Task: attack_reconstruction (flaws_cloudtrail)
Prompt: One principal appears to gain a foothold and then conduct a broad AWS inventory sweep spanning IAM, EC2/VPC, S3, Lambda, and RDS. Identify the responsible principal, the MITRE ATT&CK technique that best describes the behavior, the supporting CloudTrail record_ids grouped by each phase of the chain, and the impacted AWS assets. Return a JSON object matching the AttackReconstructionAnswer schema. Use principal.arn for primary_actor, the MITRE ATT&CK ID (e.g. T1530) for technique, and group the supporting CloudTrail record_ids by attack phase. List the AWS asset identifiers (bucket names, role/user names, trail names, ARNs) the attack acted on as impacted_assets.
Answer schema: attack_reconstruction_answer

CloudTrail records:
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d41e7254-6cf3-4fff-8682-f04a768f24e7", "record_id": "flaws_cloudtrail:0000000:d41e7254-6cf3-4fff-8682-f04a768f24e7", "row_index": 0, "timestamp": "2019-08-15T10:13:23Z", "event_type": "GetRestApis", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 874, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d41e7254-6cf3-4fff-8682-f04a768f24e7", "eventTime": "2019-08-15T10:13:23Z", "eventName": "GetRestApis", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: apigateway:GET on resource: arn:aws:apigateway:us-west-2::/restapis", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8a86cf2a-d04b-4978-9ef9-440ed328a611", "record_id": "flaws_cloudtrail:0000001:8a86cf2a-d04b-4978-9ef9-440ed328a611", "row_index": 1, "timestamp": "2019-08-15T10:14:07Z", "event_type": "GetRestApi", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 832, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8a86cf2a-d04b-4978-9ef9-440ed328a611", "eventTime": "2019-08-15T10:14:07Z", "eventName": "GetRestApi", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "awsRegion": "us-west-2", "errorCode": "NotFoundException", "errorMessage": "Invalid API identifier specified 811596193553:puspzvwgb6", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "puspzvwgb6", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8a86cf2a-d04b-4978-9ef9-440ed328a611", "record_id": "flaws_cloudtrail:0000002:8a86cf2a-d04b-4978-9ef9-440ed328a611", "row_index": 2, "timestamp": "2019-08-15T10:14:07Z", "event_type": "GetRestApi", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 832, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8a86cf2a-d04b-4978-9ef9-440ed328a611", "eventTime": "2019-08-15T10:14:07Z", "eventName": "GetRestApi", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "awsRegion": "us-west-2", "errorCode": "NotFoundException", "errorMessage": "Invalid API identifier specified 811596193553:puspzvwgb6", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "puspzvwgb6", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0771deb9-75d5-43de-bd82-708cdeaa1c42", "record_id": "flaws_cloudtrail:0000003:0771deb9-75d5-43de-bd82-708cdeaa1c42", "row_index": 3, "timestamp": "2019-08-15T10:14:27Z", "event_type": "GetRestApi", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 832, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0771deb9-75d5-43de-bd82-708cdeaa1c42", "eventTime": "2019-08-15T10:14:27Z", "eventName": "GetRestApi", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "awsRegion": "us-west-2", "errorCode": "NotFoundException", "errorMessage": "Invalid API identifier specified 811596193553:puspzvwgb6", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "puspzvwgb6", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0771deb9-75d5-43de-bd82-708cdeaa1c42", "record_id": "flaws_cloudtrail:0000004:0771deb9-75d5-43de-bd82-708cdeaa1c42", "row_index": 4, "timestamp": "2019-08-15T10:14:27Z", "event_type": "GetRestApi", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 832, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0771deb9-75d5-43de-bd82-708cdeaa1c42", "eventTime": "2019-08-15T10:14:27Z", "eventName": "GetRestApi", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "awsRegion": "us-west-2", "errorCode": "NotFoundException", "errorMessage": "Invalid API identifier specified 811596193553:puspzvwgb6", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "puspzvwgb6", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ff75f8b7-66f2-4197-b3f0-bac9de3388a1", "record_id": "flaws_cloudtrail:0000005:ff75f8b7-66f2-4197-b3f0-bac9de3388a1", "row_index": 5, "timestamp": "2019-08-15T10:15:14Z", "event_type": "GetRestApi", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 830, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ff75f8b7-66f2-4197-b3f0-bac9de3388a1", "eventTime": "2019-08-15T10:15:14Z", "eventName": "GetRestApi", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "awsRegion": "us-west-2", "errorCode": "NotFoundException", "errorMessage": "Invalid API identifier specified 811596193553:puspzvwgb6", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "puspzvwgb6", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ff75f8b7-66f2-4197-b3f0-bac9de3388a1", "record_id": "flaws_cloudtrail:0000006:ff75f8b7-66f2-4197-b3f0-bac9de3388a1", "row_index": 6, "timestamp": "2019-08-15T10:15:14Z", "event_type": "GetRestApi", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 830, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ff75f8b7-66f2-4197-b3f0-bac9de3388a1", "eventTime": "2019-08-15T10:15:14Z", "eventName": "GetRestApi", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "awsRegion": "us-west-2", "errorCode": "NotFoundException", "errorMessage": "Invalid API identifier specified 811596193553:puspzvwgb6", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "puspzvwgb6", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ddcaf7d0-939e-4920-9547-99cb68bb9155", "record_id": "flaws_cloudtrail:0000007:ddcaf7d0-939e-4920-9547-99cb68bb9155", "row_index": 7, "timestamp": "2019-08-15T10:15:49Z", "event_type": "GetRestApi", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 834, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ddcaf7d0-939e-4920-9547-99cb68bb9155", "eventTime": "2019-08-15T10:15:49Z", "eventName": "GetRestApi", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "awsRegion": "us-west-2", "errorCode": "NotFoundException", "errorMessage": "Invalid API identifier specified 811596193553:puspzvwgb6/", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "puspzvwgb6/", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ddcaf7d0-939e-4920-9547-99cb68bb9155", "record_id": "flaws_cloudtrail:0000008:ddcaf7d0-939e-4920-9547-99cb68bb9155", "row_index": 8, "timestamp": "2019-08-15T10:15:49Z", "event_type": "GetRestApi", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 834, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ddcaf7d0-939e-4920-9547-99cb68bb9155", "eventTime": "2019-08-15T10:15:49Z", "eventName": "GetRestApi", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "awsRegion": "us-west-2", "errorCode": "NotFoundException", "errorMessage": "Invalid API identifier specified 811596193553:puspzvwgb6/", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "puspzvwgb6/", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5ca503865-0687-459e-b843-5e46b8a3fc38", "record_id": "flaws_cloudtrail:0000009:5ca503865-0687-459e-b843-5e46b8a3fc38", "row_index": 9, "timestamp": "2019-08-15T10:16:11Z", "event_type": "GetRestApi", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 837, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5ca503865-0687-459e-b843-5e46b8a3fc38", "eventTime": "2019-08-15T10:16:11Z", "eventName": "GetRestApi", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "awsRegion": "us-west-2", "errorCode": "NotFoundException", "errorMessage": "Invalid API identifier specified 811596193553:puspzvwgb6/*", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "puspzvwgb6/*", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5ca503865-0687-459e-b843-5e46b8a3fc38", "record_id": "flaws_cloudtrail:0000010:5ca503865-0687-459e-b843-5e46b8a3fc38", "row_index": 10, "timestamp": "2019-08-15T10:16:11Z", "event_type": "GetRestApi", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 837, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5ca503865-0687-459e-b843-5e46b8a3fc38", "eventTime": "2019-08-15T10:16:11Z", "eventName": "GetRestApi", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "awsRegion": "us-west-2", "errorCode": "NotFoundException", "errorMessage": "Invalid API identifier specified 811596193553:puspzvwgb6/*", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "puspzvwgb6/*", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a1e077874-8629-4f83-88cf-198bde16c960", "record_id": "flaws_cloudtrail:0000011:a1e077874-8629-4f83-88cf-198bde16c960", "row_index": 11, "timestamp": "2019-08-15T10:16:41Z", "event_type": "GetRestApi", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 919, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a1e077874-8629-4f83-88cf-198bde16c960", "eventTime": "2019-08-15T10:16:41Z", "eventName": "GetRestApi", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "awsRegion": "us-west-2", "errorCode": "NotFoundException", "errorMessage": "Invalid API identifier specified 811596193553:arn:aws:execute-api:us-west-2:811596193553:puspzvwgb6", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "arn:aws:execute-api:us-west-2:811596193553:puspzvwgb6", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a1e077874-8629-4f83-88cf-198bde16c960", "record_id": "flaws_cloudtrail:0000012:a1e077874-8629-4f83-88cf-198bde16c960", "row_index": 12, "timestamp": "2019-08-15T10:16:41Z", "event_type": "GetRestApi", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 919, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a1e077874-8629-4f83-88cf-198bde16c960", "eventTime": "2019-08-15T10:16:41Z", "eventName": "GetRestApi", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "awsRegion": "us-west-2", "errorCode": "NotFoundException", "errorMessage": "Invalid API identifier specified 811596193553:arn:aws:execute-api:us-west-2:811596193553:puspzvwgb6", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "arn:aws:execute-api:us-west-2:811596193553:puspzvwgb6", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8c10eb3f-70ad-42d8-9069-849f59f90b11", "record_id": "flaws_cloudtrail:0000013:8c10eb3f-70ad-42d8-9069-849f59f90b11", "row_index": 13, "timestamp": "2019-08-15T10:16:54Z", "event_type": "GetRestApi", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 832, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8c10eb3f-70ad-42d8-9069-849f59f90b11", "eventTime": "2019-08-15T10:16:54Z", "eventName": "GetRestApi", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "awsRegion": "us-west-2", "errorCode": "NotFoundException", "errorMessage": "Invalid API identifier specified 811596193553:puspzvwgb6", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "puspzvwgb6", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8c10eb3f-70ad-42d8-9069-849f59f90b11", "record_id": "flaws_cloudtrail:0000014:8c10eb3f-70ad-42d8-9069-849f59f90b11", "row_index": 14, "timestamp": "2019-08-15T10:16:54Z", "event_type": "GetRestApi", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 832, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8c10eb3f-70ad-42d8-9069-849f59f90b11", "eventTime": "2019-08-15T10:16:54Z", "eventName": "GetRestApi", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "awsRegion": "us-west-2", "errorCode": "NotFoundException", "errorMessage": "Invalid API identifier specified 811596193553:puspzvwgb6", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "puspzvwgb6", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "27faa83b-fd39-4b71-9a92-218d76f5dd3e", "record_id": "flaws_cloudtrail:0000015:27faa83b-fd39-4b71-9a92-218d76f5dd3e", "row_index": 15, "timestamp": "2019-08-15T10:18:25Z", "event_type": "GetRestApis", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 874, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "27faa83b-fd39-4b71-9a92-218d76f5dd3e", "eventTime": "2019-08-15T10:18:25Z", "eventName": "GetRestApis", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: apigateway:GET on resource: arn:aws:apigateway:us-west-2::/restapis", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "27faa83b-fd39-4b71-9a92-218d76f5dd3e", "record_id": "flaws_cloudtrail:0000016:27faa83b-fd39-4b71-9a92-218d76f5dd3e", "row_index": 16, "timestamp": "2019-08-15T10:18:25Z", "event_type": "GetRestApis", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 874, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "27faa83b-fd39-4b71-9a92-218d76f5dd3e", "eventTime": "2019-08-15T10:18:25Z", "eventName": "GetRestApis", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: apigateway:GET on resource: arn:aws:apigateway:us-west-2::/restapis", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0f28bdf1-ffd2-4667-a406-1391d391f3aa", "record_id": "flaws_cloudtrail:0000017:0f28bdf1-ffd2-4667-a406-1391d391f3aa", "row_index": 17, "timestamp": "2019-08-15T10:18:32Z", "event_type": "GetRestApis", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 874, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0f28bdf1-ffd2-4667-a406-1391d391f3aa", "eventTime": "2019-08-15T10:18:32Z", "eventName": "GetRestApis", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: apigateway:GET on resource: arn:aws:apigateway:us-east-1::/restapis", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0f28bdf1-ffd2-4667-a406-1391d391f3aa", "record_id": "flaws_cloudtrail:0000018:0f28bdf1-ffd2-4667-a406-1391d391f3aa", "row_index": 18, "timestamp": "2019-08-15T10:18:32Z", "event_type": "GetRestApis", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 874, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0f28bdf1-ffd2-4667-a406-1391d391f3aa", "eventTime": "2019-08-15T10:18:32Z", "eventName": "GetRestApis", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: apigateway:GET on resource: arn:aws:apigateway:us-east-1::/restapis", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2fb0e51f-870a-4fac-b287-77fb016720e6d", "record_id": "flaws_cloudtrail:0000019:2fb0e51f-870a-4fac-b287-77fb016720e6d", "row_index": 19, "timestamp": "2019-08-15T10:21:24Z", "event_type": "GetResources", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 897, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2fb0e51f-870a-4fac-b287-77fb016720e6d", "eventTime": "2019-08-15T10:21:24Z", "eventName": "GetResources", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: apigateway:GET on resource: arn:aws:apigateway:us-east-1::/restapis/puspzvwgb6/resources", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2fb0e51f-870a-4fac-b287-77fb016720e6d", "record_id": "flaws_cloudtrail:0000020:2fb0e51f-870a-4fac-b287-77fb016720e6d", "row_index": 20, "timestamp": "2019-08-15T10:21:24Z", "event_type": "GetResources", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 897, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2fb0e51f-870a-4fac-b287-77fb016720e6d", "eventTime": "2019-08-15T10:21:24Z", "eventName": "GetResources", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: apigateway:GET on resource: arn:aws:apigateway:us-east-1::/restapis/puspzvwgb6/resources", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1a6cea67-9a83-4f05-b248-6049df6d7510", "record_id": "flaws_cloudtrail:0000021:1a6cea67-9a83-4f05-b248-6049df6d7510", "row_index": 21, "timestamp": "2019-08-15T10:21:30Z", "event_type": "GetResources", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 896, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1a6cea67-9a83-4f05-b248-6049df6d7510", "eventTime": "2019-08-15T10:21:30Z", "eventName": "GetResources", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "awsRegion": "us-east-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: apigateway:GET on resource: arn:aws:apigateway:us-east-2::/restapis/puspzvwgb6/resources", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1a6cea67-9a83-4f05-b248-6049df6d7510", "record_id": "flaws_cloudtrail:0000022:1a6cea67-9a83-4f05-b248-6049df6d7510", "row_index": 22, "timestamp": "2019-08-15T10:21:30Z", "event_type": "GetResources", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 896, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1a6cea67-9a83-4f05-b248-6049df6d7510", "eventTime": "2019-08-15T10:21:30Z", "eventName": "GetResources", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "awsRegion": "us-east-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: apigateway:GET on resource: arn:aws:apigateway:us-east-2::/restapis/puspzvwgb6/resources", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "04a26f33-a7a8-45ed-8ff8-2725d1d958e3", "record_id": "flaws_cloudtrail:0000023:04a26f33-a7a8-45ed-8ff8-2725d1d958e3", "row_index": 23, "timestamp": "2019-08-15T10:21:52Z", "event_type": "GetStages", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 889, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "04a26f33-a7a8-45ed-8ff8-2725d1d958e3", "eventTime": "2019-08-15T10:21:52Z", "eventName": "GetStages", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "awsRegion": "us-east-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: apigateway:GET on resource: arn:aws:apigateway:us-east-2::/restapis/puspzvwgb6/stages", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "04a26f33-a7a8-45ed-8ff8-2725d1d958e3", "record_id": "flaws_cloudtrail:0000024:04a26f33-a7a8-45ed-8ff8-2725d1d958e3", "row_index": 24, "timestamp": "2019-08-15T10:21:52Z", "event_type": "GetStages", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 889, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "04a26f33-a7a8-45ed-8ff8-2725d1d958e3", "eventTime": "2019-08-15T10:21:52Z", "eventName": "GetStages", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "awsRegion": "us-east-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: apigateway:GET on resource: arn:aws:apigateway:us-east-2::/restapis/puspzvwgb6/stages", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "80d5095b-02a8-46a2-beee-cdf29711e4d7", "record_id": "flaws_cloudtrail:0000025:80d5095b-02a8-46a2-beee-cdf29711e4d7", "row_index": 25, "timestamp": "2019-08-15T10:22:07Z", "event_type": "GetStages", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 831, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "80d5095b-02a8-46a2-beee-cdf29711e4d7", "eventTime": "2019-08-15T10:22:07Z", "eventName": "GetStages", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "awsRegion": "us-west-2", "errorCode": "NotFoundException", "errorMessage": "Invalid API identifier specified 811596193553:puspzvwgb6", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "puspzvwgb6", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "80d5095b-02a8-46a2-beee-cdf29711e4d7", "record_id": "flaws_cloudtrail:0000026:80d5095b-02a8-46a2-beee-cdf29711e4d7", "row_index": 26, "timestamp": "2019-08-15T10:22:07Z", "event_type": "GetStages", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 831, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "80d5095b-02a8-46a2-beee-cdf29711e4d7", "eventTime": "2019-08-15T10:22:07Z", "eventName": "GetStages", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "awsRegion": "us-west-2", "errorCode": "NotFoundException", "errorMessage": "Invalid API identifier specified 811596193553:puspzvwgb6", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "puspzvwgb6", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ab799a6d-c631-415b-a470-0cf7fb793d1b", "record_id": "flaws_cloudtrail:0000027:ab799a6d-c631-415b-a470-0cf7fb793d1b", "row_index": 27, "timestamp": "2019-08-15T10:24:16Z", "event_type": "GetRestApis", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 874, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ab799a6d-c631-415b-a470-0cf7fb793d1b", "eventTime": "2019-08-15T10:24:16Z", "eventName": "GetRestApis", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: apigateway:GET on resource: arn:aws:apigateway:us-west-2::/restapis", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ab799a6d-c631-415b-a470-0cf7fb793d1b", "record_id": "flaws_cloudtrail:0000028:ab799a6d-c631-415b-a470-0cf7fb793d1b", "row_index": 28, "timestamp": "2019-08-15T10:24:16Z", "event_type": "GetRestApis", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 874, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ab799a6d-c631-415b-a470-0cf7fb793d1b", "eventTime": "2019-08-15T10:24:16Z", "eventName": "GetRestApis", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: apigateway:GET on resource: arn:aws:apigateway:us-west-2::/restapis", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b6e04187-f945-437c-abfa-bf0de468adf5", "record_id": "flaws_cloudtrail:0000029:b6e04187-f945-437c-abfa-bf0de468adf5", "row_index": 29, "timestamp": "2019-08-15T10:24:35Z", "event_type": "GetRestApis", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 874, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b6e04187-f945-437c-abfa-bf0de468adf5", "eventTime": "2019-08-15T10:24:35Z", "eventName": "GetRestApis", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: apigateway:GET on resource: arn:aws:apigateway:us-east-1::/restapis", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b6e04187-f945-437c-abfa-bf0de468adf5", "record_id": "flaws_cloudtrail:0000030:b6e04187-f945-437c-abfa-bf0de468adf5", "row_index": 30, "timestamp": "2019-08-15T10:24:35Z", "event_type": "GetRestApis", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 874, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b6e04187-f945-437c-abfa-bf0de468adf5", "eventTime": "2019-08-15T10:24:35Z", "eventName": "GetRestApis", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: apigateway:GET on resource: arn:aws:apigateway:us-east-1::/restapis", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9fed75b4-2b81-4c30-bf1d-603ff688478b", "record_id": "flaws_cloudtrail:0000031:9fed75b4-2b81-4c30-bf1d-603ff688478b", "row_index": 31, "timestamp": "2019-08-15T10:24:53Z", "event_type": "GetRestApis", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 874, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9fed75b4-2b81-4c30-bf1d-603ff688478b", "eventTime": "2019-08-15T10:24:53Z", "eventName": "GetRestApis", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: apigateway:GET on resource: