6+LZt8XDb1ID3qkyxT0lytPVN+2LNKFtY4IYjFj3PAjPg317NSNm2goCZFmcPGcUb7kyLsmwwuZExtugB/Zq7Ms2Im/aA8QGVZr7cnlye2Husvz88CDlcznI0y0Xo6SuMrKDNVVACn0JJhmZv67suUp7n9OFMmuIe1bVUjMZB15PKq4cu3aXfB+SCuQ8pl3ouaeBqeRaDlvzbwDW3eLRfll6PlUpKk2iBXMTF+wo+C518FVM8ihM9vStMJhJjqxK5MLcysPMGP6RUmOm0XpnJG39ctRiJFu7uFIm8fp6e+5wPX/pd2B3ZGLr0Z3HFYVjuiBWjmkQQvBWeN+MxjGQITzoyz4A/bFs2YWtdvlDlcT9B1WRfCyr+Z7kmwZgBtCOPQpJa8mV5wlnvhyQ3d+fZureH1ErFO1tDbCtuMlkPEVPkn2rnzXW/uyOm9SwBVabgZjD2n6u1Bjq+Aas+egfVbDBGwLUEwS8CXp0ilmtGDsS8bhVBjFcJLYFZEy8VB1yf7Pf2jplOD8A/kGyzpfUiceGDLrGjq7yLzKVZnKUZZipwBT+/FpNB+7S5UqTcjF/F1TGBxrD2pM2BiE05o7d6QAikBlYUEL3FAX3eGtFx66BRfbBzyEROr4bFWmyFnktlX61owDhSHJ+ibqysFV17l64tBMpdx/MqP6cP5Na/azK8TZ3mE1RfqwwMkK5szQ9Y+XQPBstdxrY=","expiration":"Aug 1, 2024, 12:14:50 AM"},"assumedRoleUser":{"assumedRoleId":"AROAI4TSRELAFLOMQOMX6:TrustedAdvisor_733177541390_bde4d8b1-4d13-4cfa-97b3-f7fd8c3fe4f2","arn":"arn:aws:sts::733177541390:assumed-role/AWSServiceRoleForTrustedAdvisor/TrustedAdvisor_733177541390_bde4d8b1-4d13-4cfa-97b3-f7fd8c3fe4f2"}},"requestID":"ae74249e-fcac-4f81-a32b-a138c1e05e7d","eventID":"573b2c6d-9ead-3752-b88f-e064f867bdf1","readOnly":true,"resources":[{"accountId":"733177541390","type":"AWS::IAM::Role","ARN":"arn:aws:iam::733177541390:role/aws-service-role/211.29.244.154/AWSServiceRoleForTrustedAdvisor"}],"eventType":"AwsApiCall","managementEvent":true,"recipientAccountId":"733177541390","sharedEventID":"cb7bd842-7f4b-46a1-89a6-191ebd78fe6d","eventCategory":"Management"}
This is a syslog message from a product called aws_cloud_trail by aws_cloud_trail. The following fields were extracted from the message:
clientIP: 211.29.244.154
fieldExtractorName: aws_cloud_trail
messageType: audit_log
ruleCategory: AwsApiCall
ruleName: AssumeRole
senderHost: 733177541390_CloudTrail_us-east-1
sensitivity: normal
sourceInfo: unknown
streamName: aws_cloud_trail
tags: ['us-east-2', 'aws_cloud_trail', 'audit_log']
vendorCode: sts.amazonaws.com