arn:aws:apigateway:us-east-1::/restapis", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9fed75b4-2b81-4c30-bf1d-603ff688478b", "record_id": "flaws_cloudtrail:0000032:9fed75b4-2b81-4c30-bf1d-603ff688478b", "row_index": 32, "timestamp": "2019-08-15T10:24:53Z", "event_type": "GetRestApis", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 874, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9fed75b4-2b81-4c30-bf1d-603ff688478b", "eventTime": "2019-08-15T10:24:53Z", "eventName": "GetRestApis", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: apigateway:GET on resource: arn:aws:apigateway:us-east-1::/restapis", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "70b4dedd-af15-413e-a432-0675a6e34c5f", "record_id": "flaws_cloudtrail:0000033:70b4dedd-af15-413e-a432-0675a6e34c5f", "row_index": 33, "timestamp": "2019-08-15T10:28:48Z", "event_type": "GetStages", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 831, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "70b4dedd-af15-413e-a432-0675a6e34c5f", "eventTime": "2019-08-15T10:28:48Z", "eventName": "GetStages", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "awsRegion": "us-west-2", "errorCode": "NotFoundException", "errorMessage": "Invalid API identifier specified 811596193553:puspzvwgb6", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "puspzvwgb6", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "70b4dedd-af15-413e-a432-0675a6e34c5f", "record_id": "flaws_cloudtrail:0000034:70b4dedd-af15-413e-a432-0675a6e34c5f", "row_index": 34, "timestamp": "2019-08-15T10:28:48Z", "event_type": "GetStages", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 831, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "70b4dedd-af15-413e-a432-0675a6e34c5f", "eventTime": "2019-08-15T10:28:48Z", "eventName": "GetStages", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.210 Python/3.7.4 Darwin/18.7.0 botocore/1.12.200", "awsRegion": "us-west-2", "errorCode": "NotFoundException", "errorMessage": "Invalid API identifier specified 811596193553:puspzvwgb6", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "puspzvwgb6", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "df546a3d-3436-47f3-ad5d-9aa264d30324", "record_id": "flaws_cloudtrail:0000035:df546a3d-3436-47f3-ad5d-9aa264d30324", "row_index": 35, "timestamp": "2019-08-15T10:34:02Z", "event_type": "GetStages", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 827, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "df546a3d-3436-47f3-ad5d-9aa264d30324", "eventTime": "2019-08-15T10:34:02Z", "eventName": "GetStages", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "awsRegion": "us-west-2", "errorCode": "NotFoundException", "errorMessage": "Invalid API identifier specified 811596193553:puspzvwgb6", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "puspzvwgb6", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "df546a3d-3436-47f3-ad5d-9aa264d30324", "record_id": "flaws_cloudtrail:0000036:df546a3d-3436-47f3-ad5d-9aa264d30324", "row_index": 36, "timestamp": "2019-08-15T10:34:02Z", "event_type": "GetStages", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 827, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "df546a3d-3436-47f3-ad5d-9aa264d30324", "eventTime": "2019-08-15T10:34:02Z", "eventName": "GetStages", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "awsRegion": "us-west-2", "errorCode": "NotFoundException", "errorMessage": "Invalid API identifier specified 811596193553:puspzvwgb6", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "puspzvwgb6", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "77d6acf6-72cf-4dea-a7f5-9abde4a716bf", "record_id": "flaws_cloudtrail:0000037:77d6acf6-72cf-4dea-a7f5-9abde4a716bf", "row_index": 37, "timestamp": "2019-08-15T10:34:47Z", "event_type": "GetRestApi", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 827, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "77d6acf6-72cf-4dea-a7f5-9abde4a716bf", "eventTime": "2019-08-15T10:34:47Z", "eventName": "GetRestApi", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "awsRegion": "us-west-2", "errorCode": "NotFoundException", "errorMessage": "Invalid API identifier specified 811596193553:puspzvwgb6", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "puspzvwgb6", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "77d6acf6-72cf-4dea-a7f5-9abde4a716bf", "record_id": "flaws_cloudtrail:0000038:77d6acf6-72cf-4dea-a7f5-9abde4a716bf", "row_index": 38, "timestamp": "2019-08-15T10:34:47Z", "event_type": "GetRestApi", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 827, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "77d6acf6-72cf-4dea-a7f5-9abde4a716bf", "eventTime": "2019-08-15T10:34:47Z", "eventName": "GetRestApi", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "awsRegion": "us-west-2", "errorCode": "NotFoundException", "errorMessage": "Invalid API identifier specified 811596193553:puspzvwgb6", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "puspzvwgb6", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e20e4706-aad9-427f-bdf6-0d14d5ee8210", "record_id": "flaws_cloudtrail:0000039:e20e4706-aad9-427f-bdf6-0d14d5ee8210", "row_index": 39, "timestamp": "2019-08-15T10:35:06Z", "event_type": "GetRestApi", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 809, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e20e4706-aad9-427f-bdf6-0d14d5ee8210", "eventTime": "2019-08-15T10:35:06Z", "eventName": "GetRestApi", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "awsRegion": "us-west-2", "errorCode": "NotFoundException", "errorMessage": "Invalid API identifier specified 811596193553:*", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "*", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e20e4706-aad9-427f-bdf6-0d14d5ee8210", "record_id": "flaws_cloudtrail:0000040:e20e4706-aad9-427f-bdf6-0d14d5ee8210", "row_index": 40, "timestamp": "2019-08-15T10:35:06Z", "event_type": "GetRestApi", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 809, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e20e4706-aad9-427f-bdf6-0d14d5ee8210", "eventTime": "2019-08-15T10:35:06Z", "eventName": "GetRestApi", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "awsRegion": "us-west-2", "errorCode": "NotFoundException", "errorMessage": "Invalid API identifier specified 811596193553:*", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "*", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "15ed189d-02c1-4385-8a27-370915fa6", "record_id": "flaws_cloudtrail:0000041:15ed189d-02c1-4385-8a27-370915fa6", "row_index": 41, "timestamp": "2019-08-15T10:35:21Z", "event_type": "GetRestApis", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 868, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "15ed189d-02c1-4385-8a27-370915fa6", "eventTime": "2019-08-15T10:35:21Z", "eventName": "GetRestApis", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: apigateway:GET on resource: arn:aws:apigateway:us-west-2::/restapis", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "15ed189d-02c1-4385-8a27-370915fa6", "record_id": "flaws_cloudtrail:0000042:15ed189d-02c1-4385-8a27-370915fa6", "row_index": 42, "timestamp": "2019-08-15T10:35:21Z", "event_type": "GetRestApis", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 868, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "15ed189d-02c1-4385-8a27-370915fa6", "eventTime": "2019-08-15T10:35:21Z", "eventName": "GetRestApis", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: apigateway:GET on resource: arn:aws:apigateway:us-west-2::/restapis", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a19ed6cf-e389-4ecd-948f-1c8392b3018b", "record_id": "flaws_cloudtrail:0000043:a19ed6cf-e389-4ecd-948f-1c8392b3018b", "row_index": 43, "timestamp": "2019-08-15T10:37:23Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 673, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a19ed6cf-e389-4ecd-948f-1c8392b3018b", "eventTime": "2019-08-15T10:37:23Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a19ed6cf-e389-4ecd-948f-1c8392b3018b", "record_id": "flaws_cloudtrail:0000044:a19ed6cf-e389-4ecd-948f-1c8392b3018b", "row_index": 44, "timestamp": "2019-08-15T10:37:23Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 673, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a19ed6cf-e389-4ecd-948f-1c8392b3018b", "eventTime": "2019-08-15T10:37:23Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b0b45b93-a4d8-461f-8567-db173588ce16d", "record_id": "flaws_cloudtrail:0000045:b0b45b93-a4d8-461f-8567-db173588ce16d", "row_index": 45, "timestamp": "2019-08-15T10:37:40Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 674, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b0b45b93-a4d8-461f-8567-db173588ce16d", "eventTime": "2019-08-15T10:37:40Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b0b45b93-a4d8-461f-8567-db173588ce16d", "record_id": "flaws_cloudtrail:0000046:b0b45b93-a4d8-461f-8567-db173588ce16d", "row_index": 46, "timestamp": "2019-08-15T10:37:40Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 674, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b0b45b93-a4d8-461f-8567-db173588ce16d", "eventTime": "2019-08-15T10:37:40Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "352cf54c-178d-4713-98fc-6f567b256c0c", "record_id": "flaws_cloudtrail:0000047:352cf54c-178d-4713-98fc-6f567b256c0c", "row_index": 47, "timestamp": "2019-08-15T10:39:37Z", "event_type": "GetFunction202224v2", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 877, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "352cf54c-178d-4713-98fc-6f567b256c0c", "eventTime": "2019-08-15T10:39:37Z", "eventName": "GetFunction202224v2", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: lambda:GetFunction on resource: arn:aws:lambda:us-west-2:811596193553:function:Level6", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "352cf54c-178d-4713-98fc-6f567b256c0c", "record_id": "flaws_cloudtrail:0000048:352cf54c-178d-4713-98fc-6f567b256c0c", "row_index": 48, "timestamp": "2019-08-15T10:39:37Z", "event_type": "GetFunction202224v2", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 877, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "352cf54c-178d-4713-98fc-6f567b256c0c", "eventTime": "2019-08-15T10:39:37Z", "eventName": "GetFunction202224v2", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: lambda:GetFunction on resource: arn:aws:lambda:us-west-2:811596193553:function:Level6", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6af090bb-d3df-440e-af1d-5312ea5ae28f", "record_id": "flaws_cloudtrail:0000049:6af090bb-d3df-440e-af1d-5312ea5ae28f", "row_index": 49, "timestamp": "2019-08-15T10:41:32Z", "event_type": "GetPolicy202224v2", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 823, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6af090bb-d3df-440e-af1d-5312ea5ae28f", "eventTime": "2019-08-15T10:41:32Z", "eventName": "GetPolicy202224v2", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "awsRegion": "us-east-2", "errorCode": "ResourceNotFoundException", "errorMessage": "Function not found: arn:aws:lambda:us-east-2:811596193553:function:Level6", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"functionName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6af090bb-d3df-440e-af1d-5312ea5ae28f", "record_id": "flaws_cloudtrail:0000050:6af090bb-d3df-440e-af1d-5312ea5ae28f", "row_index": 50, "timestamp": "2019-08-15T10:41:32Z", "event_type": "GetPolicy202224v2", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 823, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6af090bb-d3df-440e-af1d-5312ea5ae28f", "eventTime": "2019-08-15T10:41:32Z", "eventName": "GetPolicy202224v2", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "awsRegion": "us-east-2", "errorCode": "ResourceNotFoundException", "errorMessage": "Function not found: arn:aws:lambda:us-east-2:811596193553:function:Level6", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"functionName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a33071e-f947-4840-acc1-411aa95f0547", "record_id": "flaws_cloudtrail:0000051:a33071e-f947-4840-acc1-411aa95f0547", "row_index": 51, "timestamp": "2019-08-15T10:42:15Z", "event_type": "GetPolicy202224v2", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 691, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a33071e-f947-4840-acc1-411aa95f0547", "eventTime": "2019-08-15T10:42:15Z", "eventName": "GetPolicy202224v2", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"functionName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a33071e-f947-4840-acc1-411aa95f0547", "record_id": "flaws_cloudtrail:0000052:a33071e-f947-4840-acc1-411aa95f0547", "row_index": 52, "timestamp": "2019-08-15T10:42:15Z", "event_type": "GetPolicy202224v2", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 691, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a33071e-f947-4840-acc1-411aa95f0547", "eventTime": "2019-08-15T10:42:15Z", "eventName": "GetPolicy202224v2", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"functionName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c616d202-faea-44a9-96de-a04f2f5c0b5e", "record_id": "flaws_cloudtrail:0000053:c616d202-faea-44a9-96de-a04f2f5c0b5e", "row_index": 53, "timestamp": "2019-08-15T10:42:57Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 765, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c616d202-faea-44a9-96de-a04f2f5c0b5e", "eventTime": "2019-08-15T10:42:57Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c616d202-faea-44a9-96de-a04f2f5c0b5e", "record_id": "flaws_cloudtrail:0000054:c616d202-faea-44a9-96de-a04f2f5c0b5e", "row_index": 54, "timestamp": "2019-08-15T10:42:57Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 765, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c616d202-faea-44a9-96de-a04f2f5c0b5e", "eventTime": "2019-08-15T10:42:57Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cb75822-2acc-46b4-9b2e-e2e1043b8405", "record_id": "flaws_cloudtrail:0000055:cb75822-2acc-46b4-9b2e-e2e1043b8405", "row_index": 55, "timestamp": "2019-08-15T10:43:23Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 764, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cb75822-2acc-46b4-9b2e-e2e1043b8405", "eventTime": "2019-08-15T10:43:23Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cb75822-2acc-46b4-9b2e-e2e1043b8405", "record_id": "flaws_cloudtrail:0000056:cb75822-2acc-46b4-9b2e-e2e1043b8405", "row_index": 56, "timestamp": "2019-08-15T10:43:23Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 764, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cb75822-2acc-46b4-9b2e-e2e1043b8405", "eventTime": "2019-08-15T10:43:23Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b419562e7-e97b-4569-b969-070da189378b", "record_id": "flaws_cloudtrail:0000057:b419562e7-e97b-4569-b969-070da189378b", "row_index": 57, "timestamp": "2019-08-15T10:43:51Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 766, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b419562e7-e97b-4569-b969-070da189378b", "eventTime": "2019-08-15T10:43:51Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b419562e7-e97b-4569-b969-070da189378b", "record_id": "flaws_cloudtrail:0000058:b419562e7-e97b-4569-b969-070da189378b", "row_index": 58, "timestamp": "2019-08-15T10:43:51Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 766, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b419562e7-e97b-4569-b969-070da189378b", "eventTime": "2019-08-15T10:43:51Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f8ba1584-8f0b-4c0e-a768-fe284a77cb41", "record_id": "flaws_cloudtrail:0000059:f8ba1584-8f0b-4c0e-a768-fe284a77cb41", "row_index": 59, "timestamp": "2019-08-15T10:44:00Z", "event_type": "GetPolicy202224v2", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 693, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f8ba1584-8f0b-4c0e-a768-fe284a77cb41", "eventTime": "2019-08-15T10:44:00Z", "eventName": "GetPolicy202224v2", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"functionName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f8ba1584-8f0b-4c0e-a768-fe284a77cb41", "record_id": "flaws_cloudtrail:0000060:f8ba1584-8f0b-4c0e-a768-fe284a77cb41", "row_index": 60, "timestamp": "2019-08-15T10:44:00Z", "event_type": "GetPolicy202224v2", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 693, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f8ba1584-8f0b-4c0e-a768-fe284a77cb41", "eventTime": "2019-08-15T10:44:00Z", "eventName": "GetPolicy202224v2", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"functionName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2112f56d-dab7-491b-a3b4-9591b803043d", "record_id": "flaws_cloudtrail:0000061:2112f56d-dab7-491b-a3b4-9591b803043d", "row_index": 61, "timestamp": "2019-08-15T10:44:52Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 746, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2112f56d-dab7-491b-a3b4-9591b803043d", "eventTime": "2019-08-15T10:44:52Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2112f56d-dab7-491b-a3b4-9591b803043d", "record_id": "flaws_cloudtrail:0000062:2112f56d-dab7-491b-a3b4-9591b803043d", "row_index": 62, "timestamp": "2019-08-15T10:44:52Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 746, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2112f56d-dab7-491b-a3b4-9591b803043d", "eventTime": "2019-08-15T10:44:52Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "20f98be0-cd38-43e6-8016-858d9c144ad9", "record_id": "flaws_cloudtrail:0000063:20f98be0-cd38-43e6-8016-858d9c144ad9", "row_index": 63, "timestamp": "2019-08-15T10:44:54Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1073, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "20f98be0-cd38-43e6-8016-858d9c144ad9", "eventTime": "2019-08-15T10:44:54Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJqcEpibGNPbHppTTJyVjEzcjRPRGl0eGRmWURZa3BrOUtsaFFFV0l2czh4U2RCWDB1S0lzNm5FYVQ0TE1tYTVMZUhKWThKL1NQSFJ6ZFFzUktVTWlEUmFHYUkyOFhDRlIrTlljLzVQNzFWVTFmd1dmbDFNQjh0b2daUVg3bkpBK2NBY3JNT0UySWVuQ1Uxc2twZUNzV3VCcnRsTkdoTm03UTZDcEQ0OFlqT0l0djhUTlJOT3BlN2JaY1BKTy9oSm5JNEd1Slp4UE5HMGg2UT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "20f98be0-cd38-43e6-8016-858d9c144ad9", "record_id": "flaws_cloudtrail:0000064:20f98be0-cd38-43e6-8016-858d9c144ad9", "row_index": 64, "timestamp": "2019-08-15T10:44:54Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1073, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "20f98be0-cd38-43e6-8016-858d9c144ad9", "eventTime": "2019-08-15T10:44:54Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJqcEpibGNPbHppTTJyVjEzcjRPRGl0eGRmWURZa3BrOUtsaFFFV0l2czh4U2RCWDB1S0lzNm5FYVQ0TE1tYTVMZUhKWThKL1NQSFJ6ZFFzUktVTWlEUmFHYUkyOFhDRlIrTlljLzVQNzFWVTFmd1dmbDFNQjh0b2daUVg3bkpBK2NBY3JNT0UySWVuQ1Uxc2twZUNzV3VCcnRsTkdoTm03UTZDcEQ0OFlqT0l0djhUTlJOT3BlN2JaY1BKTy9oSm5JNEd1Slp4UE5HMGg2UT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7b3f5ad3-0ebc-4a57-915e-964123d51730", "record_id": "flaws_cloudtrail:0000065:7b3f5ad3-0ebc-4a57-915e-964123d51730", "row_index": 65, "timestamp": "2019-08-15T10:44:55Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1073, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7b3f5ad3-0ebc-4a57-915e-964123d51730", "eventTime": "2019-08-15T10:44:55Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJEenlzMUJFWjArQmlhQ2NuUG5oNE5hOThvOXpZcG1xRkZsM3RidVcwZXdCUGVHbWlzaDNORHMvK0lpVkRiRVc2OXlvMHVScUxoMlBlSmNzc2w4SUUraWRYbEl2U0EyNTdFNHBSTjhCVjB4Vk1aTnR3aVlYTDJPdGV1aGxnd2dqNVA1TXl5dGQ2Yk82RXlDL0JSR3FiYWh4RHNBanNQVVR4M3ZzMkZWY25OcFhpN1l6TFFJdEkyUDhOS0hYa2tweElkMmpCV3pocjRQSVcrUT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7b3f5ad3-0ebc-4a57-915e-964123d51730", "record_id": "flaws_cloudtrail:0000066:7b3f5ad3-0ebc-4a57-915e-964123d51730", "row_index": 66, "timestamp": "2019-08-15T10:44:55Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1073, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7b3f5ad3-0ebc-4a57-915e-964123d51730", "eventTime": "2019-08-15T10:44:55Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJEenlzMUJFWjArQmlhQ2NuUG5oNE5hOThvOXpZcG1xRkZsM3RidVcwZXdCUGVHbWlzaDNORHMvK0lpVkRiRVc2OXlvMHVScUxoMlBlSmNzc2w4SUUraWRYbEl2U0EyNTdFNHBSTjhCVjB4Vk1aTnR3aVlYTDJPdGV1aGxnd2dqNVA1TXl5dGQ2Yk82RXlDL0JSR3FiYWh4RHNBanNQVVR4M3ZzMkZWY25OcFhpN1l6TFFJdEkyUDhOS0hYa2tweElkMmpCV3pocjRQSVcrUT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "219d63e2-71b4-4edf-9206-12736ae5b9a3", "record_id": "flaws_cloudtrail:0000067:219d63e2-71b4-4edf-9206-12736ae5b9a3", "row_index": 67, "timestamp": "2019-08-15T10:44:56Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1062, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "219d63e2-71b4-4edf-9206-12736ae5b9a3", "eventTime": "2019-08-15T10:44:56Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJkVWZVUUxCVEliSWZkL1ZhalFpZ2cvdzVmcFJKQjNDcFZsOTJSYVNtWnlSY2ZER2w2TkZ0V2NUYUp1cVdmVWRLeXNhWWUvdmJiM1MyVDdZaCtpSWszMnRSTTZkMXZhdlp1WU8ycnBxS3k5RHluTTQvRFR4dWExd3pDOWg2SzZNajRieGxDSHQvZzFZeFV1VkFTUWh2Q3hyV21zRWFhcEJSMmdOTzNOZ2ZnNEJ5SjdVVFNjWk82WkFOa1VVcWtGOTA3bG9vMlZsbFdRbz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "219d63e2-71b4-4edf-9206-12736ae5b9a3", "record_id": "flaws_cloudtrail:0000068:219d63e2-71b4-4edf-9206-12736ae5b9a3", "row_index": 68, "timestamp": "2019-08-15T10:44:56Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1062, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "219d63e2-71b4-4edf-9206-12736ae5b9a3", "eventTime": "2019-08-15T10:44:56Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJkVWZVUUxCVEliSWZkL1ZhalFpZ2cvdzVmcFJKQjNDcFZsOTJSYVNtWnlSY2ZER2w2TkZ0V2NUYUp1cVdmVWRLeXNhWWUvdmJiM1MyVDdZaCtpSWszMnRSTTZkMXZhdlp1WU8ycnBxS3k5RHluTTQvRFR4dWExd3pDOWg2SzZNajRieGxDSHQvZzFZeFV1VkFTUWh2Q3hyV21zRWFhcEJSMmdOTzNOZ2ZnNEJ5SjdVVFNjWk82WkFOa1VVcWtGOTA3bG9vMlZsbFdRbz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d1401cb1-999b-4fe1-ba0c-f823d02d43db", "record_id": "flaws_cloudtrail:0000069:d1401cb1-999b-4fe1-ba0c-f823d02d43db", "row_index": 69, "timestamp": "2019-08-15T10:44:57Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1064, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d1401cb1-999b-4fe1-ba0c-f823d02d43db", "eventTime": "2019-08-15T10:44:57Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJKWlNPbzlndWRPZlo3dVUwaHVpMWJFejIzck4xSVN1di9ZQmdBcjltVW9OcGZTWFRUWjNuQ1ZYODhZVTVFZGljVURZQlIzRUw2MnVvTXQwWWs5bE9vdS80cTJjYkNVeFErRnNOdStoNTJwZ0J6SFowSy9idk1ROXptL3Ird1cxUkdrUzlJZWhMY2hpSUdiK1FidXByKzBMOEVWdmZNTDN3NERPSG9hajR5SWhVL09hVy9KYkJpd3M3ckNKMlBINlVkMDIwVkd2YXFaST0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d1401cb1-999b-4fe1-ba0c-f823d02d43db", "record_id": "flaws_cloudtrail:0000070:d1401cb1-999b-4fe1-ba0c-f823d02d43db", "row_index": 70, "timestamp": "2019-08-15T10:44:57Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1064, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d1401cb1-999b-4fe1-ba0c-f823d02d43db", "eventTime": "2019-08-15T10:44:57Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJKWlNPbzlndWRPZlo3dVUwaHVpMWJFejIzck4xSVN1di9ZQmdBcjltVW9OcGZTWFRUWjNuQ1ZYODhZVTVFZGljVURZQlIzRUw2MnVvTXQwWWs5bE9vdS80cTJjYkNVeFErRnNOdStoNTJwZ0J6SFowSy9idk1ROXptL3Ird1cxUkdrUzlJZWhMY2hpSUdiK1FidXByKzBMOEVWdmZNTDN3NERPSG9hajR5SWhVL09hVy9KYkJpd3M3ckNKMlBINlVkMDIwVkd2YXFaST0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9a3b45dc-9000-4d30-9cec-eefd42924ac6", "record_id": "flaws_cloudtrail:0000071:9a3b45dc-9000-4d30-9cec-eefd42924ac6", "row_index": 71, "timestamp": "2019-08-15T10:44:58Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1073, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9a3b45dc-9000-4d30-9cec-eefd42924ac6", "eventTime": "2019-08-15T10:44:58Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJKWDVRRXpMZ3YyUHIvT2xiYkIvanlyNjI1YnJRWk9ybDNoMVZkaStFaFJKb1p0dVFBNDZCeTg5ZmZCb2hNZGNxRUlOeGcwR3B2aC95SW9nSjRSdE1raHhQUkRzZjBIak1wOWR4RHVocEV3eFV5RW5Xb1NrREthdEcwOFpKT1lnRlkwbElVc1JnTU9Tb3JDeVgvRUJXRHZGWTM0NDNUekpsVmlpZzVOaGdZYjJtSTBYa0gvSGpub0xXT0NtUXF0bG9Jd041UmFxYmdQWFRjZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9a3b45dc-9000-4d30-9cec-eefd42924ac6", "record_id": "flaws_cloudtrail:0000072:9a3b45dc-9000-4d30-9cec-eefd42924ac6", "row_index": 72, "timestamp": "2019-08-15T10:44:58Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1073, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9a3b45dc-9000-4d30-9cec-eefd42924ac6", "eventTime": "2019-08-15T10:44:58Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJKWDVRRXpMZ3YyUHIvT2xiYkIvanlyNjI1YnJRWk9ybDNoMVZkaStFaFJKb1p0dVFBNDZCeTg5ZmZCb2hNZGNxRUlOeGcwR3B2aC95SW9nSjRSdE1raHhQUkRzZjBIak1wOWR4RHVocEV3eFV5RW5Xb1NrREthdEcwOFpKT1lnRlkwbElVc1JnTU9Tb3JDeVgvRUJXRHZGWTM0NDNUekpsVmlpZzVOaGdZYjJtSTBYa0gvSGpub0xXT0NtUXF0bG9Jd041UmFxYmdQWFRjZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fb2d64fc-60c8-476c-ba1a-4811b025bdbf", "record_id": "flaws_cloudtrail:0000073:fb2d64fc-60c8-476c-ba1a-4811b025bdbf", "row_index": 73, "timestamp": "2019-08-15T10:45:00Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1063, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fb2d64fc-60c8-476c-ba1a-4811b025bdbf", "eventTime": "2019-08-15T10:45:00Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJiQ0VoRThYWUQrM0JpZ3BnNDhjSHZSWUJnRGlybXZJWW5Va2ZiaGtoK0lFMFhjUjVtOFNhYUp4Q2NDejhMTWtibXZkbVpLdlpaRGM2cUtSek4vQ016YStVbjNCblBJWmJSN1AwcXZEMi9nYVdRS1hnME14aXpFU0VaZHFZZ3hkY1Fob2F6YUVEbGdWdDV5akUvTUF0clNNL1ZNVGFUczY1SjlRU2hHaGVDcTdyNW5ldVh3V1NjcjI1N2I3RmkwMC9qUmRhTnVjQW1BPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fb2d64fc-60c8-476c-ba1a-4811b025bdbf", "record_id": "flaws_cloudtrail:0000074:fb2d64fc-60c8-476c-ba1a-4811b025bdbf", "row_index": 74, "timestamp": "2019-08-15T10:45:00Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1063, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fb2d64fc-60c8-476c-ba1a-4811b025bdbf", "eventTime": "2019-08-15T10:45:00Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJiQ0VoRThYWUQrM0JpZ3BnNDhjSHZSWUJnRGlybXZJWW5Va2ZiaGtoK0lFMFhjUjVtOFNhYUp4Q2NDejhMTWtibXZkbVpLdlpaRGM2cUtSek4vQ016YStVbjNCblBJWmJSN1AwcXZEMi9nYVdRS1hnME14aXpFU0VaZHFZZ3hkY1Fob2F6YUVEbGdWdDV5akUvTUF0clNNL1ZNVGFUczY1SjlRU2hHaGVDcTdyNW5ldVh3V1NjcjI1N2I3RmkwMC9qUmRhTnVjQW1BPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ab712361a-c032-4f9b-b749-d241c275d652", "record_id": "flaws_cloudtrail:0000075:ab712361a-c032-4f9b-b749-d241c275d652", "row_index": 75, "timestamp": "2019-08-15T10:45:01Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1074, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ab712361a-c032-4f9b-b749-d241c275d652", "eventTime": "2019-08-15T10:45:01Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJLU1pXSC9iWFFQSDIvSkd4RVVyYlh2TThNQnMwdGtkMzA1NWxyREEzczJPWStLRndHT2lPTGV0ZTRDdnc1ZHFnQlBLTGFxRkZuWGQwZkl4MUJLa2IyU0pyaG00OC9yUjdpeFFENUsyS09ZbEVyVmlCMmZJQkFuWVZsQ2plbHpZTVJ5MXo3TE9mWGRBcXhWNVllT09BZ0hYK09UaFVGSHAvU21TcUJGS3paR2U2RE10dGV3bHpSK3pOL3lCaTUxWGdCS3FnVVd4OFVSR1pIZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ab712361a-c032-4f9b-b749-d241c275d652", "record_id": "flaws_cloudtrail:0000076:ab712361a-c032-4f9b-b749-d241c275d652", "row_index": 76, "timestamp": "2019-08-15T10:45:01Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1074, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ab712361a-c032-4f9b-b749-d241c275d652", "eventTime": "2019-08-15T10:45:01Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJLU1pXSC9iWFFQSDIvSkd4RVVyYlh2TThNQnMwdGtkMzA1NWxyREEzczJPWStLRndHT2lPTGV0ZTRDdnc1ZHFnQlBLTGFxRkZuWGQwZkl4MUJLa2IyU0pyaG00OC9yUjdpeFFENUsyS09ZbEVyVmlCMmZJQkFuWVZsQ2plbHpZTVJ5MXo3TE9mWGRBcXhWNVllT09BZ0hYK09UaFVGSHAvU21TcUJGS3paR2U2RE10dGV3bHpSK3pOL3lCaTUxWGdCS3FnVVd4OFVSR1pIZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "832d6bb7-eb56-4d00-b1a9-de7fab7f1c4d", "record_id": "flaws_cloudtrail:0000077:832d6bb7-eb56-4d00-b1a9-de7fab7f1c4d", "row_index": 77, "timestamp": "2019-08-15T10:45:02Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1073, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "832d6bb7-eb56-4d00-b1a9-de7fab7f1c4d", "eventTime": "2019-08-15T10:45:02Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJGVkZNSUcwZktTaXVyOGRXeUlYdFE4MVNoYVVHWTdBUUk4OFZhNnRSbTlWZXY0R0YwbzUzNGpIZHJ6VDlTTEd1b3J1bW8rZEZSd21GcDRhK01mN1YrcHJybnNWaysrdnRKZFBTOERQcllpNVlyOStaMjlLMm1WT2FReHI4U2h3bmZac2ZvYXlybis5RVhkMVUrdGh4b0wvVDRlZmR4ZU9hN3AvK3NCNkhGTHFiUGNBNXBWV1RpTkdBSURQZEVUZ1lpNUZpSSthWktiTHY3QT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "832d6bb7-eb56-4d00-b1a9-de7fab7f1c4d", "record_id": "flaws_cloudtrail:0000078:832d6bb7-eb56-4d00-b1a9-de7fab7f1c4d", "row_index": 78, "timestamp": "2019-08-15T10:45:02Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1073, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "832d6bb7-eb56-4d00-b1a9-de7fab7f1c4d", "eventTime": "2019-08-15T10:45:02Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJGVkZNSUcwZktTaXVyOGRXeUlYdFE4MVNoYVVHWTdBUUk4OFZhNnRSbTlWZXY0R0YwbzUzNGpIZHJ6VDlTTEd1b3J1bW8rZEZSd21GcDRhK01mN1YrcHJybnNWaysrdnRKZFBTOERQcllpNVlyOStaMjlLMm1WT2FReHI4U2h3bmZac2ZvYXlybis5RVhkMVUrdGh4b0wvVDRlZmR4ZU9hN3AvK3NCNkhGTHFiUGNBNXBWV1RpTkdBSURQZEVUZ1lpNUZpSSthWktiTHY3QT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "367175c-f9dd-432b-91f7-b46035ad0066", "record_id": "flaws_cloudtrail:0000079:367175c-f9dd-432b-91f7-b46035ad0066", "row_index": 79, "timestamp": "2019-08-15T10:45:03Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1065, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "367175c-f9dd-432b-91f7-b46035ad0066", "eventTime": "2019-08-15T10:45:03Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIxV1pUemk4TTZkTHpXYmZkS2JyUGVtK0g0MC9aOG80ODQ2aW81YkFrSkN1N01mS21hSVViWjVoZkRVa3NFMk5MOWZVT3hodndnL0wySG52OUZsa29WVWlVZkpWZ3A3L01mVkFzTTdtVlF4cmtZRFhkbEN1S1Y5bTg2WFJIeFhhWDViU2VTZkx5ZjA3TFQ4aWZZcXcxNm9mOVVlQTlINFJ2a2NIS0RzQXY3cHpiNlRvVzNEN1BZUEJlUEZ4blRkeERTMFdxMkFqN1BnPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "367175c-f9dd-432b-91f7-b46035ad0066", "record_id": "flaws_cloudtrail:0000080:367175c-f9dd-432b-91f7-b46035ad0066", "row_index": 80, "timestamp": "2019-08-15T10:45:03Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1065, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "367175c-f9dd-432b-91f7-b46035ad0066", "eventTime": "2019-08-15T10:45:03Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIxV1pUemk4TTZkTHpXYmZkS2JyUGVtK0g0MC9aOG80ODQ2aW81YkFrSkN1N01mS21hSVViWjVoZkRVa3NFMk5MOWZVT3hodndnL0wySG52OUZsa29WVWlVZkpWZ3A3L01mVkFzTTdtVlF4cmtZRFhkbEN1S1Y5bTg2WFJIeFhhWDViU2VTZkx5ZjA3TFQ4aWZZcXcxNm9mOVVlQTlINFJ2a2NIS0RzQXY3cHpiNlRvVzNEN1BZUEJlUEZ4blRkeERTMFdxMkFqN1BnPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c8cf6c3b-a7b7-4e1c-89d6-fca2c194da99", "record_id": "flaws_cloudtrail:0000081:c8cf6c3b-a7b7-4e1c-89d6-fca2c194da99", "row_index": 81, "timestamp": "2019-08-15T10:45:04Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1073, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c8cf6c3b-a7b7-4e1c-89d6-fca2c194da99", "eventTime": "2019-08-15T10:45:04Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJLMUU5eFpMaFJ5Q29OREJyM2RxNC9zcFQrak9kVC9ScUVJQS9RdXBHNmNsdGs3NXhzRlBzeG5vSzh1a3JoaGJic2JXRzZTbnMxN21hVmtHN05qSklibTI5b1Frb296WUhwbDk4dW92eXdYRHJLaGF6eVh2TTZsVnFVRDh2OGpBTVR0V3M0WGhyQnY4eFgxTTE0V1FpL2hXWmN4YlRWSnFOQnU0Q2V3S0lDdVRiNWdHM3hmUDF1aDNxTHRqME1LajBqTHdFMjYzQXo3TUxudz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c8cf6c3b-a7b7-4e1c-89d6-fca2c194da99", "record_id": "flaws_cloudtrail:0000082:c8cf6c3b-a7b7-4e1c-89d6-fca2c194da99", "row_index": 82, "timestamp": "2019-08-15T10:45:04Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1073, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c8cf6c3b-a7b7-4e1c-89d6-fca2c194da99", "eventTime": "2019-08-15T10:45:04Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJLMUU5eFpMaFJ5Q29OREJyM2RxNC9zcFQrak9kVC9ScUVJQS9RdXBHNmNsdGs3NXhzRlBzeG5vSzh1a3JoaGJic2JXRzZTbnMxN21hVmtHN05qSklibTI5b1Frb296WUhwbDk4dW92eXdYRHJLaGF6eVh2TTZsVnFVRDh2OGpBTVR0V3M0WGhyQnY4eFgxTTE0V1FpL2hXWmN4YlRWSnFOQnU0Q2V3S0lDdVRiNWdHM3hmUDF1aDNxTHRqME1LajBqTHdFMjYzQXo3TUxudz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a134e3c9-f65b-4752-b573-ca9e2b55090", "record_id": "flaws_cloudtrail:0000083:a134e3c9-f65b-4752-b573-ca9e2b55090", "row_index": 83, "timestamp": "2019-08-15T10:45:05Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1072, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a134e3c9-f65b-4752-b573-ca9e2b55090", "eventTime": "2019-08-15T10:45:05Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJEV051SEYwN2N1dUFWdU91NFVjbEgrU0NMaEFPMUpxTENpTkI2aHJiQmhrdldTRHZPUnVwRW5ld2hFOHg0M1hJUmJ1ckpaTEJFWDJTaktTUGxVTnpCMy9jT3NLMUZhQ3RMSzBTVFRqa2Vpa2duSVJhMnVOekRueVBaS21JelI2anZTRS9ma2JSaU1Mczg0c1ZORlpQWkY5TmxOd2NBVkJMV3UySnlicUtuRWJmcCtSL0JMMXYzTTdmWFJuSXVrWDFnOXljZ0FvOWRGeU9NQT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a134e3c9-f65b-4752-b573-ca9e2b55090", "record_id": "flaws_cloudtrail:0000084:a134e3c9-f65b-4752-b573-ca9e2b55090", "row_index": 84, "timestamp": "2019-08-15T10:45:05Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1072, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a134e3c9-f65b-4752-b573-ca9e2b55090", "eventTime": "2019-08-15T10:45:05Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJEV051SEYwN2N1dUFWdU91NFVjbEgrU0NMaEFPMUpxTENpTkI2aHJiQmhrdldTRHZPUnVwRW5ld2hFOHg0M1hJUmJ1ckpaTEJFWDJTaktTUGxVTnpCMy9jT3NLMUZhQ3RMSzBTVFRqa2Vpa2duSVJhMnVOekRueVBaS21JelI2anZTRS9ma2JSaU1Mczg0c1ZORlpQWkY5TmxOd2NBVkJMV3UySnlicUtuRWJmcCtSL0JMMXYzTTdmWFJuSXVrWDFnOXljZ0FvOWRGeU9NQT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e6c6f751-6630-457c-b3c5-33027cce0", "record_id": "flaws_cloudtrail:0000085:e6c6f751-6630-457c-b3c5-33027cce0", "row_index": 85, "timestamp": "2019-08-15T10:45:07Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1059, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e6c6f751-6630-457c-b3c5-33027cce0", "eventTime": "2019-08-15T10:45:07Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJKQ05YVWJZSU9zWi8rKzNEam1EcGRGeTk1bGNLaXFnLzRDUU9lQXJOcUtmUVZybHFCbXhXT1ZIVkI0eEhjbklta0VTbTlMQm82TDdZcTZ0a2tjTU1ycHBqOWZ0dE1YR29VZjJFRXIrSUcydnp0eG1QWG8vVnBjN3VoNU93ZWlJSTNYMkMrN2dTVXJDWVhqaDRnaGo5VHg1cElZMWdXMi9xamlySVlmSFBpM2Z4Ly9qM0U5VXYwWWhNaUtyVnkvNnpYU1RHWlR0Z2NnZz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e6c6f751-6630-457c-b3c5-33027cce0", "record_id": "flaws_cloudtrail:0000086:e6c6f751-6630-457c-b3c5-33027cce0", "row_index": 86, "timestamp": "2019-08-15T10:45:07Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1059, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e6c6f751-6630-457c-b3c5-33027cce0", "eventTime": "2019-08-15T10:45:07Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJKQ05YVWJZSU9zWi8rKzNEam1EcGRGeTk1bGNLaXFnLzRDUU9lQXJOcUtmUVZybHFCbXhXT1ZIVkI0eEhjbklta0VTbTlMQm82TDdZcTZ0a2tjTU1ycHBqOWZ0dE1YR29VZjJFRXIrSUcydnp0eG1QWG8vVnBjN3VoNU93ZWlJSTNYMkMrN2dTVXJDWVhqaDRnaGo5VHg1cElZMWdXMi9xamlySVlmSFBpM2Z4Ly9qM0U5VXYwWWhNaUtyVnkvNnpYU1RHWlR0Z2NnZz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "36f849d0-c2fe-4b9c-af66-82b22ce2bce0", "record_id": "flaws_cloudtrail:0000087:36f849d0-c2fe-4b9c-af66-82b22ce2bce0", "row_index": 87, "timestamp": "2019-08-15T10:45:08Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1073, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "36f849d0-c2fe-4b9c-af66-82b22ce2bce0", "eventTime": "2019-08-15T10:45:08Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJMVjJqVUZxN3ZERDNGMVRFR3NmM0hCVmRpV3Z5MGFobGRiTGMwQ2VRZDBFK202TjVESjZlOWhKYXgzRG0vTVlVenVvSFNpb3JZUk5qQlhxMWdxN2JjcGVKdWhNUlpNRmNweWlkd0VPbDdJbFNTeWRxWHBxMnhUNzBpQ2NCTHJSZ1hvdjFiK0hrZ2h5ODQyMjgzcXIrV1VFWlBpWnpyNTFMSk1UOXJCNEM4RGova244REZUOG5qTU14bWZJQkFaNXdwUElBSXNXVVJDVnV0UT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "36f849d0-c2fe-4b9c-af66-82b22ce2bce0", "record_id": "flaws_cloudtrail:0000088:36f849d0-c2fe-4b9c-af66-82b22ce2bce0", "row_index": 88, "timestamp": "2019-08-15T10:45:08Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1073, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "36f849d0-c2fe-4b9c-af66-82b22ce2bce0", "eventTime": "2019-08-15T10:45:08Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJMVjJqVUZxN3ZERDNGMVRFR3NmM0hCVmRpV3Z5MGFobGRiTGMwQ2VRZDBFK202TjVESjZlOWhKYXgzRG0vTVlVenVvSFNpb3JZUk5qQlhxMWdxN2JjcGVKdWhNUlpNRmNweWlkd0VPbDdJbFNTeWRxWHBxMnhUNzBpQ2NCTHJSZ1hvdjFiK0hrZ2h5ODQyMjgzcXIrV1VFWlBpWnpyNTFMSk1UOXJCNEM4RGova244REZUOG5qTU14bWZJQkFaNXdwUElBSXNXVVJDVnV0UT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "78c5c6a6-f152-45c0-9602-2f415c373e78", "record_id": "flaws_cloudtrail:0000089:78c5c6a6-f152-45c0-9602-2f415c373e78", "row_index": 89, "timestamp": "2019-08-15T10:45:09Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1065, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "78c5c6a6-f152-45c0-9602-2f415c373e78", "eventTime": "2019-08-15T10:45:09Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJmaVdZSk1IWTkreWRpZGs5N2Q4ZmVPRkprZnA5WC8vVzFxampWNXMxblFqYi9EQW9JZDNiN0xNQWpCR1Q3ek5QQTdMU25abTJTZ1JuVmJvNW9DTXpGYzdyQjhCN3pDRVpYdE8zeW9MRkZuSHdxZ2Z0eVhLeG1QYkQ1dWxBT2tYdHhBQnBhc2trajZ6TEhPVUFVYmdWNVZzdHBRS211cml6SUxsSkhtL1ZaNEFzcDdBWFRvdy9EQk1aRFFDeFpYZDBaNjhmbmVEbUZWRT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "78c5c6a6-f152-45c0-9602-2f415c373e78", "record_id": "flaws_cloudtrail:0000090:78c5c6a6-f152-45c0-9602-2f415c373e78", "row_index": 90, "timestamp": "2019-08-15T10:45:09Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1065, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "78c5c6a6-f152-45c0-9602-2f415c373e78", "eventTime": "2019-08-15T10:45:09Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJmaVdZSk1IWTkreWRpZGs5N2Q4ZmVPRkprZnA5WC8vVzFxampWNXMxblFqYi9EQW9JZDNiN0xNQWpCR1Q3ek5QQTdMU25abTJTZ1JuVmJvNW9DTXpGYzdyQjhCN3pDRVpYdE8zeW9MRkZuSHdxZ2Z0eVhLeG1QYkQ1dWxBT2tYdHhBQnBhc2trajZ6TEhPVUFVYmdWNVZzdHBRS211cml6SUxsSkhtL1ZaNEFzcDdBWFRvdy9EQk1aRFFDeFpYZDBaNjhmbmVEbUZWRT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "eeb917e7-c9fb-43da-b0ec-75ed3454842a", "record_id": "flaws_cloudtrail:0000091:eeb917e7-c9fb-43da-b0ec-75ed3454842a", "row_index": 91, "timestamp": "2019-08-15T10:45:10Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1073, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "eeb917e7-c9fb-43da-b0ec-75ed3454842a", "eventTime": "2019-08-15T10:45:10Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJCbVR4aUQ0V2tUVXpmMmtoWEkzSE9WV0pxcHlFbG0zN3RaQzJyYm4zb3IyOVEyQlBJL0orYkZFVEVCZ3JtQkZrQlZQU2pVMzlLQWRualcwNnAyYUdSSHgrdG4vQnFweGtaVUs2KzF3Z0tqTU1YUGVLRDNCNFZFOHhXckhBeGl0YWZMd1Y4MDlGWXczNERDMEdhbXY4K2NKUzhJK1FMK2QyR0JmNHVUQ21RYllBRytBY1RZWVE2VFV0Y0FqOGg0ZGZaa0lUMkE3UjZBRzZuZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "eeb917e7-c9fb-43da-b0ec-75ed3454842a", "record_id": "flaws_cloudtrail:0000092:eeb917e7-c9fb-43da-b0ec-75ed3454842a", "row_index": 92, "timestamp": "2019-08-15T10:45:10Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1073, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "eeb917e7-c9fb-43da-b0ec-75ed3454842a", "eventTime": "2019-08-15T10:45:10Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJCbVR4aUQ0V2tUVXpmMmtoWEkzSE9WV0pxcHlFbG0zN3RaQzJyYm4zb3IyOVEyQlBJL0orYkZFVEVCZ3JtQkZrQlZQU2pVMzlLQWRualcwNnAyYUdSSHgrdG4vQnFweGtaVUs2KzF3Z0tqTU1YUGVLRDNCNFZFOHhXckhBeGl0YWZMd1Y4MDlGWXczNERDMEdhbXY4K2NKUzhJK1FMK2QyR0JmNHVUQ21RYllBRytBY1RZWVE2VFV0Y0FqOGg0ZGZaa0lUMkE3UjZBRzZuZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b398a929-b368-44ed-8443-8f310eb67230", "record_id": "flaws_cloudtrail:0000093:b398a929-b368-44ed-8443-8f310eb67230", "row_index": 93, "timestamp": "2019-08-15T10:45:12Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1063, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b398a929-b368-44ed-8443-8f310eb67230", "eventTime": "2019-08-15T10:45:12Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJacmdETWFvVlJvSlNlZFdaOU82dzkzakxhTHQxVzhXN0NhSTZJMVF5YTBIQVpmNitaMkpVTm5WSUR5dTFic3ZHWEU1QnJrdGViMHFrSTJKRUFBZGg2MndVb0lHMFZYRVZ1NWpzRHhIMWhKbVNxTnhLUVRXNURLclN6MmI3LzNtTDZTWUN2YUpEbjJtdVQ4YlpTTUtKNlNIL25icGdxZ3dYTHR5NFgrK1BGZmdUdHZFZ1NaSzZySER6TDJCeTB3d1FjbmlqaWlHc0djST0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b398a929-b368-44ed-8443-8f310eb67230", "record_id": "flaws_cloudtrail:0000094:b398a929-b368-44ed-8443-8f310eb67230", "row_index": 94, "timestamp": "2019-08-15T10:45:12Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1063, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b398a929-b368-44ed-8443-8f310eb67230", "eventTime": "2019-08-15T10:45:12Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJacmdETWFvVlJvSlNlZFdaOU82dzkzakxhTHQxVzhXN0NhSTZJMVF5YTBIQVpmNitaMkpVTm5WSUR5dTFic3ZHWEU1QnJrdGViMHFrSTJKRUFBZGg2MndVb0lHMFZYRVZ1NWpzRHhIMWhKbVNxTnhLUVRXNURLclN6MmI3LzNtTDZTWUN2YUpEbjJtdVQ4YlpTTUtKNlNIL25icGdxZ3dYTHR5NFgrK1BGZmdUdHZFZ1NaSzZySER6TDJCeTB3d1FjbmlqaWlHc0djST0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2e8f4877-aa57-4b05-9295-2207b76ce96b", "record_id": "flaws_cloudtrail:0000095:2e8f4877-aa57-4b05-9295-2207b76ce96b", "row_index": 95, "timestamp": "2019-08-15T10:45:13Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1073, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2e8f4877-aa57-4b05-9295-2207b76ce96b", "eventTime": "2019-08-15T10:45:13Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ4bEd5aG44bzlYTFRFMmNrSW5Zc2RWenhheFJ6NU5ENnhZUGlaTEVYYzY0dUVHZ0hrYlY0b1pSOWY1RTUrRDdjcjZ4RnEyb082eFEyajZiSFZFdGlMdmpmblkzaFczbmlKRmdwOVJ6OVBwejVnRWpnc2dwYnFrSFRTdXR3alV2T0ZkeGYweDY4RzNDN21XR25oQ1hGRkoyZUNuajlYczh5RDE3QUl3VklEY1JmdDhLWVZIMWl5RGpMMXNaSTRaTXovRTFUeXJoUUhJbnBjQT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2e8f4877-aa57-4b05-9295-2207b76ce96b", "record_id": "flaws_cloudtrail:0000096:2e8f4877-aa57-4b05-9295-2207b76ce96b", "row_index": 96, "timestamp": "2019-08-15T10:45:13Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1073, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2e8f4877-aa57-4b05-9295-2207b76ce96b", "eventTime": "2019-08-15T10:45:13Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ4bEd5aG44bzlYTFRFMmNrSW5Zc2RWenhheFJ6NU5ENnhZUGlaTEVYYzY0dUVHZ0hrYlY0b1pSOWY1RTUrRDdjcjZ4RnEyb082eFEyajZiSFZFdGlMdmpmblkzaFczbmlKRmdwOVJ6OVBwejVnRWpnc2dwYnFrSFRTdXR3alV2T0ZkeGYweDY4RzNDN21XR25oQ1hGRkoyZUNuajlYczh5RDE3QUl3VklEY1JmdDhLWVZIMWl5RGpMMXNaSTRaTXovRTFUeXJoUUhJbnBjQT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "49b33d88-569f-4996-a61c-91a801361f28", "record_id": "flaws_cloudtrail:0000097:49b33d88-569f-4996-a61c-91a801361f28", "row_index": 97, "timestamp": "2019-08-15T10:45:14Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1073, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "49b33d88-569f-4996-a61c-91a801361f28", "eventTime": "2019-08-15T10:45:14Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJsVGNiT1ZtMmpkOHJMV2dBOTFubTAza0pTcXY4ZXBySGtEa2FNMGNqYUNMK3NCWEF5UHBkQXFIRHAwRWowWnkxYXd2cnltT1lhRUdJMXRQQ09OU1EvbGJyd0YrR21aMmhKK2p6Z0t2U1djZVB2djUyLzNmQ3l1Q0psbkV3NzUrUEltaTRteUI4RFhCT0VFT1Z6Z3dJWFFGTjEveFNScjdKSXo4djdFMVRUQ05nbGZXcEpjQ2tnVGlkL1doWXJjZzZPK3VvK0xzRWp2ZmNKZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "49b33d88-569f-4996-a61c-91a801361f28", "record_id": "flaws_cloudtrail:0000098:49b33d88-569f-4996-a61c-91a801361f28", "row_index": 98, "timestamp": "2019-08-15T10:45:14Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1073, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "49b33d88-569f-4996-a61c-91a801361f28", "eventTime": "2019-08-15T10:45:14Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJsVGNiT1ZtMmpkOHJMV2dBOTFubTAza0pTcXY4ZXBySGtEa2FNMGNqYUNMK3NCWEF5UHBkQXFIRHAwRWowWnkxYXd2cnltT1lhRUdJMXRQQ09OU1EvbGJyd0YrR21aMmhKK2p6Z0t2U1djZVB2djUyLzNmQ3l1Q0psbkV3NzUrUEltaTRteUI4RFhCT0VFT1Z6Z3dJWFFGTjEveFNScjdKSXo4djdFMVRUQ05nbGZXcEpjQ2tnVGlkL1doWXJjZzZPK3VvK0xzRWp2ZmNKZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3806d0db-7493-4be3-bafe-f4a5ca40a96f", "record_id": "flaws_cloudtrail:0000099:3806d0db-7493-4be3-bafe-f4a5ca40a96f", "row_index": 99, "timestamp": "2019-08-15T10:45:15Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1049, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3806d0db-7493-4be3-bafe-f4a5ca40a96f", "eventTime": "2019-08-15T10:45:15Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJPVURCc04veldRVGxpTFhwNE1haGxveTkrZ1pKU1B5U3JSL2tLUExOa0orU2tFL3U0elZZdnVxUUNneWxoYzVVK0Erem1PUU15QUdSdGkxamUyTXJYaUpKbFFmeWEzRDQ1MkNIVlQwZnZNME8xbEhTTjVFMHdqUW9aWnFjZE96TE44Uk54Q0ZKajlNbDRaUThjZjU2c1YvUUo3MTFzNndGTUJCTkRPdkhkTm5WTDBmejVacTlLa3lwb1dqdlVnPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "10622b-28df-4515-ba08-441710a5d91e0", "record_id": "flaws_cloudtrail:0000100:10622b-28df-4515-ba08-441710a5d91e0", "row_index": 100, "timestamp": "2019-08-15T10:45:15Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1070, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "10622b-28df-4515-ba08-441710a5d91e0", "eventTime": "2019-08-15T10:45:15Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJYTTBmWkpWZng3YVp6VVM4VFVMZ2RNUE42MFN0MzlMZjJvNTlSbC9DZzF5c0tJRWRzRC9uN0N3R0E0bW90b1VtYTc2aXJMOU9KZXFMUkVLUDU3bHhuKzUrL3BobHBUV0ZoeFZyeG9tSlR1dlErVzZ3MGpGYW0wRk9MTHN3V2lwTFpERVhSa3RSTFlqTmdkTmE3ak14SUlTeXZwck9TZlU3ck9uR3VnSUlkcHhWZm9UQUorUHB3SldoQVZSN21SVWpFMXdjallXK3RrRmU0QT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3806d0db-7493-4be3-bafe-f4a5ca40a96f", "record_id": "flaws_cloudtrail:0000101:3806d0db-7493-4be3-bafe-f4a5ca40a96f", "row_index": 101, "timestamp": "2019-08-15T10:45:15Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1049, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3806d0db-7493-4be3-bafe-f4a5ca40a96f", "eventTime": "2019-08-15T10:45:15Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJPVURCc04veldRVGxpTFhwNE1haGxveTkrZ1pKU1B5U3JSL2tLUExOa0orU2tFL3U0elZZdnVxUUNneWxoYzVVK0Erem1PUU15QUdSdGkxamUyTXJYaUpKbFFmeWEzRDQ1MkNIVlQwZnZNME8xbEhTTjVFMHdqUW9aWnFjZE96TE44Uk54Q0ZKajlNbDRaUThjZjU2c1YvUUo3MTFzNndGTUJCTkRPdkhkTm5WTDBmejVacTlLa3lwb1dqdlVnPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "10622b-28df-4515-ba08-441710a5d91e0", "record_id": "flaws_cloudtrail:0000102:10622b-28df-4515-ba08-441710a5d91e0", "row_index": 102, "timestamp": "2019-08-15T10:45:15Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1070, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "10622b-28df-4515-ba08-441710a5d91e0", "eventTime": "2019-08-15T10:45:15Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJYTTBmWkpWZng3YVp6VVM4VFVMZ2RNUE42MFN0MzlMZjJvNTlSbC9DZzF5c0tJRWRzRC9uN0N3R0E0bW90b1VtYTc2aXJMOU9KZXFMUkVLUDU3bHhuKzUrL3BobHBUV0ZoeFZyeG9tSlR1dlErVzZ3MGpGYW0wRk9MTHN3V2lwTFpERVhSa3RSTFlqTmdkTmE3ak14SUlTeXZwck9TZlU3ck9uR3VnSUlkcHhWZm9UQUorUHB3SldoQVZSN21SVWpFMXdjallXK3RrRmU0QT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c26097-a628-46cd-b76b-2f8d31e047d0", "record_id": "flaws_cloudtrail:0000103:c26097-a628-46cd-b76b-2f8d31e047d0", "row_index": 103, "timestamp": "2019-08-15T10:45:16Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1090, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c26097-a628-46cd-b76b-2f8d31e047d0", "eventTime": "2019-08-15T10:45:16Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJCSlZIMWp5NGV6SStseU0rNWdocGg4bWtGaHFjbXB3L2xHT1E2dTZXcXhFS3hTNFRHK1JqQjBoZWl3T2cxQWdNdy93MDhoVkE4SHdJRGZqazRtczlTTW9PTEFBMUlGM01DZStIM1RYSzNpYUYyOFVRMzFXYkh6djdFZ0piR01neDZyUzBXL2tVQUdpS0t5RWZsUTIyTmV0STBMQS9DT0FxaUxSTG5Jc2VMTm02cEtkNDQrSlJ4WnR3VmpkQmtPNEdjMkNNTnNzck5CdXVNdjAxUU1VZ2J3ME5SM1RQb0o4PSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c26097-a628-46cd-b76b-2f8d31e047d0", "record_id": "flaws_cloudtrail:0000104:c26097-a628-46cd-b76b-2f8d31e047d0", "row_index": 104, "timestamp": "2019-08-15T10:45:16Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1090, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c26097-a628-46cd-b76b-2f8d31e047d0", "eventTime": "2019-08-15T10:45:16Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJCSlZIMWp5NGV6SStseU0rNWdocGg4bWtGaHFjbXB3L2xHT1E2dTZXcXhFS3hTNFRHK1JqQjBoZWl3T2cxQWdNdy93MDhoVkE4SHdJRGZqazRtczlTTW9PTEFBMUlGM01DZStIM1RYSzNpYUYyOFVRMzFXYkh6djdFZ0piR01neDZyUzBXL2tVQUdpS0t5RWZsUTIyTmV0STBMQS9DT0FxaUxSTG5Jc2VMTm02cEtkNDQrSlJ4WnR3VmpkQmtPNEdjMkNNTnNzck5CdXVNdjAxUU1VZ2J3ME5SM1RQb0o4PSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "37389b0-b53d-4e03-a98a-5d5eb40e741d", "record_id": "flaws_cloudtrail:0000105:37389b0-b53d-4e03-a98a-5d5eb40e741d", "row_index": 105, "timestamp": "2019-08-15T10:45:17Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1080, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "37389b0-b53d-4e03-a98a-5d5eb40e741d", "eventTime": "2019-08-15T10:45:17Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJhMjhqc1Juc2dXQmxQL2ZQRVA3TGVzL2ZuK1FVeTI2K1R1NUIrSTNMYXhYdWdNZHBsZ0dXaWdsZUJtRkhRWmJIaUlWOU1oR3c1b3pENWQvcmo1S1FJbG1iQjZ5MGVIQWZneXJDRUcyWmYwWjE1d2pnbW1uL2dsVHZzOCt2cjV6bTBZNDR3ZWxzU1Zrc0xUc2t1NDluK0dUVUJyK2tvYW5vWDVIeXQ5WS9GNTlRYStCSTh0Y0Eva2FualdJbElheElRRjRMK1UzdkcxdDBlc2EyNUxiVmhRPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "37389b0-b53d-4e03-a98a-5d5eb40e741d", "record_id": "flaws_cloudtrail:0000106:37389b0-b53d-4e03-a98a-5d5eb40e741d", "row_index": 106, "timestamp": "2019-08-15T10:45:17Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1080, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "37389b0-b53d-4e03-a98a-5d5eb40e741d", "eventTime": "2019-08-15T10:45:17Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJhMjhqc1Juc2dXQmxQL2ZQRVA3TGVzL2ZuK1FVeTI2K1R1NUIrSTNMYXhYdWdNZHBsZ0dXaWdsZUJtRkhRWmJIaUlWOU1oR3c1b3pENWQvcmo1S1FJbG1iQjZ5MGVIQWZneXJDRUcyWmYwWjE1d2pnbW1uL2dsVHZzOCt2cjV6bTBZNDR3ZWxzU1Zrc0xUc2t1NDluK0dUVUJyK2tvYW5vWDVIeXQ5WS9GNTlRYStCSTh0Y0Eva2FualdJbElheElRRjRMK1UzdkcxdDBlc2EyNUxiVmhRPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b58a9328-083c-48f8-a3b8-ddc03e9a63b6", "record_id": "flaws_cloudtrail:0000107:b58a9328-083c-48f8-a3b8-ddc03e9a63b6", "row_index": 107, "timestamp": "2019-08-15T10:45:18Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1093, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b58a9328-083c-48f8-a3b8-ddc03e9a63b6", "eventTime": "2019-08-15T10:45:18Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJSK01RMmUyaEJlbm4vZ2trNDM0eW1wem1Kc1h1Smp2Z0VtVFgyR25QRlpSY1poTUtVQlpBak1mVnZrL01Dc0U1clpIQVE2LzZKc1N0Z3VoUGpYTm9xMDF1eXF2LzF5OUNOb1hsL21laEF0UW8vb3NyTlNpL2hOTS9lUE1rUjlacWdoRDV6ckFuQ3owRlh0MWpKYUVzRStzR0dWSVIwZHNjMDlPZjZieU5IWUkzZENUU3RhUTh4ZGk4WDJDUmdXVmJPNXBJK3hMRTJlRERTWFp1b0MvSFMyaFRFZmhTR1pNPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "15a4d608-1f47-428a-8a88-5c2669fd249e", "record_id": "flaws_cloudtrail:0000108:15a4d608-1f47-428a-8a88-5c2669fd249e", "row_index": 108, "timestamp": "2019-08-15T10:45:18Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1050, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "15a4d608-1f47-428a-8a88-5c2669fd249e", "eventTime": "2019-08-15T10:45:18Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJDRzJSNEgyYnNNVDhwQ3ZpdW5pSWhvTUE4VFV4OGIxczFYOUtwNkF1T0ExbHQzRGJjclVrU3lqVmNjakRwVGFaTXNJTDQ2SVdNSVdYSXUwRUFEOWt3bS9JYWlXMVo4ZXA1VDRiV1hSQTV1WFZoYTdZZlhqUEVtNG93RXB4STRkSlN3eVNSdk5yUjh0dVA1T3hRWElUNEY4STZ4T0dCWkpJYXJBZjRSVmZBQjlxMG5wOXhrcUczN1k4aDlGcG0rUT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b58a9328-083c-48f8-a3b8-ddc03e9a63b6", "record_id": "flaws_cloudtrail:0000109:b58a9328-083c-48f8-a3b8-ddc03e9a63b6", "row_index": 109, "timestamp": "2019-08-15T10:45:18Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1093, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b58a9328-083c-48f8-a3b8-ddc03e9a63b6", "eventTime": "2019-08-15T10:45:18Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJSK01RMmUyaEJlbm4vZ2trNDM0eW1wem1Kc1h1Smp2Z0VtVFgyR25QRlpSY1poTUtVQlpBak1mVnZrL01Dc0U1clpIQVE2LzZKc1N0Z3VoUGpYTm9xMDF1eXF2LzF5OUNOb1hsL21laEF0UW8vb3NyTlNpL2hOTS9lUE1rUjlacWdoRDV6ckFuQ3owRlh0MWpKYUVzRStzR0dWSVIwZHNjMDlPZjZieU5IWUkzZENUU3RhUTh4ZGk4WDJDUmdXVmJPNXBJK3hMRTJlRERTWFp1b0MvSFMyaFRFZmhTR1pNPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "15a4d608-1f47-428a-8a88-5c2669fd249e", "record_id": "flaws_cloudtrail:0000110:15a4d608-1f47-428a-8a88-5c2669fd249e", "row_index": 110, "timestamp": "2019-08-15T10:45:18Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1050, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "15a4d608-1f47-428a-8a88-5c2669fd249e", "eventTime": "2019-08-15T10:45:18Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJDRzJSNEgyYnNNVDhwQ3ZpdW5pSWhvTUE4VFV4OGIxczFYOUtwNkF1T0ExbHQzRGJjclVrU3lqVmNjakRwVGFaTXNJTDQ2SVdNSVdYSXUwRUFEOWt3bS9JYWlXMVo4ZXA1VDRiV1hSQTV1WFZoYTdZZlhqUEVtNG93RXB4STRkSlN3eVNSdk5yUjh0dVA1T3hRWElUNEY4STZ4T0dCWkpJYXJBZjRSVmZBQjlxMG5wOXhrcUczN1k4aDlGcG0rUT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f564ea32-449a-4726-af12-8c05ebe88f31", "record_id": "flaws_cloudtrail:0000111:f564ea32-449a-4726-af12-8c05ebe88f31", "row_index": 111, "timestamp": "2019-08-15T10:45:19Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1091, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f564ea32-449a-4726-af12-8c05ebe88f31", "eventTime": "2019-08-15T10:45:19Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJRcUt5Y3VBVmZyei8yaDdjY1JWV3lSc3B2dkFCNmJFOHM1MVpEYW9IZE43RW9uaHEyQ1U5cEx5NUlFQjU4cmdmRllsRlBsNE9tNWJmS0ZHUlJQWGF3Rm1iSWJaWitiSDE0ajNpZURFNTR2OTdmTTN3ZWhJc2xwQ1NHR3dCSEZKWmdmbU9qSC9Ya0JYQWtKNjR4UzVqaTI5NkNCVys0dGs5K2dxRDdBVS9PNVY1V3NMby95Sm55aGM0RFFoQldMeGJYNnA5elNZVURIcHd1VTgvVjhxVW9UVHg0U3p2bWtrPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f564ea32-449a-4726-af12-8c05ebe88f31", "record_id": "flaws_cloudtrail:0000112:f564ea32-449a-4726-af12-8c05ebe88f31", "row_index": 112, "timestamp": "2019-08-15T10:45:19Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1091, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f564ea32-449a-4726-af12-8c05ebe88f31", "eventTime": "2019-08-15T10:45:19Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJRcUt5Y3VBVmZyei8yaDdjY1JWV3lSc3B2dkFCNmJFOHM1MVpEYW9IZE43RW9uaHEyQ1U5cEx5NUlFQjU4cmdmRllsRlBsNE9tNWJmS0ZHUlJQWGF3Rm1iSWJaWitiSDE0ajNpZURFNTR2OTdmTTN3ZWhJc2xwQ1NHR3dCSEZKWmdmbU9qSC9Ya0JYQWtKNjR4UzVqaTI5NkNCVys0dGs5K2dxRDdBVS9PNVY1V3NMby95Sm55aGM0RFFoQldMeGJYNnA5elNZVURIcHd1VTgvVjhxVW9UVHg0U3p2bWtrPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "eb56932-09f9-43ce-a063-bb54ca8bd5ae", "record_id": "flaws_cloudtrail:0000113:eb56932-09f9-43ce-a063-bb54ca8bd5ae", "row_index": 113, "timestamp": "2019-08-15T10:45:20Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1044, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "eb56932-09f9-43ce-a063-bb54ca8bd5ae", "eventTime": "2019-08-15T10:45:20Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIySER0K01pMVVtV0FKSXNzcWFlRzRYandQQUtDMDZWRVlLZ1hFMUcrS01Zb0czUkVSM0RTRnZIMEtPWTJDaVNyelVUeVB6dUNFb2tmVlhoa1Fya1c1eFdVN2tkRHpBSTgvQlpVeUtubUdtRWRleFJydWlRbUZmd3c0aTRpbVdTRnFxaG5GYlIvWXg0K3VBNmZ2bGNOb29IN29Tc3FqY0hicnI1QWFtMU9kOEhzL1VoTFV0ejR4M1pRUW14bmhuTT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "eb56932-09f9-43ce-a063-bb54ca8bd5ae", "record_id": "flaws_cloudtrail:0000114:eb56932-09f9-43ce-a063-bb54ca8bd5ae", "row_index": 114, "timestamp": "2019-08-15T10:45:20Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1044, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "eb56932-09f9-43ce-a063-bb54ca8bd5ae", "eventTime": "2019-08-15T10:45:20Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIySER0K01pMVVtV0FKSXNzcWFlRzRYandQQUtDMDZWRVlLZ1hFMUcrS01Zb0czUkVSM0RTRnZIMEtPWTJDaVNyelVUeVB6dUNFb2tmVlhoa1Fya1c1eFdVN2tkRHpBSTgvQlpVeUtubUdtRWRleFJydWlRbUZmd3c0aTRpbVdTRnFxaG5GYlIvWXg0K3VBNmZ2bGNOb29IN29Tc3FqY0hicnI1QWFtMU9kOEhzL1VoTFV0ejR4M1pRUW14bmhuTT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9e599a4a-c0dd-4c7e-b4a4-ca5589dc7e6c", "record_id": "flaws_cloudtrail:0000115:9e599a4a-c0dd-4c7e-b4a4-ca5589dc7e6c", "row_index": 115, "timestamp": "2019-08-15T10:45:21Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1049, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9e599a4a-c0dd-4c7e-b4a4-ca5589dc7e6c", "eventTime": "2019-08-15T10:45:21Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJQdDc2cFhZaWVlWFVSRHBZWThha241U2ZNLzIzNTZ2TUw0K252NW9SQWJ1RFMvcWJPN2ZZeEtFNmVVRjZwL2RRckM2UEYwclFxQ0N3dFg2UHZCN2UwaEw2bGM0Rm9CSWI1d1ZlbVZOMHdXZkpHVXU2c2hIekFsdHNKZHhkL04xODdUT25Nb3d2UUFWTUQzYzM5eDByUG44VzBkR2ZsTlhDbkE0eUE1ZG5sM05ueTZBd0x3VGpQNTdtVFB1NUZ4bz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "113e326b-6c05-4ec1-8f06-c6e0e447ce01", "record_id": "flaws_cloudtrail:0000116:113e326b-6c05-4ec1-8f06-c6e0e447ce01", "row_index": 116, "timestamp": "2019-08-15T10:45:21Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1093, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "113e326b-6c05-4ec1-8f06-c6e0e447ce01", "eventTime": "2019-08-15T10:45:21Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJHalZtTThFWVZ0eE1VVHkwNWlCUWRjTndIU3RscnNKM1l0SXoxU1B4M1E3N2x6MkVaZUV5M0pMQWxtL0VjMTFwd0hYdUhkNEgvV2tNRjgrVDJvNHVNUW9FblVrWndaYndXYzFvQ0Z0Q05pRUFjbVZxVkNHaVdhNm9LVUpCL0JKKzhQL2VRaTRVUGxJR3ludjVES1ZVSFQ4L1VKRDBaTUZnRjdqcGEra0JWTFFuZENRcCtPcDFzcWIrV1JNVUs4WlFDemk0Nk1VR3E4d25EVW04SVZZbG1wK0lxSURDd0NBPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9e599a4a-c0dd-4c7e-b4a4-ca5589dc7e6c", "record_id": "flaws_cloudtrail:0000117:9e599a4a-c0dd-4c7e-b4a4-ca5589dc7e6c", "row_index": 117, "timestamp": "2019-08-15T10:45:21Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1049, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9e599a4a-c0dd-4c7e-b4a4-ca5589dc7e6c", "eventTime": "2019-08-15T10:45:21Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJQdDc2cFhZaWVlWFVSRHBZWThha241U2ZNLzIzNTZ2TUw0K252NW9SQWJ1RFMvcWJPN2ZZeEtFNmVVRjZwL2RRckM2UEYwclFxQ0N3dFg2UHZCN2UwaEw2bGM0Rm9CSWI1d1ZlbVZOMHdXZkpHVXU2c2hIekFsdHNKZHhkL04xODdUT25Nb3d2UUFWTUQzYzM5eDByUG44VzBkR2ZsTlhDbkE0eUE1ZG5sM05ueTZBd0x3VGpQNTdtVFB1NUZ4bz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "113e326b-6c05-4ec1-8f06-c6e0e447ce01", "record_id": "flaws_cloudtrail:0000118:113e326b-6c05-4ec1-8f06-c6e0e447ce01", "row_index": 118, "timestamp": "2019-08-15T10:45:21Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1093, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "113e326b-6c05-4ec1-8f06-c6e0e447ce01", "eventTime": "2019-08-15T10:45:21Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJHalZtTThFWVZ0eE1VVHkwNWlCUWRjTndIU3RscnNKM1l0SXoxU1B4M1E3N2x6MkVaZUV5M0pMQWxtL0VjMTFwd0hYdUhkNEgvV2tNRjgrVDJvNHVNUW9FblVrWndaYndXYzFvQ0Z0Q05pRUFjbVZxVkNHaVdhNm9LVUpCL0JKKzhQL2VRaTRVUGxJR3ludjVES1ZVSFQ4L1VKRDBaTUZnRjdqcGEra0JWTFFuZENRcCtPcDFzcWIrV1JNVUs4WlFDemk0Nk1VR3E4d25EVW04SVZZbG1wK0lxSURDd0NBPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6e3d7990-52ed-4aad-928a-720cb304e4d0", "record_id": "flaws_cloudtrail:0000119:6e3d7990-52ed-4aad-928a-720cb304e4d0", "row_index": 119, "timestamp": "2019-08-15T10:45:22Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1049, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6e3d7990-52ed-4aad-928a-720cb304e4d0", "eventTime": "2019-08-15T10:45:22Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJwaXlhNlJnRXBGZDNXKzhnSUhQTG4vMEd3MkVsMWZkRjZzdjJKelgvdExHSFp3akJldFRUaWcrdHFUMzNLTnJtYzNEeS8xVysyOGJqdU90eWdFVEJtM2hhNDBHTFI3Z3BKNi9zK216T3J2MVNkaldjd0RHQTNySTJFNGZobndkZ043U2Q4a2NRbUNhakFTc3hxaGpTMWwwUXlJTTEwb1J2bHMzTkpocDQ2R281UFppUG5CdUlHQ2VtTVpObXFFOD0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5b007650-01c2-4b2a-b1f5-663002eda", "record_id": "flaws_cloudtrail:0000120:5b007650-01c2-4b2a-b1f5-663002eda", "row_index": 120, "timestamp": "2019-08-15T10:45:22Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1088, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5b007650-01c2-4b2a-b1f5-663002eda", "eventTime": "2019-08-15T10:45:22Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJSN0IrZWhCV3NOVVM1Uml4RGNzUmZLWlkrbUN6cldscm1qTUlrQlBGRGRKZ25IQ3hpM0kxTHZKY0JldXowRXhOd0craHlic3FIckFYYzJaWVl5dEtBWlFlTUhaK1g0cTEybHk5TUpsbFB6azFQVFcrVnFqQjMxZjZUQTQrUjBqZWV3TXlNd09yZUc3RTFFRFJzZGVDdE5PVlowd2x0b2VNNkdFdXRKbWdJZnZoOERjRTBHWWdOWDFpNTYzdWcwWU5xVTlGNEVYZnhIcjFvY1FpcWlYVzZoanFWNGlVVG5FPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6e3d7990-52ed-4aad-928a-720cb304e4d0", "record_id": "flaws_cloudtrail:0000121:6e3d7990-52ed-4aad-928a-720cb304e4d0", "row_index": 121, "timestamp": "2019-08-15T10:45:22Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1049, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6e3d7990-52ed-4aad-928a-720cb304e4d0", "eventTime": "2019-08-15T10:45:22Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJwaXlhNlJnRXBGZDNXKzhnSUhQTG4vMEd3MkVsMWZkRjZzdjJKelgvdExHSFp3akJldFRUaWcrdHFUMzNLTnJtYzNEeS8xVysyOGJqdU90eWdFVEJtM2hhNDBHTFI3Z3BKNi9zK216T3J2MVNkaldjd0RHQTNySTJFNGZobndkZ043U2Q4a2NRbUNhakFTc3hxaGpTMWwwUXlJTTEwb1J2bHMzTkpocDQ2R281UFppUG5CdUlHQ2VtTVpObXFFOD0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5b007650-01c2-4b2a-b1f5-663002eda", "record_id": "flaws_cloudtrail:0000122:5b007650-01c2-4b2a-b1f5-663002eda", "row_index": 122, "timestamp": "2019-08-15T10:45:22Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1088, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5b007650-01c2-4b2a-b1f5-663002eda", "eventTime": "2019-08-15T10:45:22Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJSN0IrZWhCV3NOVVM1Uml4RGNzUmZLWlkrbUN6cldscm1qTUlrQlBGRGRKZ25IQ3hpM0kxTHZKY0JldXowRXhOd0craHlic3FIckFYYzJaWVl5dEtBWlFlTUhaK1g0cTEybHk5TUpsbFB6azFQVFcrVnFqQjMxZjZUQTQrUjBqZWV3TXlNd09yZUc3RTFFRFJzZGVDdE5PVlowd2x0b2VNNkdFdXRKbWdJZnZoOERjRTBHWWdOWDFpNTYzdWcwWU5xVTlGNEVYZnhIcjFvY1FpcWlYVzZoanFWNGlVVG5FPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "153a7766-dddd-4270-acc5-b18e1008f777", "record_id": "flaws_cloudtrail:0000123:153a7766-dddd-4270-acc5-b18e1008f777", "row_index": 123, "timestamp": "2019-08-15T10:45:23Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1047, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "153a7766-dddd-4270-acc5-b18e1008f777", "eventTime": "2019-08-15T10:45:23Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ0c2RFT0VLSktMUHQ4dWhrS0swcGVxa3BnR3FWV2duMDcvWlg3Z2NVQmxyY3JncW9BNWRqV0UzQ3Z1RFd0YnhjRmh2TGJFSWNUZ0R4ZUQyM1Mwc1ArRWR1WnRRdDA5VUVyYVV5Vk5ad2xUaWdWWTlUMUY4R1MzUEM4cXpwNjFVVExiaGNRbzdKTXplcTBaRzRaZThEVGY0ZEFmamdYeEI1R00ycnZiWW5CNUs3UTFXMDZoU01pQkwvVjZIYTVIYz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0fc617f8-4ae3-47e7-9da2-befe829775bb", "record_id": "flaws_cloudtrail:0000124:0fc617f8-4ae3-47e7-9da2-befe829775bb", "row_index": 124, "timestamp": "2019-08-15T10:45:23Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1093, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0fc617f8-4ae3-47e7-9da2-befe829775bb", "eventTime": "2019-08-15T10:45:23Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJUL0xzb2N6a0ZEeGRKek5TMFJRVzVkb2ZuVllPQVJ0LzFnWFhjYnRBTXdOVFh4d0ZSb3c4b1p3MG1rMEVSM2NCenZBRGVaR3FrR1E2UjhJWlBPKzlzVHdSWlJpNEtiTGFMeG5CK0M4dnkrM1l3RUphN0lsTVkvOXlnVVluSjNCRFhZMkZMLzl4SFNJR3JqZ051TEIxTVFaSjh6SWhwUXBTYkduUDFLV3I2enJPWWduMGs0UG1RbHdVenBvK0tGbTcxcGtHcDMvQXhUbG1EcnBrS0l4eDR6UXhoRUswa1FjPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "153a7766-dddd-4270-acc5-b18e1008f777", "record_id": "flaws_cloudtrail:0000125:153a7766-dddd-4270-acc5-b18e1008f777", "row_index": 125, "timestamp": "2019-08-15T10:45:23Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1047, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "153a7766-dddd-4270-acc5-b18e1008f777", "eventTime": "2019-08-15T10:45:23Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ0c2RFT0VLSktMUHQ4dWhrS0swcGVxa3BnR3FWV2duMDcvWlg3Z2NVQmxyY3JncW9BNWRqV0UzQ3Z1RFd0YnhjRmh2TGJFSWNUZ0R4ZUQyM1Mwc1ArRWR1WnRRdDA5VUVyYVV5Vk5ad2xUaWdWWTlUMUY4R1MzUEM4cXpwNjFVVExiaGNRbzdKTXplcTBaRzRaZThEVGY0ZEFmamdYeEI1R00ycnZiWW5CNUs3UTFXMDZoU01pQkwvVjZIYTVIYz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0fc617f8-4ae3-47e7-9da2-befe829775bb", "record_id": "flaws_cloudtrail:0000126:0fc617f8-4ae3-47e7-9da2-befe829775bb", "row_index": 126, "timestamp": "2019-08-15T10:45:23Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1093, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0fc617f8-4ae3-47e7-9da2-befe829775bb", "eventTime": "2019-08-15T10:45:23Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJUL0xzb2N6a0ZEeGRKek5TMFJRVzVkb2ZuVllPQVJ0LzFnWFhjYnRBTXdOVFh4d0ZSb3c4b1p3MG1rMEVSM2NCenZBRGVaR3FrR1E2UjhJWlBPKzlzVHdSWlJpNEtiTGFMeG5CK0M4dnkrM1l3RUphN0lsTVkvOXlnVVluSjNCRFhZMkZMLzl4SFNJR3JqZ051TEIxTVFaSjh6SWhwUXBTYkduUDFLV3I2enJPWWduMGs0UG1RbHdVenBvK0tGbTcxcGtHcDMvQXhUbG1EcnBrS0l4eDR6UXhoRUswa1FjPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "14ec2aa6-4ae2-4cb1-a6ee-442ea89567da", "record_id": "flaws_cloudtrail:0000127:14ec2aa6-4ae2-4cb1-a6ee-442ea89567da", "row_index": 127, "timestamp": "2019-08-15T10:45:24Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1093, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "14ec2aa6-4ae2-4cb1-a6ee-442ea89567da", "eventTime": "2019-08-15T10:45:24Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJNUG56MTZqZXROd2o2Q2RZS1I2K0ttTmI5enNPcHByRTU3MVpwelpYdkhZU20vNGlndTJkMG1RRTg2MFYvdlJDN0pPQStoVG04U0d2b0hOSlJqb0tXUzduK2ZFS3g4YXpDSDdYZ0d5STVYd20wYWFkZithYXY1eUR0Z3JGbmMyZHRPSjdndkJhbUJCc0c4ZkNkMHM5R043djczTVFTbFRBUVJaVlU5OExNWlhpc3FNZGYycUJvcndacUVQMnBqaW1hV2p3ZDNjaUl5WHZoRlg2VkRDTjlGQ3EvZW1hWDNNPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "14ec2aa6-4ae2-4cb1-a6ee-442ea89567da", "record_id": "flaws_cloudtrail:0000128:14ec2aa6-4ae2-4cb1-a6ee-442ea89567da", "row_index": 128, "timestamp": "2019-08-15T10:45:24Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1093, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "14ec2aa6-4ae2-4cb1-a6ee-442ea89567da", "eventTime": "2019-08-15T10:45:24Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJNUG56MTZqZXROd2o2Q2RZS1I2K0ttTmI5enNPcHByRTU3MVpwelpYdkhZU20vNGlndTJkMG1RRTg2MFYvdlJDN0pPQStoVG04U0d2b0hOSlJqb0tXUzduK2ZFS3g4YXpDSDdYZ0d5STVYd20wYWFkZithYXY1eUR0Z3JGbmMyZHRPSjdndkJhbUJCc0c4ZkNkMHM5R043djczTVFTbFRBUVJaVlU5OExNWlhpc3FNZGYycUJvcndacUVQMnBqaW1hV2p3ZDNjaUl5WHZoRlg2VkRDTjlGQ3EvZW1hWDNNPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cbb109020-d3da-443b-8667-86b8f37b77ce", "record_id": "flaws_cloudtrail:0000129:cbb109020-d3da-443b-8667-86b8f37b77ce", "row_index": 129, "timestamp": "2019-08-15T10:45:25Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1050, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cbb109020-d3da-443b-8667-86b8f37b77ce", "eventTime": "2019-08-15T10:45:25Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ4WFZsMFgzcGRudXNGNVhlV2hYRDh5Z2g4SjVRZlRITWFoRnFiSnRWdlVoS0VwMFl5Umd3REgxeVdXcGZCR2Fvb2MzVGNWNUtrcU90RHk4eUNrL1FCWllwV3UvZDV4UHBEU2dDdDBpeDcrUWpsQ0xzNnNGeWFZSTNqZk9DOEtOWmcwTm1pbDR6WHhMUzF0QWt2eGxzc0xXcG92KzE4RUNNcjZyMkdpam14QlZwVzRhNjcwY1EwRUJmcXlrV1RCTT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cbb109020-d3da-443b-8667-86b8f37b77ce", "record_id": "flaws_cloudtrail:0000130:cbb109020-d3da-443b-8667-86b8f37b77ce", "row_index": 130, "timestamp": "2019-08-15T10:45:25Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1050, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cbb109020-d3da-443b-8667-86b8f37b77ce", "eventTime": "2019-08-15T10:45:25Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ4WFZsMFgzcGRudXNGNVhlV2hYRDh5Z2g4SjVRZlRITWFoRnFiSnRWdlVoS0VwMFl5Umd3REgxeVdXcGZCR2Fvb2MzVGNWNUtrcU90RHk4eUNrL1FCWllwV3UvZDV4UHBEU2dDdDBpeDcrUWpsQ0xzNnNGeWFZSTNqZk9DOEtOWmcwTm1pbDR6WHhMUzF0QWt2eGxzc0xXcG92KzE4RUNNcjZyMkdpam14QlZwVzRhNjcwY1EwRUJmcXlrV1RCTT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a9abff09-2c1b-4cef-a12b-066531bce612", "record_id": "flaws_cloudtrail:0000131:a9abff09-2c1b-4cef-a12b-066531bce612", "row_index": 131, "timestamp": "2019-08-15T10:46:22Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 780, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a9abff09-2c1b-4cef-a12b-066531bce612", "eventTime": "2019-08-15T10:46:22Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a9abff09-2c1b-4cef-a12b-066531bce612", "record_id": "flaws_cloudtrail:0000132:a9abff09-2c1b-4cef-a12b-066531bce612", "row_index": 132, "timestamp": "2019-08-15T10:46:22Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 780, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a9abff09-2c1b-4cef-a12b-066531bce612", "eventTime": "2019-08-15T10:46:22Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "881f11ab-33ec-4692-a2f4-3dd75f5a3d35", "record_id": "flaws_cloudtrail:0000133:881f11ab-33ec-4692-a2f4-3dd75f5a3d35", "row_index": 133, "timestamp": "2019-08-15T10:46:38Z", "event_type": "GetRestApi", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 723, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "881f11ab-33ec-4692-a2f4-3dd75f5a3d35", "eventTime": "2019-08-15T10:46:38Z", "eventName": "GetRestApi", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "s33ppypa75", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "881f11ab-33ec-4692-a2f4-3dd75f5a3d35", "record_id": "flaws_cloudtrail:0000134:881f11ab-33ec-4692-a2f4-3dd75f5a3d35", "row_index": 134, "timestamp": "2019-08-15T10:46:38Z", "event_type": "GetRestApi", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 723, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "881f11ab-33ec-4692-a2f4-3dd75f5a3d35", "eventTime": "2019-08-15T10:46:38Z", "eventName": "GetRestApi", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "s33ppypa75", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6cbee8fc-6e2a-4e80-bd2b-c3fe1a7aa115", "record_id": "flaws_cloudtrail:0000135:6cbee8fc-6e2a-4e80-bd2b-c3fe1a7aa115", "row_index": 135, "timestamp": "2019-08-15T10:46:51Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 780, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6cbee8fc-6e2a-4e80-bd2b-c3fe1a7aa115", "eventTime": "2019-08-15T10:46:51Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6cbee8fc-6e2a-4e80-bd2b-c3fe1a7aa115", "record_id": "flaws_cloudtrail:0000136:6cbee8fc-6e2a-4e80-bd2b-c3fe1a7aa115", "row_index": 136, "timestamp": "2019-08-15T10:46:51Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 780, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6cbee8fc-6e2a-4e80-bd2b-c3fe1a7aa115", "eventTime": "2019-08-15T10:46:51Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "50d22a3b-cebb-4406-93d6-e0fa398c1dd5", "record_id": "flaws_cloudtrail:0000137:50d22a3b-cebb-4406-93d6-e0fa398c1dd5", "row_index": 137, "timestamp": "2019-08-15T10:47:36Z", "event_type": "GetStages", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 722, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "50d22a3b-cebb-4406-93d6-e0fa398c1dd5", "eventTime": "2019-08-15T10:47:36Z", "eventName": "GetStages", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "s33ppypa75", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "50d22a3b-cebb-4406-93d6-e0fa398c1dd5", "record_id": "flaws_cloudtrail:0000138:50d22a3b-cebb-4406-93d6-e0fa398c1dd5", "row_index": 138, "timestamp": "2019-08-15T10:47:36Z", "event_type": "GetStages", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 722, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "50d22a3b-cebb-4406-93d6-e0fa398c1dd5", "eventTime": "2019-08-15T10:47:36Z", "eventName": "GetStages", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "s33ppypa75", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d028099-8e75-45e3-a347-beaeca25b247", "record_id": "flaws_cloudtrail:0000139:d028099-8e75-45e3-a347-beaeca25b247", "row_index": 139, "timestamp": "2019-08-15T10:48:04Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 779, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d028099-8e75-45e3-a347-beaeca25b247", "eventTime": "2019-08-15T10:48:04Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d028099-8e75-45e3-a347-beaeca25b247", "record_id": "flaws_cloudtrail:0000140:d028099-8e75-45e3-a347-beaeca25b247", "row_index": 140, "timestamp": "2019-08-15T10:48:04Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 779, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d028099-8e75-45e3-a347-beaeca25b247", "eventTime": "2019-08-15T10:48:04Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1f85be0d-7767-40df-b602-b735a0b49141", "record_id": "flaws_cloudtrail:0000141:1f85be0d-7767-40df-b602-b735a0b49141", "row_index": 141, "timestamp": "2019-08-15T10:49:10Z", "event_type": "GetStage", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 740, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1f85be0d-7767-40df-b602-b735a0b49141", "eventTime": "2019-08-15T10:49:10Z", "eventName": "GetStage", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "s33ppypa75", "stageName": "Prod", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1f85be0d-7767-40df-b602-b735a0b49141", "record_id": "flaws_cloudtrail:0000142:1f85be0d-7767-40df-b602-b735a0b49141", "row_index": 142, "timestamp": "2019-08-15T10:49:10Z", "event_type": "GetStage", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 740, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1f85be0d-7767-40df-b602-b735a0b49141", "eventTime": "2019-08-15T10:49:10Z", "eventName": "GetStage", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "s33ppypa75", "stageName": "Prod", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7527d495-7411-4230-8a3a-8b80ae4f1cf2", "record_id": "flaws_cloudtrail:0000143:7527d495-7411-4230-8a3a-8b80ae4f1cf2", "row_index": 143, "timestamp": "2019-08-15T10:50:07Z", "event_type": "GetDeployment", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7527d495-7411-4230-8a3a-8b80ae4f1cf2", "eventTime": "2019-08-15T10:50:07Z", "eventName": "GetDeployment", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"deploymentId": "8gppiv", "restApiId": "s33ppypa75", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7527d495-7411-4230-8a3a-8b80ae4f1cf2", "record_id": "flaws_cloudtrail:0000144:7527d495-7411-4230-8a3a-8b80ae4f1cf2", "row_index": 144, "timestamp": "2019-08-15T10:50:07Z", "event_type": "GetDeployment", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7527d495-7411-4230-8a3a-8b80ae4f1cf2", "eventTime": "2019-08-15T10:50:07Z", "eventName": "GetDeployment", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"deploymentId": "8gppiv", "restApiId": "s33ppypa75", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6c9b8ae7-6cb5-48a3-8348-9c55b830fe3e", "record_id": "flaws_cloudtrail:0000145:6c9b8ae7-6cb5-48a3-8348-9c55b830fe3e", "row_index": 145, "timestamp": "2019-08-15T10:51:00Z", "event_type": "GetApiKeys", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 869, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6c9b8ae7-6cb5-48a3-8348-9c55b830fe3e", "eventTime": "2019-08-15T10:51:00Z", "eventName": "GetApiKeys", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: apigateway:GET on resource: arn:aws:apigateway:us-west-2::/apikeys", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6c9b8ae7-6cb5-48a3-8348-9c55b830fe3e", "record_id": "flaws_cloudtrail:0000146:6c9b8ae7-6cb5-48a3-8348-9c55b830fe3e", "row_index": 146, "timestamp": "2019-08-15T10:51:00Z", "event_type": "GetApiKeys", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 869, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6c9b8ae7-6cb5-48a3-8348-9c55b830fe3e", "eventTime": "2019-08-15T10:51:00Z", "eventName": "GetApiKeys", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: apigateway:GET on resource: arn:aws:apigateway:us-west-2::/apikeys", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e3db4201-717a-443f-b6ce-1c4eddc6ef88", "record_id": "flaws_cloudtrail:0000147:e3db4201-717a-443f-b6ce-1c4eddc6ef88", "row_index": 147, "timestamp": "2019-08-15T10:52:09Z", "event_type": "GetFunctionConfiguration202224v2", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 897, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e3db4201-717a-443f-b6ce-1c4eddc6ef88", "eventTime": "2019-08-15T10:52:09Z", "eventName": "GetFunctionConfiguration202224v2", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "awsRegion": "us-east-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: lambda:GetFunctionConfiguration on resource: arn:aws:lambda:us-east-2:811596193553:function:Level6", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e3db4201-717a-443f-b6ce-1c4eddc6ef88", "record_id": "flaws_cloudtrail:0000148:e3db4201-717a-443f-b6ce-1c4eddc6ef88", "row_index": 148, "timestamp": "2019-08-15T10:52:09Z", "event_type": "GetFunctionConfiguration202224v2", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 897, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e3db4201-717a-443f-b6ce-1c4eddc6ef88", "eventTime": "2019-08-15T10:52:09Z", "eventName": "GetFunctionConfiguration202224v2", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "awsRegion": "us-east-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: lambda:GetFunctionConfiguration on resource: arn:aws:lambda:us-east-2:811596193553:function:Level6", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a1cdb198-9b49-479c-9d6e-954523fe5a0a", "record_id": "flaws_cloudtrail:0000149:a1cdb198-9b49-479c-9d6e-954523fe5a0a", "row_index": 149, "timestamp": "2019-08-15T10:52:19Z", "event_type": "GetFunctionConfiguration202224v2", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 903, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a1cdb198-9b49-479c-9d6e-954523fe5a0a", "eventTime": "2019-08-15T10:52:19Z", "eventName": "GetFunctionConfiguration202224v2", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: lambda:GetFunctionConfiguration on resource: arn:aws:lambda:us-west-2:811596193553:function:Level6", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a1cdb198-9b49-479c-9d6e-954523fe5a0a", "record_id": "flaws_cloudtrail:0000150:a1cdb198-9b49-479c-9d6e-954523fe5a0a", "row_index": 150, "timestamp": "2019-08-15T10:52:19Z", "event_type": "GetFunctionConfiguration202224v2", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "164.224.65.250", "user_agent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 903, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a1cdb198-9b49-479c-9d6e-954523fe5a0a", "eventTime": "2019-08-15T10:52:19Z", "eventName": "GetFunctionConfiguration202224v2", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "164.224.65.250", "userAgent": "aws-cli/1.16.19 Python/3.7.4 Darwin/18.7.0 botocore/1.12.9", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: lambda:GetFunctionConfiguration on resource: arn:aws:lambda:us-west-2:811596193553:function:Level6", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "832e736b-9c50-42af-97c7-fd360040c38", "record_id": "flaws_cloudtrail:0000151:832e736b-9c50-42af-97c7-fd360040c38", "row_index": 151, "timestamp": "2019-08-15T10:56:51Z", "event_type": "CreateLogStream", "event_source": "logs.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "account_id": "811596193553", "principal_id": "AROAI4E1FBACLY3FPC6BB:Level6", "user_name": null, "access_key_id": "ASIAKSNZBSDA7JRSLBPS", "session_issuer_arn": "arn:aws:iam::811596193553:role/service-role/Level6", "session_issuer_user_name": "Level6"}, "network": {"source_ip": "234.254.113.9", "user_agent": "awslambda-worker", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1029, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "832e736b-9c50-42af-97c7-fd360040c38", "eventTime": "2019-08-15T10:56:51Z", "eventName": "CreateLogStream", "eventSource": "logs.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "234.254.113.9", "userAgent": "awslambda-worker", "awsRegion": "us-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAI4E1FBACLY3FPC6BB:Level6", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "accountId": "811596193553", "accessKeyId": "ASIAKSNZBSDA7JRSLBPS", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-08-15T10:56:51Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAI4E1FBACLY3FPC6BB", "arn": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "userName": "Level6"}}}, "requestParameters": {"logStreamName": "2019/08/15/[$LATEST]251a5769725feee93c8f61bc50115346", "logGroupName": "/aws/lambda/Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6b2568a6-3c3d-433c-85de-391056eb8086", "record_id": "flaws_cloudtrail:0000152:6b2568a6-3c3d-433c-85de-391056eb8086", "row_index": 152, "timestamp": "2019-08-15T10:56:51Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "lambda.amazonaws.com", "user_agent": "lambda.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/service-role/Level6"], "raw_record_size_bytes": 1620, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6b2568a6-3c3d-433c-85de-391056eb8086", "eventTime": "2019-08-15T10:56:51Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "lambda.amazonaws.com", "userAgent": "lambda.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "lambda.amazonaws.com"}, "requestParameters": {"roleSessionName": "Level6", "roleArn": "arn:aws:iam::811596193553:role/service-role/Level6"}, "responseElements": {"credentials": {"accessKeyId": "ASIAKSNZBSDA7JRSLBPS", "expiration": "Aug 15, 2019 10:56:51 PM", "sessionToken": "AgoJb3JpZ2luX2VjEJP//////////wEaCXVzLXdlc3QtMiJHMEUCIQDDhBSz59ySbHhYsy1ncp+5eryujdp6sP8S/nYWKgPFLAIgH752w5RHADedmbbum6D8Zz7qmkKtYH5KiX9gVdPSuZUqggIILBAAGgw5NzU0MjYyNjIwMjkiDH1OdMBhYxXuON50SyrfAXnf7LmS+rGoybh9dZjUevyHp61i+Xg7cYoIaGtHz4FtIqWjOzCSkYfWmjAppTVZT9QXVQQsPFQiB8PsCAPBdBNDbZTGcB3BK6q7Nhh1lciRTYhrChZ+LQgQrR7Q9LKzgFne82q5W8iozAuOufgGAo3piVuqPR9/Jho2oqZOIlzbUMR84r15OfkaLlAzjQCkPOaNu5T6rX+YX39w8gjzDjYPBij4ST/9T2S926Whn7zCI9ZaJhzPtQVw7n6YMRUfqVjH99swbsWUk1lwpDjzwro0G/lEjhOK8qoOWYtMTKIw8/TU6gU6tAGjCOikEc+UU9ZV4U5mt0+nu9nq3AwuFQhks4FGKSXByN34RkgjR0SnY/fJ2yb/ellMJYXPkTYDoYU+IoqWEZ9TK5Iusy+Vm8FH5EqAA9P524HtrBrDwKkUZDbjgdVkFFAgXC6YBn17TdnOGNMqTNKfU5vEBT1ZNArENhmCmIPlyEi5E5Ty4KkSN+3qyNmuMtAHKM3kQc/KOU4Am12h2EXbuLqgwI6tuwuBnDEBhZZLZlPq+9g="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "267d7cfa-fa7c-4a23-89e7-d6499dc66395", "record_id": "flaws_cloudtrail:0000153:267d7cfa-fa7c-4a23-89e7-d6499dc66395", "row_index": 153, "timestamp": "2019-08-15T10:56:51Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "lambda.amazonaws.com", "user_agent": "lambda.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/service-role/Level6"], "raw_record_size_bytes": 1620, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "267d7cfa-fa7c-4a23-89e7-d6499dc66395", "eventTime": "2019-08-15T10:56:51Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "lambda.amazonaws.com", "userAgent": "lambda.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "lambda.amazonaws.com"}, "requestParameters": {"roleSessionName": "Level6", "roleArn": "arn:aws:iam::811596193553:role/service-role/Level6"}, "responseElements": {"credentials": {"accessKeyId": "ASIAC5CB93XIQIW73MEL", "expiration": "Aug 15, 2019 10:56:51 PM", "sessionToken": "AgoJb3JpZ2luX2VjEJP//////////wEaCXVzLXdlc3QtMiJGMEQCIBaSmBES065EUEiy6Fem+WwkdyTyYUdnXH74fwHF5VuGAiApUGQf4IpGLquHi8ZlAVUZ44bij5pftRaGyh+YTKJt8yqCAggsEAAaDDk3NTQyNjI2MjAyOSIM0Z375djBTMGn6ZARKt8BPeo+TLQHJ9dUG+4cuQIAYTWOhIIh9E+KYH78iPMx/WUHUTSIW180OUKFON88Ll/zE1IvDpuDPaJf6QMbHhD9T3SI1W+EGnZKbQis/JRkESwwIl/N/eD6eOws8/PqHAXi1WXimbfiaWhtKrzFvoXO+XIm2Gd4YNKLhWbrDtbXJVtsVMkgNFvY0XAOrp9qgce+8T/W5/3wrD+xWGDk7yXVihVlVD3REJ9XXFfnxNWZO4fVoNmT6bymZSZ9SBRSduJY4sMmcCEY8+6Z78WZ4y4+y244++a5BthhgepugnA6jjDz9NTqBTq1AaUakMyXBCCAJwBaCQbMYRN9G9nirnZ8w6CB1yroIXWdYLLOlbG10cKB/Hvi2SJ2j2dJlpI6WlcAdKGxYpceTP4kOQb9fMgO8xTOzIZMBtNJFONF0EExjoknTQJdP9csRV+i4KWF9Uh1AQSIX0TlsbUZzWJU/wGxAplbDku/YIX0GdcSqXkE0nRQtMnt66qyUw8Wv/I0IWRMIH/yk8yiN0IzXGRQTnHs+hk4iCbqMWhPVqm8sj8="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "832e736b-9c50-42af-97c7-fd360040c38", "record_id": "flaws_cloudtrail:0000154:832e736b-9c50-42af-97c7-fd360040c38", "row_index": 154, "timestamp": "2019-08-15T10:56:51Z", "event_type": "CreateLogStream", "event_source": "logs.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "account_id": "811596193553", "principal_id": "AROAI4E1FBACLY3FPC6BB:Level6", "user_name": null, "access_key_id": "ASIAKSNZBSDA7JRSLBPS", "session_issuer_arn": "arn:aws:iam::811596193553:role/service-role/Level6", "session_issuer_user_name": "Level6"}, "network": {"source_ip": "234.254.113.9", "user_agent": "awslambda-worker", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1029, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "832e736b-9c50-42af-97c7-fd360040c38", "eventTime": "2019-08-15T10:56:51Z", "eventName": "CreateLogStream", "eventSource": "logs.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "234.254.113.9", "userAgent": "awslambda-worker", "awsRegion": "us-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAI4E1FBACLY3FPC6BB:Level6", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "accountId": "811596193553", "accessKeyId": "ASIAKSNZBSDA7JRSLBPS", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-08-15T10:56:51Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAI4E1FBACLY3FPC6BB", "arn": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "userName": "Level6"}}}, "requestParameters": {"logStreamName": "2019/08/15/[$LATEST]251a5769725feee93c8f61bc50115346", "logGroupName": "/aws/lambda/Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6b2568a6-3c3d-433c-85de-391056eb8086", "record_id": "flaws_cloudtrail:0000155:6b2568a6-3c3d-433c-85de-391056eb8086", "row_index": 155, "timestamp": "2019-08-15T10:56:51Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "lambda.amazonaws.com", "user_agent": "lambda.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/service-role/Level6"], "raw_record_size_bytes": 1620, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6b2568a6-3c3d-433c-85de-391056eb8086", "eventTime": "2019-08-15T10:56:51Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "lambda.amazonaws.com", "userAgent": "lambda.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "lambda.amazonaws.com"}, "requestParameters": {"roleSessionName": "Level6", "roleArn": "arn:aws:iam::811596193553:role/service-role/Level6"}, "responseElements": {"credentials": {"accessKeyId": "ASIAKSNZBSDA7JRSLBPS", "expiration": "Aug 15, 2019 10:56:51 PM", "sessionToken": "AgoJb3JpZ2luX2VjEJP//////////wEaCXVzLXdlc3QtMiJHMEUCIQDDhBSz59ySbHhYsy1ncp+5eryujdp6sP8S/nYWKgPFLAIgH752w5RHADedmbbum6D8Zz7qmkKtYH5KiX9gVdPSuZUqggIILBAAGgw5NzU0MjYyNjIwMjkiDH1OdMBhYxXuON50SyrfAXnf7LmS+rGoybh9dZjUevyHp61i+Xg7cYoIaGtHz4FtIqWjOzCSkYfWmjAppTVZT9QXVQQsPFQiB8PsCAPBdBNDbZTGcB3BK6q7Nhh1lciRTYhrChZ+LQgQrR7Q9LKzgFne82q5W8iozAuOufgGAo3piVuqPR9/Jho2oqZOIlzbUMR84r15OfkaLlAzjQCkPOaNu5T6rX+YX39w8gjzDjYPBij4ST/9T2S926Whn7zCI9ZaJhzPtQVw7n6YMRUfqVjH99swbsWUk1lwpDjzwro0G/lEjhOK8qoOWYtMTKIw8/TU6gU6tAGjCOikEc+UU9ZV4U5mt0+nu9nq3AwuFQhks4FGKSXByN34RkgjR0SnY/fJ2yb/ellMJYXPkTYDoYU+IoqWEZ9TK5Iusy+Vm8FH5EqAA9P524HtrBrDwKkUZDbjgdVkFFAgXC6YBn17TdnOGNMqTNKfU5vEBT1ZNArENhmCmIPlyEi5E5Ty4KkSN+3qyNmuMtAHKM3kQc/KOU4Am12h2EXbuLqgwI6tuwuBnDEBhZZLZlPq+9g="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "267d7cfa-fa7c-4a23-89e7-d6499dc66395", "record_id": "flaws_cloudtrail:0000156:267d7cfa-fa7c-4a23-89e7-d6499dc66395", "row_index": 156, "timestamp": "2019-08-15T10:56:51Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "lambda.amazonaws.com", "user_agent": "lambda.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/service-role/Level6"], "raw_record_size_bytes": 1620, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "267d7cfa-fa7c-4a23-89e7-d6499dc66395", "eventTime": "2019-08-15T10:56:51Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "lambda.amazonaws.com", "userAgent": "lambda.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "lambda.amazonaws.com"}, "requestParameters": {"roleSessionName": "Level6", "roleArn": "arn:aws:iam::811596193553:role/service-role/Level6"}, "responseElements": {"credentials": {"accessKeyId": "ASIAC5CB93XIQIW73MEL", "expiration": "Aug 15, 2019 10:56:51 PM", "sessionToken": "AgoJb3JpZ2luX2VjEJP//////////wEaCXVzLXdlc3QtMiJGMEQCIBaSmBES065EUEiy6Fem+WwkdyTyYUdnXH74fwHF5VuGAiApUGQf4IpGLquHi8ZlAVUZ44bij5pftRaGyh+YTKJt8yqCAggsEAAaDDk3NTQyNjI2MjAyOSIM0Z375djBTMGn6ZARKt8BPeo+TLQHJ9dUG+4cuQIAYTWOhIIh9E+KYH78iPMx/WUHUTSIW180OUKFON88Ll/zE1IvDpuDPaJf6QMbHhD9T3SI1W+EGnZKbQis/JRkESwwIl/N/eD6eOws8/PqHAXi1WXimbfiaWhtKrzFvoXO+XIm2Gd4YNKLhWbrDtbXJVtsVMkgNFvY0XAOrp9qgce+8T/W5/3wrD+xWGDk7yXVihVlVD3REJ9XXFfnxNWZO4fVoNmT6bymZSZ9SBRSduJY4sMmcCEY8+6Z78WZ4y4+y244++a5BthhgepugnA6jjDz9NTqBTq1AaUakMyXBCCAJwBaCQbMYRN9G9nirnZ8w6CB1yroIXWdYLLOlbG10cKB/Hvi2SJ2j2dJlpI6WlcAdKGxYpceTP4kOQb9fMgO8xTOzIZMBtNJFONF0EExjoknTQJdP9csRV+i4KWF9Uh1AQSIX0TlsbUZzWJU/wGxAplbDku/YIX0GdcSqXkE0nRQtMnt66qyUw8Wv/I0IWRMIH/yk8yiN0IzXGRQTnHs+hk4iCbqMWhPVqm8sj8="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1de82d79-23c5-4639-af5e-3fb82bd2471e", "record_id": "flaws_cloudtrail:0000157:1de82d79-23c5-4639-af5e-3fb82bd2471e", "row_index": 157, "timestamp": "2019-08-15T10:57:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1880, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1de82d79-23c5-4639-af5e-3fb82bd2471e", "eventTime": "2019-08-15T10:57:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIAOFHWTPX4ANBKE54H", "expiration": "Aug 15, 2019 5:20:08 PM", "sessionToken": "AgoJb3JpZ2luX2VjEJP//////////wEaCXVzLXdlc3QtMiJHMEUCICeAdyaPCd+2v/1YU/n62DlMhA4qnK8bqc3QpIi6vGJ9AiEAxT9HpkD/HpBPWD9InheCAcUyPvTqRGWsv4jFpTWD5isq2gMILBAAGgw5NzU0MjYyNjIwMjkiDM+x8MHsQGw7viF4FSq3Axx0xB+H8y6tkgzyUQjK3KRgdSxMJAAmLqoyjTLX4DVS312fR5bCygtPzTc9I8s0i6nqyKzmm6z2m/gR1KVieUb0YOIq7d1XtDYzt8uPZ6Z26jblqFaXDEaadhj3cp81EQpqcGS8DXzZuRZ422FIZwsjT3do1VkZuSPwhGGtgmOOl3oySBv+26muJz0Xuim4CH+x3pKHYd5oszorDcOGz2FhYQJWpoRjVyjoYxds3evYU1E4dghdZB58uzuXFV4p8jWFfaBDGE9TVM8zgJ+wwRt9hZONQgh+5z+abqtHGf/7UiImKs+yZtAQ5/EGWHcnqc26I/wRRgyxpL4kfTJwn63iSqXhte6dAOcfxyga2eSQigHkkHbEQ34MKR4NYLuKzM4WKcjxc8iD8WR9Wf3uKPkySZwucAqKt88nuGgicVlrfZ4tQdeUF78AK5E182HHjxHhWeg7agHtLfhwbMqfcFSeYc3gi/PZnyvhYC72uBmh1AgeXu97l6nI1PvvqWmyJZaojgVl3ERN78BfCuhvLv6hB4XhvHnDRqMC+x2Kv9JGrxCXDIuz6CN2raFMadkZvzWuzdMx8awwkvXU6gU6tAGCdKiFthYOVVm6nxWbD9ZLkkJgK82XGfDZ1aerJTXinfQ3oVgd7+uq5khb9Yqp/LGy2n7HP6bXrk4Vnep/kzsIkvPidIxM84q3fUbsgXzxxz0hUidY04/JAcj8L1ayerVtNWsBrJXIjwl2aM5r1lQVVeeaTNCHv5uPNMk4IGmvTEdVHq5UK7QBG9JnoHt0NeZlumfUhXrOrur82L0Yg4KoO0wtCv6U8/WCwSyx3T6t9Nl764c="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1de82d79-23c5-4639-af5e-3fb82bd2471e", "record_id": "flaws_cloudtrail:0000158:1de82d79-23c5-4639-af5e-3fb82bd2471e", "row_index": 158, "timestamp": "2019-08-15T10:57:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1880, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1de82d79-23c5-4639-af5e-3fb82bd2471e", "eventTime": "2019-08-15T10:57:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIAOFHWTPX4ANBKE54H", "expiration": "Aug 15, 2019 5:20:08 PM", "sessionToken": "AgoJb3JpZ2luX2VjEJP//////////wEaCXVzLXdlc3QtMiJHMEUCICeAdyaPCd+2v/1YU/n62DlMhA4qnK8bqc3QpIi6vGJ9AiEAxT9HpkD/HpBPWD9InheCAcUyPvTqRGWsv4jFpTWD5isq2gMILBAAGgw5NzU0MjYyNjIwMjkiDM+x8MHsQGw7viF4FSq3Axx0xB+H8y6tkgzyUQjK3KRgdSxMJAAmLqoyjTLX4DVS312fR5bCygtPzTc9I8s0i6nqyKzmm6z2m/gR1KVieUb0YOIq7d1XtDYzt8uPZ6Z26jblqFaXDEaadhj3cp81EQpqcGS8DXzZuRZ422FIZwsjT3do1VkZuSPwhGGtgmOOl3oySBv+26muJz0Xuim4CH+x3pKHYd5oszorDcOGz2FhYQJWpoRjVyjoYxds3evYU1E4dghdZB58uzuXFV4p8jWFfaBDGE9TVM8zgJ+wwRt9hZONQgh+5z+abqtHGf/7UiImKs+yZtAQ5/EGWHcnqc26I/wRRgyxpL4kfTJwn63iSqXhte6dAOcfxyga2eSQigHkkHbEQ34MKR4NYLuKzM4WKcjxc8iD8WR9Wf3uKPkySZwucAqKt88nuGgicVlrfZ4tQdeUF78AK5E182HHjxHhWeg7agHtLfhwbMqfcFSeYc3gi/PZnyvhYC72uBmh1AgeXu97l6nI1PvvqWmyJZaojgVl3ERN78BfCuhvLv6hB4XhvHnDRqMC+x2Kv9JGrxCXDIuz6CN2raFMadkZvzWuzdMx8awwkvXU6gU6tAGCdKiFthYOVVm6nxWbD9ZLkkJgK82XGfDZ1aerJTXinfQ3oVgd7+uq5khb9Yqp/LGy2n7HP6bXrk4Vnep/kzsIkvPidIxM84q3fUbsgXzxxz0hUidY04/JAcj8L1ayerVtNWsBrJXIjwl2aM5r1lQVVeeaTNCHv5uPNMk4IGmvTEdVHq5UK7QBG9JnoHt0NeZlumfUhXrOrur82L0Yg4KoO0wtCv6U8/WCwSyx3T6t9Nl764c="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "931e9a56-113c-4d27-8d4f-9b240f814c21", "record_id": "flaws_cloudtrail:0000159:931e9a56-113c-4d27-8d4f-9b240f814c21", "row_index": 159, "timestamp": "2019-08-15T11:02:58Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "[aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 795, "raw_record_depth": 3, "raw_record_top_level_keys": ["additionalEventData", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "931e9a56-113c-4d27-8d4f-9b240f814c21", "eventTime": "2019-08-15T11:02:58Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "[aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207]", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"host": ["s3.amazonaws.com"]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "931e9a56-113c-4d27-8d4f-9b240f814c21", "record_id": "flaws_cloudtrail:0000160:931e9a56-113c-4d27-8d4f-9b240f814c21", "row_index": 160, "timestamp": "2019-08-15T11:02:58Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "[aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 795, "raw_record_depth": 3, "raw_record_top_level_keys": ["additionalEventData", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "931e9a56-113c-4d27-8d4f-9b240f814c21", "eventTime": "2019-08-15T11:02:58Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "[aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207]", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"host": ["s3.amazonaws.com"]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b1f49a73-1a9d-43f0-a5ee-b2fbbaf592bd", "record_id": "flaws_cloudtrail:0000161:b1f49a73-1a9d-43f0-a5ee-b2fbbaf592bd", "row_index": 161, "timestamp": "2019-08-15T11:32:19Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "lambda.amazonaws.com", "user_agent": "lambda.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/service-role/Level6"], "raw_record_size_bytes": 1620, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b1f49a73-1a9d-43f0-a5ee-b2fbbaf592bd", "eventTime": "2019-08-15T11:32:19Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "lambda.amazonaws.com", "userAgent": "lambda.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "lambda.amazonaws.com"}, "requestParameters": {"roleSessionName": "Level6", "roleArn": "arn:aws:iam::811596193553:role/service-role/Level6"}, "responseElements": {"credentials": {"accessKeyId": "ASIAVMHWKQTKVWJ3MI51", "expiration": "Aug 15, 2019 11:32:19 PM", "sessionToken": "AgoJb3JpZ2luX2VjEJT//////////wEaCXVzLXdlc3QtMiJIMEYCIQDGjRlsZZpDnrbVRCj4zQcNr94hvkVbQ4x/7+sl9bX1JgIhAPf6ZxnXOXKXSzYwh3NPLUrE42uLE4G04WWlf+SciZoJKoICCC0QABoMOTc1NDI2MjYyMDI5IgyJxxose2Y6nnLCDBYq3wGhb7AMJdHehy8NAUVHMbw/Osj67ngNO81Lg85/k+f+cfTP7Luz2jAult49boyXDiTHbCzpJ9R+jPhHWQIovJBIRsDw/oBxhLZpldADrTxZl6AfhBih+vDnqBH/nVUfJ4ZNIPnKPDcbkvn0uCt3RsPt/MTE5AqzNTKBlHcSM08GHHL0KS8bwzN8jEhhKSrVaTO8bzHgB2mjbaDHbuQdYFwvmZ/oXFOUhs0jkChQS1IJRtZwCr8YjGdII5aU1OZMicajhThOJGuld65qOxOYywUF4WlFHhMBtumLMqI6Cf66MMOF1eoFOrMBHoAsY/v1e+I6QvskUdBX4/G09qq04Cf/juEf+Ao1k6R+DGsYGkOC18d2Gf955IHCi6LKatFzEjIQb/pUZ6yJNcHQIYDRx1ff0RvXgo+OVmI/tcqNL9zxxVO7k2YLE58fFx1eQFuH7eRUYODCCt8yaZKgbJfiwwvXmwhbvc6t23H2RbjJ8wjW6T8fdzZN2ZlckovDhuNOQS2fnK5mQXJfZWHyy+QNqSkrRN+Bl7V2xx6Bn5c="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "653b9e70-3273-4b30-a75c-62a1f251b08e", "record_id": "flaws_cloudtrail:0000162:653b9e70-3273-4b30-a75c-62a1f251b08e", "row_index": 162, "timestamp": "2019-08-15T11:32:19Z", "event_type": "CreateLogStream", "event_source": "logs.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "account_id": "811596193553", "principal_id": "AROAI4E1FBACLY3FPC6BB:Level6", "user_name": null, "access_key_id": "ASIAKSNZBSDA7JRSLBPS", "session_issuer_arn": "arn:aws:iam::811596193553:role/service-role/Level6", "session_issuer_user_name": "Level6"}, "network": {"source_ip": "255.1.250.0", "user_agent": "awslambda-worker", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1029, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "653b9e70-3273-4b30-a75c-62a1f251b08e", "eventTime": "2019-08-15T11:32:19Z", "eventName": "CreateLogStream", "eventSource": "logs.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.1.250.0", "userAgent": "awslambda-worker", "awsRegion": "us-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAI4E1FBACLY3FPC6BB:Level6", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "accountId": "811596193553", "accessKeyId": "ASIAKSNZBSDA7JRSLBPS", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-08-15T10:56:51Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAI4E1FBACLY3FPC6BB", "arn": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "userName": "Level6"}}}, "requestParameters": {"logGroupName": "/aws/lambda/Level6", "logStreamName": "2019/08/15/[$LATEST]4fded36ef8dc3093daac17454c9b0847"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "653b9e70-3273-4b30-a75c-62a1f251b08e", "record_id": "flaws_cloudtrail:0000163:653b9e70-3273-4b30-a75c-62a1f251b08e", "row_index": 163, "timestamp": "2019-08-15T11:32:19Z", "event_type": "CreateLogStream", "event_source": "logs.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "account_id": "811596193553", "principal_id": "AROAI4E1FBACLY3FPC6BB:Level6", "user_name": null, "access_key_id": "ASIAKSNZBSDA7JRSLBPS", "session_issuer_arn": "arn:aws:iam::811596193553:role/service-role/Level6", "session_issuer_user_name": "Level6"}, "network": {"source_ip": "255.1.250.0", "user_agent": "awslambda-worker", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1029, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "653b9e70-3273-4b30-a75c-62a1f251b08e", "eventTime": "2019-08-15T11:32:19Z", "eventName": "CreateLogStream", "eventSource": "logs.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.1.250.0", "userAgent": "awslambda-worker", "awsRegion": "us-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAI4E1FBACLY3FPC6BB:Level6", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "accountId": "811596193553", "accessKeyId": "ASIAKSNZBSDA7JRSLBPS", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-08-15T10:56:51Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAI4E1FBACLY3FPC6BB", "arn": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "userName": "Level6"}}}, "requestParameters": {"logGroupName": "/aws/lambda/Level6", "logStreamName": "2019/08/15/[$LATEST]4fded36ef8dc3093daac17454c9b0847"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b1f49a73-1a9d-43f0-a5ee-b2fbbaf592bd", "record_id": "flaws_cloudtrail:0000164:b1f49a73-1a9d-43f0-a5ee-b2fbbaf592bd", "row_index": 164, "timestamp": "2019-08-15T11:32:19Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "lambda.amazonaws.com", "user_agent": "lambda.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/service-role/Level6"], "raw_record_size_bytes": 1620, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b1f49a73-1a9d-43f0-a5ee-b2fbbaf592bd", "eventTime": "2019-08-15T11:32:19Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "lambda.amazonaws.com", "userAgent": "lambda.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "lambda.amazonaws.com"}, "requestParameters": {"roleSessionName": "Level6", "roleArn": "arn:aws:iam::811596193553:role/service-role/Level6"}, "responseElements": {"credentials": {"accessKeyId": "ASIAVMHWKQTKVWJ3MI51", "expiration": "Aug 15, 2019 11:32:19 PM", "sessionToken": "AgoJb3JpZ2luX2VjEJT//////////wEaCXVzLXdlc3QtMiJIMEYCIQDGjRlsZZpDnrbVRCj4zQcNr94hvkVbQ4x/7+sl9bX1JgIhAPf6ZxnXOXKXSzYwh3NPLUrE42uLE4G04WWlf+SciZoJKoICCC0QABoMOTc1NDI2MjYyMDI5IgyJxxose2Y6nnLCDBYq3wGhb7AMJdHehy8NAUVHMbw/Osj67ngNO81Lg85/k+f+cfTP7Luz2jAult49boyXDiTHbCzpJ9R+jPhHWQIovJBIRsDw/oBxhLZpldADrTxZl6AfhBih+vDnqBH/nVUfJ4ZNIPnKPDcbkvn0uCt3RsPt/MTE5AqzNTKBlHcSM08GHHL0KS8bwzN8jEhhKSrVaTO8bzHgB2mjbaDHbuQdYFwvmZ/oXFOUhs0jkChQS1IJRtZwCr8YjGdII5aU1OZMicajhThOJGuld65qOxOYywUF4WlFHhMBtumLMqI6Cf66MMOF1eoFOrMBHoAsY/v1e+I6QvskUdBX4/G09qq04Cf/juEf+Ao1k6R+DGsYGkOC18d2Gf955IHCi6LKatFzEjIQb/pUZ6yJNcHQIYDRx1ff0RvXgo+OVmI/tcqNL9zxxVO7k2YLE58fFx1eQFuH7eRUYODCCt8yaZKgbJfiwwvXmwhbvc6t23H2RbjJ8wjW6T8fdzZN2ZlckovDhuNOQS2fnK5mQXJfZWHyy+QNqSkrRN+Bl7V2xx6Bn5c="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c84d9bb1-617b-4dad-b516-d30aefb22dc7", "record_id": "flaws_cloudtrail:0000165:c84d9bb1-617b-4dad-b516-d30aefb22dc7", "row_index": 165, "timestamp": "2019-08-15T11:57:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1882, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c84d9bb1-617b-4dad-b516-d30aefb22dc7", "eventTime": "2019-08-15T11:57:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIA0VMM6J5D3NMURU86", "expiration": "Aug 15, 2019 6:01:00 PM", "sessionToken": "AgoJb3JpZ2luX2VjEJT//////////wEaCXVzLXdlc3QtMiJHMEUCIQCiioeZ9DKhzg5akOK+fDy5DqU2uHS74lYXzjq9kMiFqwIgIFwmdhOSJPV0rrvwm+qxakQHozPdLBk6FmJtzzwPPtUq2gMILRAAGgw5NzU0MjYyNjIwMjkiDAIyOqnIjCNRnbvQdiq3A/c4qQrrv4J1PpfE9UJERaGJyMxQVVSNZG16s++EpZnhKxqDwPoPOitc7TMHLLM8yOFasFi2sT3R7ZpoXd4lbBb2efSCtQmPZC5US+FSJym9kUhVHBb1P96wY/7ETQBoLMpj+6boRf7FePlyGXYyCXedyehv3t8HtpMIe2QqovM75F88x0w2wEZOswJczqkClWx+ZTBc7QPKYswOTjP3h0D3/zCtMZfcSUMHhjR3eIheGiEpIc2/tZuQfiXb9TiJ7hR1+hwnHJhRShp8K0urZP5Sj/KwvyVLhq/Jlz7alAPjfSjTVzIG5iOBzOolhu2pG4kBb0wCfdRBpVwhnvBwGNMCqYZwAouFSwKWgYfvYJom2tMTbmuO6NbPKg9oLS24Zg0NcTuAyVUBVfwaK+VMDpdwwdHwxYDmOHQ/dU2VrTyd5/ef0mWJQeoD7V14DkeDO767fx0DBr13aNcRuTVrO9lvVekZvS98DM48qbJMjvMmzoXCUckzGj423OjHCl/DIaAi4rswH82xqxobP3KZ2FRzik5uY18hlTwu+oBRlgnM5NPHAPYdmDMzpSwvRur+4D2vIfEyaYswopHV6gU6tAHAbrYmG0E7JVzGODxRbe4BnCoDGoWWiTRqWsNTmZTN2VEcMtlvj9S3W+zsHMP/rNhWIa8LGSON0Bes+n92uedbcv8PQwAUZse0uvzId1vehatdbIRYHGABkwAqAy+3uW9d/YDGsxqkeWQGC/ubEFoxnTIrS3ZdS2q3K+YT/7S4HG/amtJfpk6S2Xj8nvcw0x1aDO7AoQoLqhMVDK2rYtWSRIpp2TF7qW1vqDXOyPFfy21ix7M="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c84d9bb1-617b-4dad-b516-d30aefb22dc7", "record_id": "flaws_cloudtrail:0000166:c84d9bb1-617b-4dad-b516-d30aefb22dc7", "row_index": 166, "timestamp": "2019-08-15T11:57:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1882, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c84d9bb1-617b-4dad-b516-d30aefb22dc7", "eventTime": "2019-08-15T11:57:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIA0VMM6J5D3NMURU86", "expiration": "Aug 15, 2019 6:01:00 PM", "sessionToken": "AgoJb3JpZ2luX2VjEJT//////////wEaCXVzLXdlc3QtMiJHMEUCIQCiioeZ9DKhzg5akOK+fDy5DqU2uHS74lYXzjq9kMiFqwIgIFwmdhOSJPV0rrvwm+qxakQHozPdLBk6FmJtzzwPPtUq2gMILRAAGgw5NzU0MjYyNjIwMjkiDAIyOqnIjCNRnbvQdiq3A/c4qQrrv4J1PpfE9UJERaGJyMxQVVSNZG16s++EpZnhKxqDwPoPOitc7TMHLLM8yOFasFi2sT3R7ZpoXd4lbBb2efSCtQmPZC5US+FSJym9kUhVHBb1P96wY/7ETQBoLMpj+6boRf7FePlyGXYyCXedyehv3t8HtpMIe2QqovM75F88x0w2wEZOswJczqkClWx+ZTBc7QPKYswOTjP3h0D3/zCtMZfcSUMHhjR3eIheGiEpIc2/tZuQfiXb9TiJ7hR1+hwnHJhRShp8K0urZP5Sj/KwvyVLhq/Jlz7alAPjfSjTVzIG5iOBzOolhu2pG4kBb0wCfdRBpVwhnvBwGNMCqYZwAouFSwKWgYfvYJom2tMTbmuO6NbPKg9oLS24Zg0NcTuAyVUBVfwaK+VMDpdwwdHwxYDmOHQ/dU2VrTyd5/ef0mWJQeoD7V14DkeDO767fx0DBr13aNcRuTVrO9lvVekZvS98DM48qbJMjvMmzoXCUckzGj423OjHCl/DIaAi4rswH82xqxobP3KZ2FRzik5uY18hlTwu+oBRlgnM5NPHAPYdmDMzpSwvRur+4D2vIfEyaYswopHV6gU6tAHAbrYmG0E7JVzGODxRbe4BnCoDGoWWiTRqWsNTmZTN2VEcMtlvj9S3W+zsHMP/rNhWIa8LGSON0Bes+n92uedbcv8PQwAUZse0uvzId1vehatdbIRYHGABkwAqAy+3uW9d/YDGsxqkeWQGC/ubEFoxnTIrS3ZdS2q3K+YT/7S4HG/amtJfpk6S2Xj8nvcw0x1aDO7AoQoLqhMVDK2rYtWSRIpp2TF7qW1vqDXOyPFfy21ix7M="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a0d9ec90-d703-4c29-ad9d-9448df883db0", "record_id": "flaws_cloudtrail:0000167:a0d9ec90-d703-4c29-ad9d-9448df883db0", "row_index": 167, "timestamp": "2019-08-15T12:25:03Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "config.amazonaws.com", "user_agent": "config.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/service-role/config-role-us-west-2"], "raw_record_size_bytes": 1936, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a0d9ec90-d703-4c29-ad9d-9448df883db0", "eventTime": "2019-08-15T12:25:03Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "config.amazonaws.com", "userAgent": "config.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "config.amazonaws.com"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/service-role/config-role-us-west-2", "roleSessionName": "AWSConfig"}, "responseElements": {"credentials": {"accessKeyId": "ASIABJQEVIMX4NGMLKDX", "expiration": "Aug 15, 2019 1:25:03 PM", "sessionToken": "AgoJb3JpZ2luX2VjEJX//////////wEaCXVzLXdlc3QtMiJGMEQCIAdaQXhCxWIt9Rc3zGfKsR3sQhUuaQTzmSYAQhZAZ6pzAiAOSIlHbj+6gcitlNxPJW65E8GwIqO2LJjuyq70Z0Ng1iroAgguEAAaDDk3NTQyNjI2MjAyOSIMPszjZael/m5HDQlgKsUCPtNy2ZUMQUjb/LGJRNbdi6p+w6SnmUNGUPC/eYULXXGrPISwBVYGDEGgCS9XFnsj7tz3Nmpx1d0wSVnm5gpF0/DbOxyuL7qmUNo6louj3vGRQlWSEEKNj6ZUhuzHootb+vZKXZDGfwAj0izDWEBms8gkyylBlb46UTPaRyvmFLKGPPkcggB4nVILrMRBN12al6MUDLUZhAcfzL4Lih7pBQSJNiLvVSpOwjOcqWpEppPoNyTyk6LjQNiJP49OJ4mfc5NzDU4Ki7jkuvdjX2wut+ycnFW0yyFIjSXTA5H8cqvQdZ96IIXenm9M2BtTYtclZaMSxltDda2wVTLbpRLaFEqOLNiC062khRu+Ngi/4ejU5tQ/U156emXVAhQkk3ljZ+/M/GgBhMGIKajGL6NPtc4gtXHqKmT3LKa3wEMCgvcwgSNCNzCfntXqBTq1AeA11FucosTSu2SFCOYWc1YfSmbwnUzHhvkxiF6WNBt8Kogo0MhqeN6bxdTU58cLI6UbAi+pAqi0bIRCWyyV9bhv6ZMFkRPaFLVCyZhUy4SCya19u385gHitUtIUM3RwKtvy2eCpjTjfoh041WiTMCzcl9dKcuY4TxjnNmHLTPxBmnlkjapE3QYilfSTTR4ZQXDldGVacsnpWVBjxBWdExzcVq1QlK5ZI71Cjv+GJEQ90pN5g2M="}, "assumedRoleUser": {"assumedRoleId": "AROASM3HWKK95VDO4HH81:AWSConfig", "arn": "arn:aws:sts::811596193553:assumed-role/config-role-us-west-2/AWSConfig"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/service-role/config-role-us-west-2", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a0d9ec90-d703-4c29-ad9d-9448df883db0", "record_id": "flaws_cloudtrail:0000168:a0d9ec90-d703-4c29-ad9d-9448df883db0", "row_index": 168, "timestamp": "2019-08-15T12:25:03Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "config.amazonaws.com", "user_agent": "config.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/service-role/config-role-us-west-2"], "raw_record_size_bytes": 1936, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a0d9ec90-d703-4c29-ad9d-9448df883db0", "eventTime": "2019-08-15T12:25:03Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "config.amazonaws.com", "userAgent": "config.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "config.amazonaws.com"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/service-role/config-role-us-west-2", "roleSessionName": "AWSConfig"}, "responseElements": {"credentials": {"accessKeyId": "ASIABJQEVIMX4NGMLKDX", "expiration": "Aug 15, 2019 1:25:03 PM", "sessionToken": "AgoJb3JpZ2luX2VjEJX//////////wEaCXVzLXdlc3QtMiJGMEQCIAdaQXhCxWIt9Rc3zGfKsR3sQhUuaQTzmSYAQhZAZ6pzAiAOSIlHbj+6gcitlNxPJW65E8GwIqO2LJjuyq70Z0Ng1iroAgguEAAaDDk3NTQyNjI2MjAyOSIMPszjZael/m5HDQlgKsUCPtNy2ZUMQUjb/LGJRNbdi6p+w6SnmUNGUPC/eYULXXGrPISwBVYGDEGgCS9XFnsj7tz3Nmpx1d0wSVnm5gpF0/DbOxyuL7qmUNo6louj3vGRQlWSEEKNj6ZUhuzHootb+vZKXZDGfwAj0izDWEBms8gkyylBlb46UTPaRyvmFLKGPPkcggB4nVILrMRBN12al6MUDLUZhAcfzL4Lih7pBQSJNiLvVSpOwjOcqWpEppPoNyTyk6LjQNiJP49OJ4mfc5NzDU4Ki7jkuvdjX2wut+ycnFW0yyFIjSXTA5H8cqvQdZ96IIXenm9M2BtTYtclZaMSxltDda2wVTLbpRLaFEqOLNiC062khRu+Ngi/4ejU5tQ/U156emXVAhQkk3ljZ+/M/GgBhMGIKajGL6NPtc4gtXHqKmT3LKa3wEMCgvcwgSNCNzCfntXqBTq1AeA11FucosTSu2SFCOYWc1YfSmbwnUzHhvkxiF6WNBt8Kogo0MhqeN6bxdTU58cLI6UbAi+pAqi0bIRCWyyV9bhv6ZMFkRPaFLVCyZhUy4SCya19u385gHitUtIUM3RwKtvy2eCpjTjfoh041WiTMCzcl9dKcuY4TxjnNmHLTPxBmnlkjapE3QYilfSTTR4ZQXDldGVacsnpWVBjxBWdExzcVq1QlK5ZI71Cjv+GJEQ90pN5g2M="}, "assumedRoleUser": {"assumedRoleId": "AROASM3HWKK95VDO4HH81:AWSConfig", "arn": "arn:aws:sts::811596193553:assumed-role/config-role-us-west-2/AWSConfig"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/service-role/config-role-us-west-2", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b884e41f-498f-438d-889c-1823fcf8107b", "record_id": "flaws_cloudtrail:0000169:b884e41f-498f-438d-889c-1823fcf8107b", "row_index": 169, "timestamp": "2019-08-15T12:57:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1881, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b884e41f-498f-438d-889c-1823fcf8107b", "eventTime": "2019-08-15T12:57:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIALZAH8KDRAP6NEAFQ", "expiration": "Aug 15, 2019 7:11:52 PM", "sessionToken": "AgoJb3JpZ2luX2VjEJX//////////wEaCXVzLXdlc3QtMiJHMEUCICSLep4qKX0/lKwN5+1JasNOG55N5vKd5RWb8QXyDctUAiEA7Wa0aSUlcmvvfmoFbRvXA7XKTj0j2rLX5TSV1TmWUZsq2gMILhAAGgw5NzU0MjYyNjIwMjkiDKLJmqYCaficW5bBYCq3Aw0VnAuN+FBrH7NE24drg40pQPTmS+YNXEVNE6y7S8xrhTBDXY4Ya8VtkbSv3XEHmtYfIA2mIhi/fz0ayWKkGipf53JhGlyfXrwev6eOJdjjvyxC7rzTndFQrXu2mG15DVNCmYnNBsniTj6NSvZ5G8LuP8gKyoogzCyf2jY8cU3M+TT2wBHAPVAkoIztUaXvdndzPOYmC9KAFCEBl2ahFWlFRQJ+il+S2ym+u/qGw3T/dE0i3FVCmTjsOO0SSfgLks32REgk8vfCWBR92fl2NadmZAYkwjGV1oFxriCCe3yhCOK9dQZL+Q2ylpg2yW34KTqcdeo/nIUk/M+NDci15LCCNhGEoY/tsITp1dXUzFGvxD2uXNC+w/9jMSX7O+hnnPB9NDOzKcj3xDOXOjOu3bi3hXvfLDatQkd/pHhfkfYLztU4SMxZofh8sI/Jad2LHUsZqudSCKC5uRpznmuPk7x3hb5Zf1n68PNuXUtRHGxaD27KHOipflv8nG18Q2RBl9b7GJuTOX5fezNyTKW9Ht88ZO2uwEHrup5j7Nq0D1wr11hlMiuBRF7RWTpAHC1UVnefrLzgYjwwsq3V6gU6tAGKct+Z7wc5p7hvJuQAkVxRCYyySlL+Rl3En4FLxSJWGuTlbLE7UgzgFgsJ+oowjfImWKy+fjVdBJUcBrkIySkuP7EyYFBImvJiO6JtKovgB21vT19r88UONSxpi1ZQraa4UBjrIHFPW9FUQTFzK6LfRL2bCSxAeNjjnhKNFwakYIpadLsDgNVu9C4gKU4uAj7sX75nHkXezW1R5i8+Pv8feB64JTP/hH/22JqQdGnG63wlQ+4="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b884e41f-498f-438d-889c-1823fcf8107b", "record_id": "flaws_cloudtrail:0000170:b884e41f-498f-438d-889c-1823fcf8107b", "row_index": 170, "timestamp": "2019-08-15T12:57:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1881, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b884e41f-498f-438d-889c-1823fcf8107b", "eventTime": "2019-08-15T12:57:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIALZAH8KDRAP6NEAFQ", "expiration": "Aug 15, 2019 7:11:52 PM", "sessionToken": "AgoJb3JpZ2luX2VjEJX//////////wEaCXVzLXdlc3QtMiJHMEUCICSLep4qKX0/lKwN5+1JasNOG55N5vKd5RWb8QXyDctUAiEA7Wa0aSUlcmvvfmoFbRvXA7XKTj0j2rLX5TSV1TmWUZsq2gMILhAAGgw5NzU0MjYyNjIwMjkiDKLJmqYCaficW5bBYCq3Aw0VnAuN+FBrH7NE24drg40pQPTmS+YNXEVNE6y7S8xrhTBDXY4Ya8VtkbSv3XEHmtYfIA2mIhi/fz0ayWKkGipf53JhGlyfXrwev6eOJdjjvyxC7rzTndFQrXu2mG15DVNCmYnNBsniTj6NSvZ5G8LuP8gKyoogzCyf2jY8cU3M+TT2wBHAPVAkoIztUaXvdndzPOYmC9KAFCEBl2ahFWlFRQJ+il+S2ym+u/qGw3T/dE0i3FVCmTjsOO0SSfgLks32REgk8vfCWBR92fl2NadmZAYkwjGV1oFxriCCe3yhCOK9dQZL+Q2ylpg2yW34KTqcdeo/nIUk/M+NDci15LCCNhGEoY/tsITp1dXUzFGvxD2uXNC+w/9jMSX7O+hnnPB9NDOzKcj3xDOXOjOu3bi3hXvfLDatQkd/pHhfkfYLztU4SMxZofh8sI/Jad2LHUsZqudSCKC5uRpznmuPk7x3hb5Zf1n68PNuXUtRHGxaD27KHOipflv8nG18Q2RBl9b7GJuTOX5fezNyTKW9Ht88ZO2uwEHrup5j7Nq0D1wr11hlMiuBRF7RWTpAHC1UVnefrLzgYjwwsq3V6gU6tAGKct+Z7wc5p7hvJuQAkVxRCYyySlL+Rl3En4FLxSJWGuTlbLE7UgzgFgsJ+oowjfImWKy+fjVdBJUcBrkIySkuP7EyYFBImvJiO6JtKovgB21vT19r88UONSxpi1ZQraa4UBjrIHFPW9FUQTFzK6LfRL2bCSxAeNjjnhKNFwakYIpadLsDgNVu9C4gKU4uAj7sX75nHkXezW1R5i8+Pv8feB64JTP/hH/22JqQdGnG63wlQ+4="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "286e66f5-d6a3-4fb6-a42f-00269a7aa46e", "record_id": "flaws_cloudtrail:0000171:286e66f5-d6a3-4fb6-a42f-00269a7aa46e", "row_index": 171, "timestamp": "2019-08-15T13:29:29Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "231.7.126.253", "user_agent": "aws-cli/1.16.116 Python/2.7.15+ Linux/5.0.0-23-generic botocore/1.12.106", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 782, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "286e66f5-d6a3-4fb6-a42f-00269a7aa46e", "eventTime": "2019-08-15T13:29:29Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "231.7.126.253", "userAgent": "aws-cli/1.16.116 Python/2.7.15+ Linux/5.0.0-23-generic botocore/1.12.106", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "responseElements": {"userId": "AIDADO2GQD0K8TEF7KW1V", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "286e66f5-d6a3-4fb6-a42f-00269a7aa46e", "record_id": "flaws_cloudtrail:0000172:286e66f5-d6a3-4fb6-a42f-00269a7aa46e", "row_index": 172, "timestamp": "2019-08-15T13:29:29Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "231.7.126.253", "user_agent": "aws-cli/1.16.116 Python/2.7.15+ Linux/5.0.0-23-generic botocore/1.12.106", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 782, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "286e66f5-d6a3-4fb6-a42f-00269a7aa46e", "eventTime": "2019-08-15T13:29:29Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "231.7.126.253", "userAgent": "aws-cli/1.16.116 Python/2.7.15+ Linux/5.0.0-23-generic botocore/1.12.106", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "responseElements": {"userId": "AIDADO2GQD0K8TEF7KW1V", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4b0e11d3-f6a9-4cb7-8783-be523f945668", "record_id": "flaws_cloudtrail:0000173:4b0e11d3-f6a9-4cb7-8783-be523f945668", "row_index": 173, "timestamp": "2019-08-15T13:31:24Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "231.7.126.253", "user_agent": "aws-cli/1.16.116 Python/2.7.15+ Linux/5.0.0-23-generic botocore/1.12.106", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 671, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4b0e11d3-f6a9-4cb7-8783-be523f945668", "eventTime": "2019-08-15T13:31:24Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "231.7.126.253", "userAgent": "aws-cli/1.16.116 Python/2.7.15+ Linux/5.0.0-23-generic botocore/1.12.106", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4b0e11d3-f6a9-4cb7-8783-be523f945668", "record_id": "flaws_cloudtrail:0000174:4b0e11d3-f6a9-4cb7-8783-be523f945668", "row_index": 174, "timestamp": "2019-08-15T13:31:24Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "231.7.126.253", "user_agent": "aws-cli/1.16.116 Python/2.7.15+ Linux/5.0.0-23-generic botocore/1.12.106", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 671, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4b0e11d3-f6a9-4cb7-8783-be523f945668", "eventTime": "2019-08-15T13:31:24Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "231.7.126.253", "userAgent": "aws-cli/1.16.116 Python/2.7.15+ Linux/5.0.0-23-generic botocore/1.12.106", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c8fbedfa-d0d7-454d-9925-fdeadd30126f", "record_id": "flaws_cloudtrail:0000175:c8fbedfa-d0d7-454d-9925-fdeadd30126f", "row_index": 175, "timestamp": "2019-08-15T13:32:10Z", "event_type": "ListAttachedUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "231.7.126.253", "user_agent": "aws-cli/1.16.116 Python/2.7.15+ Linux/5.0.0-23-generic botocore/1.12.106", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 705, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c8fbedfa-d0d7-454d-9925-fdeadd30126f", "eventTime": "2019-08-15T13:32:10Z", "eventName": "ListAttachedUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "231.7.126.253", "userAgent": "aws-cli/1.16.116 Python/2.7.15+ Linux/5.0.0-23-generic botocore/1.12.106", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c8fbedfa-d0d7-454d-9925-fdeadd30126f", "record_id": "flaws_cloudtrail:0000176:c8fbedfa-d0d7-454d-9925-fdeadd30126f", "row_index": 176, "timestamp": "2019-08-15T13:32:10Z", "event_type": "ListAttachedUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "231.7.126.253", "user_agent": "aws-cli/1.16.116 Python/2.7.15+ Linux/5.0.0-23-generic botocore/1.12.106", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 705, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c8fbedfa-d0d7-454d-9925-fdeadd30126f", "eventTime": "2019-08-15T13:32:10Z", "eventName": "ListAttachedUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "231.7.126.253", "userAgent": "aws-cli/1.16.116 Python/2.7.15+ Linux/5.0.0-23-generic botocore/1.12.106", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6b253e25-56ca-4409-86ac-ad4611d07ac4", "record_id": "flaws_cloudtrail:0000177:6b253e25-56ca-4409-86ac-ad4611d07ac4", "row_index": 177, "timestamp": "2019-08-15T13:32:52Z", "event_type": "GetPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "231.7.126.253", "user_agent": "aws-cli/1.16.116 Python/2.7.15+ Linux/5.0.0-23-generic botocore/1.12.106", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 734, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6b253e25-56ca-4409-86ac-ad4611d07ac4", "eventTime": "2019-08-15T13:32:52Z", "eventName": "GetPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "231.7.126.253", "userAgent": "aws-cli/1.16.116 Python/2.7.15+ Linux/5.0.0-23-generic botocore/1.12.106", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6b253e25-56ca-4409-86ac-ad4611d07ac4", "record_id": "flaws_cloudtrail:0000178:6b253e25-56ca-4409-86ac-ad4611d07ac4", "row_index": 178, "timestamp": "2019-08-15T13:32:52Z", "event_type": "GetPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "231.7.126.253", "user_agent": "aws-cli/1.16.116 Python/2.7.15+ Linux/5.0.0-23-generic botocore/1.12.106", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 734, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6b253e25-56ca-4409-86ac-ad4611d07ac4", "eventTime": "2019-08-15T13:32:52Z", "eventName": "GetPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "231.7.126.253", "userAgent": "aws-cli/1.16.116 Python/2.7.15+ Linux/5.0.0-23-generic botocore/1.12.106", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "39c3d59d-a147-4d20-9e29-8bc0275f12a8", "record_id": "flaws_cloudtrail:0000179:39c3d59d-a147-4d20-9e29-8bc0275f12a8", "row_index": 179, "timestamp": "2019-08-15T13:33:32Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "231.7.126.253", "user_agent": "aws-cli/1.16.116 Python/2.7.15+ Linux/5.0.0-23-generic botocore/1.12.106", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 758, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "39c3d59d-a147-4d20-9e29-8bc0275f12a8", "eventTime": "2019-08-15T13:33:32Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "231.7.126.253", "userAgent": "aws-cli/1.16.116 Python/2.7.15+ Linux/5.0.0-23-generic botocore/1.12.106", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways", "versionId": "v4"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "39c3d59d-a147-4d20-9e29-8bc0275f12a8", "record_id": "flaws_cloudtrail:0000180:39c3d59d-a147-4d20-9e29-8bc0275f12a8", "row_index": 180, "timestamp": "2019-08-15T13:33:32Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "231.7.126.253", "user_agent": "aws-cli/1.16.116 Python/2.7.15+ Linux/5.0.0-23-generic botocore/1.12.106", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 758, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "39c3d59d-a147-4d20-9e29-8bc0275f12a8", "eventTime": "2019-08-15T13:33:32Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "231.7.126.253", "userAgent": "aws-cli/1.16.116 Python/2.7.15+ Linux/5.0.0-23-generic botocore/1.12.106", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways", "versionId": "v4"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "52521aa7-60f1-469f-baab-dc59a29245bc", "record_id": "flaws_cloudtrail:0000181:52521aa7-60f1-469f-baab-dc59a29245bc", "row_index": 181, "timestamp": "2019-08-15T13:34:04Z", "event_type": "CreateLogStream", "event_source": "logs.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "account_id": "811596193553", "principal_id": "AROAI4E1FBACLY3FPC6BB:Level6", "user_name": null, "access_key_id": "ASIAIVB2SPVC1NRZO4TP", "session_issuer_arn": "arn:aws:iam::811596193553:role/service-role/Level6", "session_issuer_user_name": "Level6"}, "network": {"source_ip": "30.193.3.8", "user_agent": "awslambda-worker", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1027, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "52521aa7-60f1-469f-baab-dc59a29245bc", "eventTime": "2019-08-15T13:34:04Z", "eventName": "CreateLogStream", "eventSource": "logs.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "30.193.3.8", "userAgent": "awslambda-worker", "awsRegion": "us-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAI4E1FBACLY3FPC6BB:Level6", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "accountId": "811596193553", "accessKeyId": "ASIAIVB2SPVC1NRZO4TP", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-08-15T13:34:04Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAI4E1FBACLY3FPC6BB", "arn": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "userName": "Level6"}}}, "requestParameters": {"logGroupName": "/aws/lambda/Level6", "logStreamName": "2019/08/15/[$LATEST]f6007cec125f5e0bd6783640add87e32"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0f2e10f4-5863-4840-83af-a565c6640e9f", "record_id": "flaws_cloudtrail:0000182:0f2e10f4-5863-4840-83af-a565c6640e9f", "row_index": 182, "timestamp": "2019-08-15T13:34:04Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "lambda.amazonaws.com", "user_agent": "lambda.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/service-role/Level6"], "raw_record_size_bytes": 1618, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0f2e10f4-5863-4840-83af-a565c6640e9f", "eventTime": "2019-08-15T13:34:04Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "lambda.amazonaws.com", "userAgent": "lambda.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "lambda.amazonaws.com"}, "requestParameters": {"roleSessionName": "Level6", "roleArn": "arn:aws:iam::811596193553:role/service-role/Level6"}, "responseElements": {"credentials": {"accessKeyId": "ASIA7RWW1NR51KGOXT01", "expiration": "Aug 16, 2019 1:34:04 AM", "sessionToken": "AgoJb3JpZ2luX2VjEJb//////////wEaCXVzLXdlc3QtMiJIMEYCIQC7BmeJa9z9aaSRx6BMbvmVYRrtqvl2OEi47FIcIRezvQIhAKMjLS1Fw8R9ztsAYed5VLKCdQwPJZzoC8nob/k7M/+qKoICCC8QABoMOTc1NDI2MjYyMDI5IgyXwoij1UMdDMQy54Uq3wGldtk+bPF5mnxz0WwdRQjtIQMTmb3lej8RFpxVWSOPDvRttEcQP1h06rq/EFVpL+s/Bo1ODqoYxxYaTNtzJP64RoOLbOv+WVefdewgBQ1qEsCBYF/dzl+tyuOaucdQ4WtodgK6nTiqE83eJfkFeZHqgOsj48QXjdyFEFseRZ86yW5XTbe2kzw6bfY+f7PITw1FVKP8GlxrjLILHJmT8+KW4NzV4IH7AAH13Qt87fbhK+6sKxwaPNBJlQSpdx6UQnAMEpGY+4lYYagvoWJbI8M8OCUCy5r/C2fvZbgpALfvMMy+1eoFOrMB6YiBo5w4VYWwMHNuCUGv1uFjMtr02/bwl0GOYCoNDJ/fv0L8rM7zRcqGYt3hQEFVT4DZJesKjDBIj77GampWozuhW2Y3+1uj7FYDL21hKCJ6v4rOOGqXZYojTSIu0jpPRbCWuLcuNcCW+AF+qKQKOeANl6CDuigqdjAQeZ/S0YUWM0r9Ebz3swGhwykcXpmKL3PaTuqVcxnbEx36pefcm+mMAN7dlNv8ga+NGhZVqaN6JnY="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dcd21147-cf3d-464d-b5e2-956a3d5f6e87", "record_id": "flaws_cloudtrail:0000183:dcd21147-cf3d-464d-b5e2-956a3d5f6e87", "row_index": 183, "timestamp": "2019-08-15T13:34:04Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "lambda.amazonaws.com", "user_agent": "lambda.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/service-role/Level6"], "raw_record_size_bytes": 1618, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dcd21147-cf3d-464d-b5e2-956a3d5f6e87", "eventTime": "2019-08-15T13:34:04Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "lambda.amazonaws.com", "userAgent": "lambda.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "lambda.amazonaws.com"}, "requestParameters": {"roleSessionName": "Level6", "roleArn": "arn:aws:iam::811596193553:role/service-role/Level6"}, "responseElements": {"credentials": {"accessKeyId": "ASIAIVB2SPVC1NRZO4TP", "expiration": "Aug 16, 2019 1:34:04 AM", "sessionToken": "AgoJb3JpZ2luX2VjEJb//////////wEaCXVzLXdlc3QtMiJGMEQCIA5Uya0/hnSuoEVzJdd9v/eVYmGTUOObyAnfyY2gsbCQAiBIfg0XUJA3RJ/mBWGy1Mv3EwUkN4TLcIBj+TAM79mSlyqCAggvEAAaDDk3NTQyNjI2MjAyOSIMjBl1jlgGo7FcA8gLKt8BeAkdNVq6DKNOtER3kXTeszZCGT128WtIF6XCwWN1YZDbPMuXBXBDtbgN24X+vpQycFnXjg/eoahnEf0bPgcXZfUV4CmrI8jFsjhJOmgHNkQk0FLFsrHmru5IsuoaOJ1b45mY4ep5Xn3BhU2kQfPhBvobBZX/1oG6ni2K3gJfSSRauBU4/+0KBFAac4zV3MFoDTDOogoGyDKKJC62gYirInHVjHSmz2nszEj/qzBr9Wqd+GwYsi196nQs8Kc/eS9l7JgT88ZNFbiOeY3ub7JORRNSMpMGvojrZE81CJyyjjDMvtXqBTq1AZtkff41h6auacFpPB0AphqWb6/P9eY5xhUBocc8zU7f63s0MMJFQX8JE4U8+na6cqPqrThWJap6FMHYTROcfmZa29SbNZ6C9HuJnox6Ijj0clfWxowO6/KWbQL0O3lFdTagJ0ULLtwb3diB9IsYwNerNUsI/H8hHZtuGXvjcibKfcOpLYrBC25pQb60OGGOWyDn9iPv6vZtTuMnniPz7ZPFfxvonj6CFo8lWZLsudbpwDipobE="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0f2e10f4-5863-4840-83af-a565c6640e9f", "record_id": "flaws_cloudtrail:0000184:0f2e10f4-5863-4840-83af-a565c6640e9f", "row_index": 184, "timestamp": "2019-08-15T13:34:04Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "lambda.amazonaws.com", "user_agent": "lambda.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/service-role/Level6"], "raw_record_size_bytes": 1618, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0f2e10f4-5863-4840-83af-a565c6640e9f", "eventTime": "2019-08-15T13:34:04Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "lambda.amazonaws.com", "userAgent": "lambda.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "lambda.amazonaws.com"}, "requestParameters": {"roleSessionName": "Level6", "roleArn": "arn:aws:iam::811596193553:role/service-role/Level6"}, "responseElements": {"credentials": {"accessKeyId": "ASIA7RWW1NR51KGOXT01", "expiration": "Aug 16, 2019 1:34:04 AM", "sessionToken": "AgoJb3JpZ2luX2VjEJb//////////wEaCXVzLXdlc3QtMiJIMEYCIQC7BmeJa9z9aaSRx6BMbvmVYRrtqvl2OEi47FIcIRezvQIhAKMjLS1Fw8R9ztsAYed5VLKCdQwPJZzoC8nob/k7M/+qKoICCC8QABoMOTc1NDI2MjYyMDI5IgyXwoij1UMdDMQy54Uq3wGldtk+bPF5mnxz0WwdRQjtIQMTmb3lej8RFpxVWSOPDvRttEcQP1h06rq/EFVpL+s/Bo1ODqoYxxYaTNtzJP64RoOLbOv+WVefdewgBQ1qEsCBYF/dzl+tyuOaucdQ4WtodgK6nTiqE83eJfkFeZHqgOsj48QXjdyFEFseRZ86yW5XTbe2kzw6bfY+f7PITw1FVKP8GlxrjLILHJmT8+KW4NzV4IH7AAH13Qt87fbhK+6sKxwaPNBJlQSpdx6UQnAMEpGY+4lYYagvoWJbI8M8OCUCy5r/C2fvZbgpALfvMMy+1eoFOrMB6YiBo5w4VYWwMHNuCUGv1uFjMtr02/bwl0GOYCoNDJ/fv0L8rM7zRcqGYt3hQEFVT4DZJesKjDBIj77GampWozuhW2Y3+1uj7FYDL21hKCJ6v4rOOGqXZYojTSIu0jpPRbCWuLcuNcCW+AF+qKQKOeANl6CDuigqdjAQeZ/S0YUWM0r9Ebz3swGhwykcXpmKL3PaTuqVcxnbEx36pefcm+mMAN7dlNv8ga+NGhZVqaN6JnY="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dcd21147-cf3d-464d-b5e2-956a3d5f6e87", "record_id": "flaws_cloudtrail:0000185:dcd21147-cf3d-464d-b5e2-956a3d5f6e87", "row_index": 185, "timestamp": "2019-08-15T13:34:04Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "lambda.amazonaws.com", "user_agent": "lambda.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/service-role/Level6"], "raw_record_size_bytes": 1618, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dcd21147-cf3d-464d-b5e2-956a3d5f6e87", "eventTime": "2019-08-15T13:34:04Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "lambda.amazonaws.com", "userAgent": "lambda.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "lambda.amazonaws.com"}, "requestParameters": {"roleSessionName": "Level6", "roleArn": "arn:aws:iam::811596193553:role/service-role/Level6"}, "responseElements": {"credentials": {"accessKeyId": "ASIAIVB2SPVC1NRZO4TP", "expiration": "Aug 16, 2019 1:34:04 AM", "sessionToken": "AgoJb3JpZ2luX2VjEJb//////////wEaCXVzLXdlc3QtMiJGMEQCIA5Uya0/hnSuoEVzJdd9v/eVYmGTUOObyAnfyY2gsbCQAiBIfg0XUJA3RJ/mBWGy1Mv3EwUkN4TLcIBj+TAM79mSlyqCAggvEAAaDDk3NTQyNjI2MjAyOSIMjBl1jlgGo7FcA8gLKt8BeAkdNVq6DKNOtER3kXTeszZCGT128WtIF6XCwWN1YZDbPMuXBXBDtbgN24X+vpQycFnXjg/eoahnEf0bPgcXZfUV4CmrI8jFsjhJOmgHNkQk0FLFsrHmru5IsuoaOJ1b45mY4ep5Xn3BhU2kQfPhBvobBZX/1oG6ni2K3gJfSSRauBU4/+0KBFAac4zV3MFoDTDOogoGyDKKJC62gYirInHVjHSmz2nszEj/qzBr9Wqd+GwYsi196nQs8Kc/eS9l7JgT88ZNFbiOeY3ub7JORRNSMpMGvojrZE81CJyyjjDMvtXqBTq1AZtkff41h6auacFpPB0AphqWb6/P9eY5xhUBocc8zU7f63s0MMJFQX8JE4U8+na6cqPqrThWJap6FMHYTROcfmZa29SbNZ6C9HuJnox6Ijj0clfWxowO6/KWbQL0O3lFdTagJ0ULLtwb3diB9IsYwNerNUsI/H8hHZtuGXvjcibKfcOpLYrBC25pQb60OGGOWyDn9iPv6vZtTuMnniPz7ZPFfxvonj6CFo8lWZLsudbpwDipobE="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "52521aa7-60f1-469f-baab-dc59a29245bc", "record_id": "flaws_cloudtrail:0000186:52521aa7-60f1-469f-baab-dc59a29245bc", "row_index": 186, "timestamp": "2019-08-15T13:34:04Z", "event_type": "CreateLogStream", "event_source": "logs.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "account_id": "811596193553", "principal_id": "AROAI4E1FBACLY3FPC6BB:Level6", "user_name": null, "access_key_id": "ASIAIVB2SPVC1NRZO4TP", "session_issuer_arn": "arn:aws:iam::811596193553:role/service-role/Level6", "session_issuer_user_name": "Level6"}, "network": {"source_ip": "30.193.3.8", "user_agent": "awslambda-worker", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1027, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "52521aa7-60f1-469f-baab-dc59a29245bc", "eventTime": "2019-08-15T13:34:04Z", "eventName": "CreateLogStream", "eventSource": "logs.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "30.193.3.8", "userAgent": "awslambda-worker", "awsRegion": "us-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAI4E1FBACLY3FPC6BB:Level6", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "accountId": "811596193553", "accessKeyId": "ASIAIVB2SPVC1NRZO4TP", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-08-15T13:34:04Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAI4E1FBACLY3FPC6BB", "arn": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "userName": "Level6"}}}, "requestParameters": {"logGroupName": "/aws/lambda/Level6", "logStreamName": "2019/08/15/[$LATEST]f6007cec125f5e0bd6783640add87e32"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8c324bce-9340-449d-98fe-a8cc627321ec", "record_id": "flaws_cloudtrail:0000187:8c324bce-9340-449d-98fe-a8cc627321ec", "row_index": 187, "timestamp": "2019-08-15T13:34:25Z", "event_type": "GetStages", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "231.7.126.253", "user_agent": "aws-cli/1.16.116 Python/2.7.15+ Linux/5.0.0-23-generic botocore/1.12.106", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 735, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8c324bce-9340-449d-98fe-a8cc627321ec", "eventTime": "2019-08-15T13:34:25Z", "eventName": "GetStages", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "231.7.126.253", "userAgent": "aws-cli/1.16.116 Python/2.7.15+ Linux/5.0.0-23-generic botocore/1.12.106", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "s33ppypa75", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8c324bce-9340-449d-98fe-a8cc627321ec", "record_id": "flaws_cloudtrail:0000188:8c324bce-9340-449d-98fe-a8cc627321ec", "row_index": 188, "timestamp": "2019-08-15T13:34:25Z", "event_type": "GetStages", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "231.7.126.253", "user_agent": "aws-cli/1.16.116 Python/2.7.15+ Linux/5.0.0-23-generic botocore/1.12.106", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 735, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8c324bce-9340-449d-98fe-a8cc627321ec", "eventTime": "2019-08-15T13:34:25Z", "eventName": "GetStages", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "231.7.126.253", "userAgent": "aws-cli/1.16.116 Python/2.7.15+ Linux/5.0.0-23-generic botocore/1.12.106", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "s33ppypa75", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2c499999-c5d4-4c41-ac77-68565c583d", "record_id": "flaws_cloudtrail:0000189:2c499999-c5d4-4c41-ac77-68565c583d", "row_index": 189, "timestamp": "2019-08-15T13:57:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1880, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2c499999-c5d4-4c41-ac77-68565c583d", "eventTime": "2019-08-15T13:57:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIAU7SC09Y99AQP8H5N", "expiration": "Aug 15, 2019 8:13:48 PM", "sessionToken": "AgoJb3JpZ2luX2VjEJb//////////wEaCXVzLXdlc3QtMiJIMEYCIQC3HnX3tvIFNZE3eQ9Hq/WfXm/QnzMYihJ53vomHRj9AwIhAO+B6l3I7Bxqsb8cvWNXWriOv0vECyXnL41pbVOaWBFpKtoDCC8QABoMOTc1NDI2MjYyMDI5IgxOLUEOY/tnZBg2At4qtwM5glPcCFbN6MhdeCt1fU/CiIkZXEWAu+BOM/0brnQxgmS+7elHjM6HQ/CI1aQMbHmkC633aDz6vD5WqLSIttm9fqV+OLS7+UuNy3a9GfM/V65Q/oIJCvbMdbpVuSzY8LVPfu/LLrXv8h7bq8CBNDnYFZjzVloCPAPPLGpnAxXAbT/cVvEwqqCJ1Kf6VuLmLostlko9tBcbxheaFEEUll3YxurffL4DYVZwpcRfDL5TMINXZr/SKXBj7xorFlvZ4p76FbfnI7LsREDNRkD13jFkA6F6UUvTdcG83PmOr+7c+25q44GqauXpBrE4TpAm3hcGc57BVpvTrlVWRC3Aiy8VsD+lVXbIH1I6nRmIg0Zqg9WJ8QMF4l+VUmTxMJg6wk4wibLAMYh57KS3zhs3dNYQozQoNgEfKmzL7kd+jw3r7OWQo2EbBQUVL5O9cSzz65MvmRGQVLpbaVNWeV5LV4ieYsazdZfSnq4CRDFcoEH+HSPSblIaznES5va11Ix3Pg5fJ9RKuMnZub6ydoGe8/EjgV6e7mURJNwcSNzNp+0nwgJrs1UfvPaxeK5GP583L90A5h05hSBCMMLJ1eoFOrMBhT63tZfswDu8YVGj5mrUzkEHHytlzasz1ymHSjnbsO4Rwcwq2r/NWcpfDFt4GbB6A4AYqphPgszSXc7W/9sVgmpkMdt6s1NscJCOn057w5/KTNNk5UuHbLlkMpUCd31Q5MqcNMsZ4sVkCKsvS5jFnsMNzUIf1HhwQYyzABJO6xAzfyiZYgv1ZJ/XuSMMy7jqGsQVRrdp2Glcp2oWPpQ+vMyAtihzvZqQBmasQtN6T65luS0="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2c499999-c5d4-4c41-ac77-68565c583d", "record_id": "flaws_cloudtrail:0000190:2c499999-c5d4-4c41-ac77-68565c583d", "row_index": 190, "timestamp": "2019-08-15T13:57:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1880, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2c499999-c5d4-4c41-ac77-68565c583d", "eventTime": "2019-08-15T13:57:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIAU7SC09Y99AQP8H5N", "expiration": "Aug 15, 2019 8:13:48 PM", "sessionToken": "AgoJb3JpZ2luX2VjEJb//////////wEaCXVzLXdlc3QtMiJIMEYCIQC3HnX3tvIFNZE3eQ9Hq/WfXm/QnzMYihJ53vomHRj9AwIhAO+B6l3I7Bxqsb8cvWNXWriOv0vECyXnL41pbVOaWBFpKtoDCC8QABoMOTc1NDI2MjYyMDI5IgxOLUEOY/tnZBg2At4qtwM5glPcCFbN6MhdeCt1fU/CiIkZXEWAu+BOM/0brnQxgmS+7elHjM6HQ/CI1aQMbHmkC633aDz6vD5WqLSIttm9fqV+OLS7+UuNy3a9GfM/V65Q/oIJCvbMdbpVuSzY8LVPfu/LLrXv8h7bq8CBNDnYFZjzVloCPAPPLGpnAxXAbT/cVvEwqqCJ1Kf6VuLmLostlko9tBcbxheaFEEUll3YxurffL4DYVZwpcRfDL5TMINXZr/SKXBj7xorFlvZ4p76FbfnI7LsREDNRkD13jFkA6F6UUvTdcG83PmOr+7c+25q44GqauXpBrE4TpAm3hcGc57BVpvTrlVWRC3Aiy8VsD+lVXbIH1I6nRmIg0Zqg9WJ8QMF4l+VUmTxMJg6wk4wibLAMYh57KS3zhs3dNYQozQoNgEfKmzL7kd+jw3r7OWQo2EbBQUVL5O9cSzz65MvmRGQVLpbaVNWeV5LV4ieYsazdZfSnq4CRDFcoEH+HSPSblIaznES5va11Ix3Pg5fJ9RKuMnZub6ydoGe8/EjgV6e7mURJNwcSNzNp+0nwgJrs1UfvPaxeK5GP583L90A5h05hSBCMMLJ1eoFOrMBhT63tZfswDu8YVGj5mrUzkEHHytlzasz1ymHSjnbsO4Rwcwq2r/NWcpfDFt4GbB6A4AYqphPgszSXc7W/9sVgmpkMdt6s1NscJCOn057w5/KTNNk5UuHbLlkMpUCd31Q5MqcNMsZ4sVkCKsvS5jFnsMNzUIf1HhwQYyzABJO6xAzfyiZYgv1ZJ/XuSMMy7jqGsQVRrdp2Glcp2oWPpQ+vMyAtihzvZqQBmasQtN6T65luS0="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "44988de-e943-4b89-90e5-5b5edf8c0263", "record_id": "flaws_cloudtrail:0000191:44988de-e943-4b89-90e5-5b5edf8c0263", "row_index": 191, "timestamp": "2019-08-15T14:57:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1881, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "44988de-e943-4b89-90e5-5b5edf8c0263", "eventTime": "2019-08-15T14:57:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIAFLY9IE1U8FQ04B0K", "expiration": "Aug 15, 2019 9:09:41 PM", "sessionToken": "AgoJb3JpZ2luX2VjEJf//////////wEaCXVzLXdlc3QtMiJIMEYCIQCtRqPuqag9Poy+/LdG6919UTBD5Oo6qdEGAF+BmUKmSgIhAIIxZP9f7LDvuXZ+2LM7z8Lmw4Vi1c2Y4FuohdPbO7P1KtoDCDAQABoMOTc1NDI2MjYyMDI5Igw034UIxBkfwbWFrtIqtwNGJzsiijPb9rBbVxvTGgrPBSy3aNzjQi1cYz0HHWrI6X4lIcxxudFVphBLPIos3s69Ms9+7cyssNbl7yvPdBvcQyx0aOp8Uot5s3scnltxi3eQXLGhWU4RpkczpuNo/Z/ICymef7M06RjEBGr0ZwmVNfW9EHx7Jizx+VFJMX7FjwdGAqS2hLbBMenFgeeTLs2Jkg5LQBcwO721rfBDmnBOX2ChSBRa3dIc/Yjtkov6LL9drtWBjOyAmGN7+/OYZngJn8yXe5THn8yPLcsio3gltUoF+0Jjgejl3Hwa1z+hochq12KKiFOiNjjBT4x7dF/E6FK61WoaFbWvas1qvjiwhNTRB4bOSkvfl0DC2SzyCmBNv4ZSko5WY8t7Ux+zscW7iO26SSA+SiDZbsYno9ZSYovAvvGVmOhHMYC946xyKH4xiEA9mIMssxM1TFSSsDIZeBX0EW1giXWkTnefFivSzsy6TtT/ooR6Yy457LFpAsFdyj1WImP/lUNsKLIQibuP0EfaoDmDJdKKkNhnew3plbQLkFETIS52OOSVvA+lQnME6Y0HgRXRlcLhdIIriu0NjfMrn/upMNLl1eoFOrMBTd7+C4vorl1ZdafYg0n3EZvZwG3bZq9tNfdl/heK8HERUCjYJFNIF72POrENDSo4230jZtz/OedrcsLTgmftwqoINn9wC/8H2jW4QJ9MkfmylokT+iiktKM/TY1afQVKhE4jhHaEtSoqejlHBteXfGpNoJnjHQSDvj2C2NcDJVrFH1Zft8M/YTjXjLl0e7A+fxwOlTJU4X7J3pw8DEcNCXHdB2a98HvrwI4mZEa8MiVVWpw="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "44988de-e943-4b89-90e5-5b5edf8c0263", "record_id": "flaws_cloudtrail:0000192:44988de-e943-4b89-90e5-5b5edf8c0263", "row_index": 192, "timestamp": "2019-08-15T14:57:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1881, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "44988de-e943-4b89-90e5-5b5edf8c0263", "eventTime": "2019-08-15T14:57:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIAFLY9IE1U8FQ04B0K", "expiration": "Aug 15, 2019 9:09:41 PM", "sessionToken": "AgoJb3JpZ2luX2VjEJf//////////wEaCXVzLXdlc3QtMiJIMEYCIQCtRqPuqag9Poy+/LdG6919UTBD5Oo6qdEGAF+BmUKmSgIhAIIxZP9f7LDvuXZ+2LM7z8Lmw4Vi1c2Y4FuohdPbO7P1KtoDCDAQABoMOTc1NDI2MjYyMDI5Igw034UIxBkfwbWFrtIqtwNGJzsiijPb9rBbVxvTGgrPBSy3aNzjQi1cYz0HHWrI6X4lIcxxudFVphBLPIos3s69Ms9+7cyssNbl7yvPdBvcQyx0aOp8Uot5s3scnltxi3eQXLGhWU4RpkczpuNo/Z/ICymef7M06RjEBGr0ZwmVNfW9EHx7Jizx+VFJMX7FjwdGAqS2hLbBMenFgeeTLs2Jkg5LQBcwO721rfBDmnBOX2ChSBRa3dIc/Yjtkov6LL9drtWBjOyAmGN7+/OYZngJn8yXe5THn8yPLcsio3gltUoF+0Jjgejl3Hwa1z+hochq12KKiFOiNjjBT4x7dF/E6FK61WoaFbWvas1qvjiwhNTRB4bOSkvfl0DC2SzyCmBNv4ZSko5WY8t7Ux+zscW7iO26SSA+SiDZbsYno9ZSYovAvvGVmOhHMYC946xyKH4xiEA9mIMssxM1TFSSsDIZeBX0EW1giXWkTnefFivSzsy6TtT/ooR6Yy457LFpAsFdyj1WImP/lUNsKLIQibuP0EfaoDmDJdKKkNhnew3plbQLkFETIS52OOSVvA+lQnME6Y0HgRXRlcLhdIIriu0NjfMrn/upMNLl1eoFOrMBTd7+C4vorl1ZdafYg0n3EZvZwG3bZq9tNfdl/heK8HERUCjYJFNIF72POrENDSo4230jZtz/OedrcsLTgmftwqoINn9wC/8H2jW4QJ9MkfmylokT+iiktKM/TY1afQVKhE4jhHaEtSoqejlHBteXfGpNoJnjHQSDvj2C2NcDJVrFH1Zft8M/YTjXjLl0e7A+fxwOlTJU4X7J3pw8DEcNCXHdB2a98HvrwI4mZEa8MiVVWpw="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e315857-7f58-4f47-86aa-6fe6ba94b1ef", "record_id": "flaws_cloudtrail:0000193:e315857-7f58-4f47-86aa-6fe6ba94b1ef", "row_index": 193, "timestamp": "2019-08-15T15:57:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1882, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e315857-7f58-4f47-86aa-6fe6ba94b1ef", "eventTime": "2019-08-15T15:57:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIAF1C9G5NNV4263ZMP", "expiration": "Aug 15, 2019 10:04:04 PM", "sessionToken": "AgoJb3JpZ2luX2VjEJj//////////wEaCXVzLXdlc3QtMiJIMEYCIQDzmrA7OYNTdGhye2rx6PxWKizscBmzFlmdUe963DXHCAIhALaU9sQzla+XV3mX9NZ+Jjt+EEJI6uavHE2gMhkcECabKtoDCDEQABoMOTc1NDI2MjYyMDI5Igxg32jC6C/IGpxiTpAqtwOldHF/7Snb+x2g4EDVQCYGCCHLnm/ohcKtoIr9GbeefE8W7ZFVV3pOHrsy76a+U3oRy87ujg/ZThjL6y74r7HXcAKOwOcmv/mtPrB1yTGgzleXa9peR37V3WsAt7JD1QHY8aCh9oDNRxvFPL8zMCIoZezacv7iSXZw71skMx7yfAUYM0m/l4srHfcI5p2HjdvctgV3XUBwAxCvN1MYpIAjzM3slt3+g6DC8XvasB24K40g6EE1CzH4VWsuU6uKEcWIbZ1pipztKVUNVnbctVvp9omgcHrLoO36NiFTKHaHcBhYhmmMyACOp4YuTNqJnR9PuYOuXsomWU4SaygIWgY2VIy31hsmFScQfaOftF1525CJFP0TPEqFk2tGCdNnTkzO31pV/Ms5bi0Pmhb3SHz6ec7GBTegX/Ov8GfbL2dhJzY0JAcVYhhTA4ypm1+3AeLxUNWklWWAKTUFpN4MoIrz/kipaK9k50KctgGydDZ8jixYtDPVHm4g1WISSXkuVWGOms9XuTQOL99c5LZK4Eb0r5RroobYuaNkcNlF/xEmGTKtU918K9V7vljKm4WT/ci+XyQ8hXaiMOKB1uoFOrMB5Cc5W/e2kjHBF0cpsw0GkiprPBv017Fu14anbcoJ5lfZimH4/Iq9x2ni81XwI6OFunXOk68TKhq5j7xlsPFF89qmLdBrlVUxAMEx9jpohy2zkqUop99wm2w0F5aIQnrJKrmyxlJ2DRSXyNKtFaOgwueOSxtTA5rs/KNUkjSEQ4vkmp4JOjC6iAyKhWvVxUCBsSiM9AXvVCk/uqkk0rNEI9BZu03uUWVoDXg2fsLRMRKp8bo="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e315857-7f58-4f47-86aa-6fe6ba94b1ef", "record_id": "flaws_cloudtrail:0000194:e315857-7f58-4f47-86aa-6fe6ba94b1ef", "row_index": 194, "timestamp": "2019-08-15T15:57:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1882, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e315857-7f58-4f47-86aa-6fe6ba94b1ef", "eventTime": "2019-08-15T15:57:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIAF1C9G5NNV4263ZMP", "expiration": "Aug 15, 2019 10:04:04 PM", "sessionToken": "AgoJb3JpZ2luX2VjEJj//////////wEaCXVzLXdlc3QtMiJIMEYCIQDzmrA7OYNTdGhye2rx6PxWKizscBmzFlmdUe963DXHCAIhALaU9sQzla+XV3mX9NZ+Jjt+EEJI6uavHE2gMhkcECabKtoDCDEQABoMOTc1NDI2MjYyMDI5Igxg32jC6C/IGpxiTpAqtwOldHF/7Snb+x2g4EDVQCYGCCHLnm/ohcKtoIr9GbeefE8W7ZFVV3pOHrsy76a+U3oRy87ujg/ZThjL6y74r7HXcAKOwOcmv/mtPrB1yTGgzleXa9peR37V3WsAt7JD1QHY8aCh9oDNRxvFPL8zMCIoZezacv7iSXZw71skMx7yfAUYM0m/l4srHfcI5p2HjdvctgV3XUBwAxCvN1MYpIAjzM3slt3+g6DC8XvasB24K40g6EE1CzH4VWsuU6uKEcWIbZ1pipztKVUNVnbctVvp9omgcHrLoO36NiFTKHaHcBhYhmmMyACOp4YuTNqJnR9PuYOuXsomWU4SaygIWgY2VIy31hsmFScQfaOftF1525CJFP0TPEqFk2tGCdNnTkzO31pV/Ms5bi0Pmhb3SHz6ec7GBTegX/Ov8GfbL2dhJzY0JAcVYhhTA4ypm1+3AeLxUNWklWWAKTUFpN4MoIrz/kipaK9k50KctgGydDZ8jixYtDPVHm4g1WISSXkuVWGOms9XuTQOL99c5LZK4Eb0r5RroobYuaNkcNlF/xEmGTKtU918K9V7vljKm4WT/ci+XyQ8hXaiMOKB1uoFOrMB5Cc5W/e2kjHBF0cpsw0GkiprPBv017Fu14anbcoJ5lfZimH4/Iq9x2ni81XwI6OFunXOk68TKhq5j7xlsPFF89qmLdBrlVUxAMEx9jpohy2zkqUop99wm2w0F5aIQnrJKrmyxlJ2DRSXyNKtFaOgwueOSxtTA5rs/KNUkjSEQ4vkmp4JOjC6iAyKhWvVxUCBsSiM9AXvVCk/uqkk0rNEI9BZu03uUWVoDXg2fsLRMRKp8bo="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "182f0a8d-6fe7-4a70-a664-42a93b521b5f", "record_id": "flaws_cloudtrail:0000195:182f0a8d-6fe7-4a70-a664-42a93b521b5f", "row_index": 195, "timestamp": "2019-08-15T16:57:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1882, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "182f0a8d-6fe7-4a70-a664-42a93b521b5f", "eventTime": "2019-08-15T16:57:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIA7WKD01EH6BTOJCZR", "expiration": "Aug 15, 2019 11:16:55 PM", "sessionToken": "AgoJb3JpZ2luX2VjEJn//////////wEaCXVzLXdlc3QtMiJIMEYCIQC2boedVWR4Ywdyy3AxVSPhRh7A9TNF/JEmwz8ntjj0/gIhAMPBAEwHh/befDAfU76LSK0Nvqk0U05xAXRou8d4JPwWKtoDCDIQABoMOTc1NDI2MjYyMDI5IgyzrbcA6P3X2EO721MqtwNPSFeMlKsRHcTSrY4wDRc7nYSvq91lrfycAf2lIYn6KDqraR5b+tVNw3n58UU5zXXPL2Uc6vTqHrKKUzcN1imFAwJM8yI7g3BaFNS1EO0Uou6mg9I4eqiENH3lVGob51dVqA9mYIUaPpgdJvY3Q/sHoDaNBqwHMFLjPz8PeFVoN4/I3sjK/C9XlXmqlkNTSSrGgJEeNke6Qf1u1GZ5PA/f1Aa77iCWoudTz3cXZUach19cjiXUCkj4ehkC/JUxWVq9xtIAPPZEKFSSyBhdqRChOoBs7zwlnIZLz2JXRhT3Umyu61mau5yX6W1XzxxX0FZv+9Kfo+sEF1WkdsFQsY0mKMSq6oyAlZZw/NGkemFl28emET9d/RoSzTEV1vQT4VFHOCO1iFFbFaC87qQ7ZX1AipLPpcHoKXU0KC8HlPELPCJvjUrcZlJiKtxWuybJ0h4DmpVaBmF2YUq2FR2YmpeykbRLsqPDpcumlASj9FdmzZC+JZNlM3FHBvJO0Ow6pbqfYatuOw/OVxDmtW2yUdJJs0NEHKBV+7pMUozni0m9riDxUI3WnOgtiZNf7g7Otaq6U0yX9AXEMPKd1uoFOrMBHqu9e72AhBYLMs54ywIz7DXeLVOQr4ckxF9p+m75pi8lL184b0nLJORJzjbp1iHwrFPjInv7AHd9oXoG1HgDDs0OzOXdnAT+70k5j8IX/UJofDSSLzc6OY1JPvhKrBnwkvlUkRQIuK5nRxXJHlxKo7ILiTz48brzda9qhna0O3kQDc5IS6WcwSrxtKCJLUFMhIW+biEuMv1bwjWrjeL6tQhpPD+xginXmveKQG6P8wYGJ1s="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "182f0a8d-6fe7-4a70-a664-42a93b521b5f", "record_id": "flaws_cloudtrail:0000196:182f0a8d-6fe7-4a70-a664-42a93b521b5f", "row_index": 196, "timestamp": "2019-08-15T16:57:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1882, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "182f0a8d-6fe7-4a70-a664-42a93b521b5f", "eventTime": "2019-08-15T16:57:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIA7WKD01EH6BTOJCZR", "expiration": "Aug 15, 2019 11:16:55 PM", "sessionToken": "AgoJb3JpZ2luX2VjEJn//////////wEaCXVzLXdlc3QtMiJIMEYCIQC2boedVWR4Ywdyy3AxVSPhRh7A9TNF/JEmwz8ntjj0/gIhAMPBAEwHh/befDAfU76LSK0Nvqk0U05xAXRou8d4JPwWKtoDCDIQABoMOTc1NDI2MjYyMDI5IgyzrbcA6P3X2EO721MqtwNPSFeMlKsRHcTSrY4wDRc7nYSvq91lrfycAf2lIYn6KDqraR5b+tVNw3n58UU5zXXPL2Uc6vTqHrKKUzcN1imFAwJM8yI7g3BaFNS1EO0Uou6mg9I4eqiENH3lVGob51dVqA9mYIUaPpgdJvY3Q/sHoDaNBqwHMFLjPz8PeFVoN4/I3sjK/C9XlXmqlkNTSSrGgJEeNke6Qf1u1GZ5PA/f1Aa77iCWoudTz3cXZUach19cjiXUCkj4ehkC/JUxWVq9xtIAPPZEKFSSyBhdqRChOoBs7zwlnIZLz2JXRhT3Umyu61mau5yX6W1XzxxX0FZv+9Kfo+sEF1WkdsFQsY0mKMSq6oyAlZZw/NGkemFl28emET9d/RoSzTEV1vQT4VFHOCO1iFFbFaC87qQ7ZX1AipLPpcHoKXU0KC8HlPELPCJvjUrcZlJiKtxWuybJ0h4DmpVaBmF2YUq2FR2YmpeykbRLsqPDpcumlASj9FdmzZC+JZNlM3FHBvJO0Ow6pbqfYatuOw/OVxDmtW2yUdJJs0NEHKBV+7pMUozni0m9riDxUI3WnOgtiZNf7g7Otaq6U0yX9AXEMPKd1uoFOrMBHqu9e72AhBYLMs54ywIz7DXeLVOQr4ckxF9p+m75pi8lL184b0nLJORJzjbp1iHwrFPjInv7AHd9oXoG1HgDDs0OzOXdnAT+70k5j8IX/UJofDSSLzc6OY1JPvhKrBnwkvlUkRQIuK5nRxXJHlxKo7ILiTz48brzda9qhna0O3kQDc5IS6WcwSrxtKCJLUFMhIW+biEuMv1bwjWrjeL6tQhpPD+xginXmveKQG6P8wYGJ1s="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "87699c5-fc56-414b-bb6a-f4ca18479cc7", "record_id": "flaws_cloudtrail:0000197:87699c5-fc56-414b-bb6a-f4ca18479cc7", "row_index": 197, "timestamp": "2019-08-15T17:57:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1882, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "87699c5-fc56-414b-bb6a-f4ca18479cc7", "eventTime": "2019-08-15T17:57:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIAJEXS268KBZXL18KM", "expiration": "Aug 16, 2019 12:25:57 AM", "sessionToken": "AgoJb3JpZ2luX2VjEJr//////////wEaCXVzLXdlc3QtMiJGMEQCIC9yOsJZkFjTKAPQBNFJI01cLkqJVHS5NVhc4G2u4wXPAiBfpnf3/rWP0muiI8nuO0QayFk4siUu1KEVzYrG0vk66CraAwgzEAAaDDk3NTQyNjI2MjAyOSIMIt0suvoQl0qiXw6LKrcDqR/6/H6Y1gZPCjlgDDWGegIUupLSBWYFvG+p9AVw0OExLMNhAsR9tLBrXKr0xTOA9VMAuPaOS5KAe2gClHYLUYIXqTsa4sj0ne+C5F2gK9awzHBLYKj6ImUuFkMZk8DsTCFPdyW4FYRELeX0DkYyxedr4ETbsl0juTs/YTXjaFbvtKpUaTvZt7vpk4/c1TTWGJCvmr+C/ANJSxvyg2upyAPTZIF82nAyH7Pa0TZ6x5yg4hYLmIuZuC/xrf0T8RigbLHeU1Va6Y4DYRuQqme6V1UVJwwMHDj4QL6F3KfHxXUEbjjRMm6P68GSkKVikWym/zpJSSkzIn1PSiiDcX3NQN6nyj2ZDFUANEsYD3qEq5ijW4eA/RBaWZjP0LB1HlHmhY0Q6yKdSzZRucq2wWYTl5ENuRgkoGjYhA0ldTESBY3SvYUEHWbdKvuhQUzJL4WPRshl7sPKvisBKZ7CmeR8LJbsY3uTXI1TnuMb4aM+bsHz5AEbua0dH2r8WpJkT2K8A4RUq+Pr+gVF2h+L3Wyeyl7HpPHOtcuQbgcXpJMobc+Cd8iQS2GplvR3NeN3ZUG47Foicj5FyzCCutbqBTq1AfCrpu+E37fm1QLa6j+pLQ9OiOrMz+eX95Zksz+Px++cTTn4nhvfgu9lra8bPq1cuy01RQDH7Yweh5P5n7QzNRinIiT+tNSKbYMTbxdSdSJsC4RZMw8wUguDi+34CLHbyZw5DtkUr+44RwVCdBrmutMEHXtIe1JhF3I46SIBLFtlmD1Y5xXH1QowMXRw8h7N9aGYQ2qAfoMmSCs6efdfdooIE2mzsAV/0B/y24718PrDqEz/QRs="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "87699c5-fc56-414b-bb6a-f4ca18479cc7", "record_id": "flaws_cloudtrail:0000198:87699c5-fc56-414b-bb6a-f4ca18479cc7", "row_index": 198, "timestamp": "2019-08-15T17:57:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1882, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "87699c5-fc56-414b-bb6a-f4ca18479cc7", "eventTime": "2019-08-15T17:57:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIAJEXS268KBZXL18KM", "expiration": "Aug 16, 2019 12:25:57 AM", "sessionToken": "AgoJb3JpZ2luX2VjEJr//////////wEaCXVzLXdlc3QtMiJGMEQCIC9yOsJZkFjTKAPQBNFJI01cLkqJVHS5NVhc4G2u4wXPAiBfpnf3/rWP0muiI8nuO0QayFk4siUu1KEVzYrG0vk66CraAwgzEAAaDDk3NTQyNjI2MjAyOSIMIt0suvoQl0qiXw6LKrcDqR/6/H6Y1gZPCjlgDDWGegIUupLSBWYFvG+p9AVw0OExLMNhAsR9tLBrXKr0xTOA9VMAuPaOS5KAe2gClHYLUYIXqTsa4sj0ne+C5F2gK9awzHBLYKj6ImUuFkMZk8DsTCFPdyW4FYRELeX0DkYyxedr4ETbsl0juTs/YTXjaFbvtKpUaTvZt7vpk4/c1TTWGJCvmr+C/ANJSxvyg2upyAPTZIF82nAyH7Pa0TZ6x5yg4hYLmIuZuC/xrf0T8RigbLHeU1Va6Y4DYRuQqme6V1UVJwwMHDj4QL6F3KfHxXUEbjjRMm6P68GSkKVikWym/zpJSSkzIn1PSiiDcX3NQN6nyj2ZDFUANEsYD3qEq5ijW4eA/RBaWZjP0LB1HlHmhY0Q6yKdSzZRucq2wWYTl5ENuRgkoGjYhA0ldTESBY3SvYUEHWbdKvuhQUzJL4WPRshl7sPKvisBKZ7CmeR8LJbsY3uTXI1TnuMb4aM+bsHz5AEbua0dH2r8WpJkT2K8A4RUq+Pr+gVF2h+L3Wyeyl7HpPHOtcuQbgcXpJMobc+Cd8iQS2GplvR3NeN3ZUG47Foicj5FyzCCutbqBTq1AfCrpu+E37fm1QLa6j+pLQ9OiOrMz+eX95Zksz+Px++cTTn4nhvfgu9lra8bPq1cuy01RQDH7Yweh5P5n7QzNRinIiT+tNSKbYMTbxdSdSJsC4RZMw8wUguDi+34CLHbyZw5DtkUr+44RwVCdBrmutMEHXtIe1JhF3I46SIBLFtlmD1Y5xXH1QowMXRw8h7N9aGYQ2qAfoMmSCs6efdfdooIE2mzsAV/0B/y24718PrDqEz/QRs="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e5fbfda1-a8be-454c-825d-ea28a910ce25", "record_id": "flaws_cloudtrail:0000199:e5fbfda1-a8be-454c-825d-ea28a910ce25", "row_index": 199, "timestamp": "2019-08-15T18:27:16Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "config.amazonaws.com", "user_agent": "config.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/service-role/config-role-us-west-2"], "raw_record_size_bytes": 1936, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e5fbfda1-a8be-454c-825d-ea28a910ce25", "eventTime": "2019-08-15T18:27:16Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "config.amazonaws.com", "userAgent": "config.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "config.amazonaws.com"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/service-role/config-role-us-west-2", "roleSessionName": "AWSConfig"}, "responseElements": {"credentials": {"accessKeyId": "ASIAUE4GSRPK0AJAU5JD", "expiration": "Aug 15, 2019 7:27:16 PM", "sessionToken": "AgoJb3JpZ2luX2VjEJv//////////wEaCXVzLXdlc3QtMiJIMEYCIQDUGJBPAdelhB8+/RrKoyAJ8l1HtE3Dj30zgnF17UDmUwIhAJrpGTvC+3OqHan3CMvyDxha2dVVwwjz85XTelEXuV7lKugCCDQQABoMOTc1NDI2MjYyMDI5Igw0NKenW8WWQlOOQpkqxQLcEvQwIRrNJcswVRAIKt0AYbjpR/R4zLM1MO9nSLFtw1vfQoAb2fsu3i2/48HSnyrGDVVk9mwOpogvwULgVYXBwEgiSAp/+hKAVncpnXngUn9HDXPnFP2tx/bJpg9fgh3fLXxBgmmprRlohfRhmEN3B6RcbQCiQaa5uEWpXjEg/Ox5lNGLzHU4UPWve1DTdF9Gcwn9OjMcqruiHOQSCObobUVSG8kWBnfbLB7V96wfzSA8Mxiifxa3kutNDQpdlqNk/QeNerBJ0VXxh2SYl9/EUFfCH/aeMF0VjzAuEIPVHtepcmVEsRiESu0PyYBOstFYXVoucGVZoT9vrtmRiz+/xgdxeef24uqiIjzS/tTljE+5TpBwPjbM6+eWXCOVkXCwlNxVN9uyZCrJSUgJpqz72Ip3t0uC1MF5+xYRtIwVFTSfovV6MITI1uoFOrMB0+sweWNXohG/oBM9doawNp1oaE62s8xmggh5a9JK1IA1XVQGw0lC7MTJKi4ojnl1dr6rkqeLbUfgS4xZxgguAL7vGCP35zDbFU1SKSH0mZfNuq7a9YHkPk1nzG1sjLgzxdIyWQ4MnlofCpChubcIUaT1ahZ2AmZlDkfE53Ql7OA4n/ZRS9pybQ/Q24QcjZ7375b/F/2Scy3rHka7ORnpAoIs40JcqrHNRu6b43XIuyl3CpQ="}, "assumedRoleUser": {"assumedRoleId": "AROASM3HWKK95VDO4HH81:AWSConfig", "arn": "arn:aws:sts::811596193553:assumed-role/config-role-us-west-2/AWSConfig"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/service-role/config-role-us-west-2", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e5fbfda1-a8be-454c-825d-ea28a910ce25", "record_id": "flaws_cloudtrail:0000200:e5fbfda1-a8be-454c-825d-ea28a910ce25", "row_index": 200, "timestamp": "2019-08-15T18:27:16Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "config.amazonaws.com", "user_agent": "config.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/service-role/config-role-us-west-2"], "raw_record_size_bytes": 1936, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e5fbfda1-a8be-454c-825d-ea28a910ce25", "eventTime": "2019-08-15T18:27:16Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "config.amazonaws.com", "userAgent": "config.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "config.amazonaws.com"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/service-role/config-role-us-west-2", "roleSessionName": "AWSConfig"}, "responseElements": {"credentials": {"accessKeyId": "ASIAUE4GSRPK0AJAU5JD", "expiration": "Aug 15, 2019 7:27:16 PM", "sessionToken": "AgoJb3JpZ2luX2VjEJv//////////wEaCXVzLXdlc3QtMiJIMEYCIQDUGJBPAdelhB8+/RrKoyAJ8l1HtE3Dj30zgnF17UDmUwIhAJrpGTvC+3OqHan3CMvyDxha2dVVwwjz85XTelEXuV7lKugCCDQQABoMOTc1NDI2MjYyMDI5Igw0NKenW8WWQlOOQpkqxQLcEvQwIRrNJcswVRAIKt0AYbjpR/R4zLM1MO9nSLFtw1vfQoAb2fsu3i2/48HSnyrGDVVk9mwOpogvwULgVYXBwEgiSAp/+hKAVncpnXngUn9HDXPnFP2tx/bJpg9fgh3fLXxBgmmprRlohfRhmEN3B6RcbQCiQaa5uEWpXjEg/Ox5lNGLzHU4UPWve1DTdF9Gcwn9OjMcqruiHOQSCObobUVSG8kWBnfbLB7V96wfzSA8Mxiifxa3kutNDQpdlqNk/QeNerBJ0VXxh2SYl9/EUFfCH/aeMF0VjzAuEIPVHtepcmVEsRiESu0PyYBOstFYXVoucGVZoT9vrtmRiz+/xgdxeef24uqiIjzS/tTljE+5TpBwPjbM6+eWXCOVkXCwlNxVN9uyZCrJSUgJpqz72Ip3t0uC1MF5+xYRtIwVFTSfovV6MITI1uoFOrMB0+sweWNXohG/oBM9doawNp1oaE62s8xmggh5a9JK1IA1XVQGw0lC7MTJKi4ojnl1dr6rkqeLbUfgS4xZxgguAL7vGCP35zDbFU1SKSH0mZfNuq7a9YHkPk1nzG1sjLgzxdIyWQ4MnlofCpChubcIUaT1ahZ2AmZlDkfE53Ql7OA4n/ZRS9pybQ/Q24QcjZ7375b/F/2Scy3rHka7ORnpAoIs40JcqrHNRu6b43XIuyl3CpQ="}, "assumedRoleUser": {"assumedRoleId": "AROASM3HWKK95VDO4HH81:AWSConfig", "arn": "arn:aws:sts::811596193553:assumed-role/config-role-us-west-2/AWSConfig"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/service-role/config-role-us-west-2", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bfd584d2-3f45-459f-a3e5-1139a6cdb1b5", "record_id": "flaws_cloudtrail:0000201:bfd584d2-3f45-459f-a3e5-1139a6cdb1b5", "row_index": 201, "timestamp": "2019-08-15T18:57:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1882, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bfd584d2-3f45-459f-a3e5-1139a6cdb1b5", "eventTime": "2019-08-15T18:57:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIA7G0CEQWKJ2WP54VA", "expiration": "Aug 16, 2019 1:30:02 AM", "sessionToken": "AgoJb3JpZ2luX2VjEJv//////////wEaCXVzLXdlc3QtMiJIMEYCIQCyqyYYXBrAEVO8DUfZGXGJ7mU7oTGRnXcPMpXgG4bjpwIhAKFJvoCDQ6tXGBaZWLF0zGngb7X0rYkBkRrlAaN4gzVOKtoDCDQQABoMOTc1NDI2MjYyMDI5IgznA2XUZyZt5v5vQ20qtwOjCBQ9fqkYEcbfoii9WOUQy/lJA0trDmk1W851UdL59S0b/1qeOQbriXHiYm61dpVhuYafkK0pf0EemhvvurMqVtp7xjzOyWG7HnoM4VLv5wngZc7S8IRlEqie9TfpHYNrtVG0JCfE2Y5DfXJSzJ7UYk3/DsuIqCXJ4NMSk1rYFxCo7EuNYJpkDSZUEG67a1CvHZ7BC8/dhFthheJvsM6C3rv4zNqCjRLEe3wlQDXEshpwkK3PrGVkaO7oojsMSEQdexQGVqGPvnRa8UJ1we/N8Iw6VB5hjUynEaFOiOZ4TClf11iLFSiUtv52Edp3XTsdzeW+ecy3eMvcWfWQAU/l06DCxLp+zv3gepGvRzn6wx/+LxZ4L/VpSiEASWaZEPFjnzckJoCzIyxdklYv71qc/Dfas83XIgSaMiDgKrYu5VyxjhKAvlwJT03Tad6GY2jw0s4oZYomuxa0/lZEiHYdsFyjisX7rFJOHafIW6LSTHAsswE33cb5SiObYMVQVgRzDNg7BffxXYugO1QDMxR5RPxy9f9vlTRa+NzwoEUNljFvHQqZtSpsvc+nocUG56vkYQfOkzHRMJLW1uoFOrMBkVtMmClfXsz9QCh4vK7DrmaijbeG5r/iiTcOOMO/Ht/RJK0bJTEtgwtAn4d/QNxxDA8H9W9yqI+d3FEM4SX7EIcSHMhDJnSk54mPXWi1mgCX1wGSgppJLVKOaSs1PVjoG4JQRZWrM1fxSa4O0+lIBVwUqncqTS0WoegrJB0+PojicTB3eRQKdkUqqrisU6OYK9+JavmxLNgcCVEyX7TXX4susPZa7B4pirgmrDxPS7bMK7Y="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bfd584d2-3f45-459f-a3e5-1139a6cdb1b5", "record_id": "flaws_cloudtrail:0000202:bfd584d2-3f45-459f-a3e5-1139a6cdb1b5", "row_index": 202, "timestamp": "2019-08-15T18:57:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1882, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bfd584d2-3f45-459f-a3e5-1139a6cdb1b5", "eventTime": "2019-08-15T18:57:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIA7G0CEQWKJ2WP54VA", "expiration": "Aug 16, 2019 1:30:02 AM", "sessionToken": "AgoJb3JpZ2luX2VjEJv//////////wEaCXVzLXdlc3QtMiJIMEYCIQCyqyYYXBrAEVO8DUfZGXGJ7mU7oTGRnXcPMpXgG4bjpwIhAKFJvoCDQ6tXGBaZWLF0zGngb7X0rYkBkRrlAaN4gzVOKtoDCDQQABoMOTc1NDI2MjYyMDI5IgznA2XUZyZt5v5vQ20qtwOjCBQ9fqkYEcbfoii9WOUQy/lJA0trDmk1W851UdL59S0b/1qeOQbriXHiYm61dpVhuYafkK0pf0EemhvvurMqVtp7xjzOyWG7HnoM4VLv5wngZc7S8IRlEqie9TfpHYNrtVG0JCfE2Y5DfXJSzJ7UYk3/DsuIqCXJ4NMSk1rYFxCo7EuNYJpkDSZUEG67a1CvHZ7BC8/dhFthheJvsM6C3rv4zNqCjRLEe3wlQDXEshpwkK3PrGVkaO7oojsMSEQdexQGVqGPvnRa8UJ1we/N8Iw6VB5hjUynEaFOiOZ4TClf11iLFSiUtv52Edp3XTsdzeW+ecy3eMvcWfWQAU/l06DCxLp+zv3gepGvRzn6wx/+LxZ4L/VpSiEASWaZEPFjnzckJoCzIyxdklYv71qc/Dfas83XIgSaMiDgKrYu5VyxjhKAvlwJT03Tad6GY2jw0s4oZYomuxa0/lZEiHYdsFyjisX7rFJOHafIW6LSTHAsswE33cb5SiObYMVQVgRzDNg7BffxXYugO1QDMxR5RPxy9f9vlTRa+NzwoEUNljFvHQqZtSpsvc+nocUG56vkYQfOkzHRMJLW1uoFOrMBkVtMmClfXsz9QCh4vK7DrmaijbeG5r/iiTcOOMO/Ht/RJK0bJTEtgwtAn4d/QNxxDA8H9W9yqI+d3FEM4SX7EIcSHMhDJnSk54mPXWi1mgCX1wGSgppJLVKOaSs1PVjoG4JQRZWrM1fxSa4O0+lIBVwUqncqTS0WoegrJB0+PojicTB3eRQKdkUqqrisU6OYK9+JavmxLNgcCVEyX7TXX4susPZa7B4pirgmrDxPS7bMK7Y="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "23255a-a94a-41d6-b287-bf1c97c48e53", "record_id": "flaws_cloudtrail:0000203:23255a-a94a-41d6-b287-bf1c97c48e53", "row_index": 203, "timestamp": "2019-08-15T19:24:20Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "19.34.189.6", "user_agent": "[aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 797, "raw_record_depth": 3, "raw_record_top_level_keys": ["additionalEventData", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "23255a-a94a-41d6-b287-bf1c97c48e53", "eventTime": "2019-08-15T19:24:20Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "19.34.189.6", "userAgent": "[aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135]", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"host": ["s3.amazonaws.com"]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "23255a-a94a-41d6-b287-bf1c97c48e53", "record_id": "flaws_cloudtrail:0000204:23255a-a94a-41d6-b287-bf1c97c48e53", "row_index": 204, "timestamp": "2019-08-15T19:24:20Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "19.34.189.6", "user_agent": "[aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 797, "raw_record_depth": 3, "raw_record_top_level_keys": ["additionalEventData", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "23255a-a94a-41d6-b287-bf1c97c48e53", "eventTime": "2019-08-15T19:24:20Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "19.34.189.6", "userAgent": "[aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135]", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"host": ["s3.amazonaws.com"]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2a08c4a8-d586-44f8-8b18-3db8512c0347", "record_id": "flaws_cloudtrail:0000205:2a08c4a8-d586-44f8-8b18-3db8512c0347", "row_index": 205, "timestamp": "2019-08-15T19:25:27Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "19.34.189.6", "user_agent": "[aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 799, "raw_record_depth": 3, "raw_record_top_level_keys": ["additionalEventData", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2a08c4a8-d586-44f8-8b18-3db8512c0347", "eventTime": "2019-08-15T19:25:27Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "19.34.189.6", "userAgent": "[aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135]", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"host": ["s3.amazonaws.com"]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2a08c4a8-d586-44f8-8b18-3db8512c0347", "record_id": "flaws_cloudtrail:0000206:2a08c4a8-d586-44f8-8b18-3db8512c0347", "row_index": 206, "timestamp": "2019-08-15T19:25:27Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "19.34.189.6", "user_agent": "[aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 799, "raw_record_depth": 3, "raw_record_top_level_keys": ["additionalEventData", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2a08c4a8-d586-44f8-8b18-3db8512c0347", "eventTime": "2019-08-15T19:25:27Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "19.34.189.6", "userAgent": "[aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135]", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"host": ["s3.amazonaws.com"]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a127746e-f714-4f1e-833e-19a74d0f94c2", "record_id": "flaws_cloudtrail:0000207:a127746e-f714-4f1e-833e-19a74d0f94c2", "row_index": 207, "timestamp": "2019-08-15T19:31:35Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "19.34.189.6", "user_agent": "aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 769, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a127746e-f714-4f1e-833e-19a74d0f94c2", "eventTime": "2019-08-15T19:31:35Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "19.34.189.6", "userAgent": "aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a127746e-f714-4f1e-833e-19a74d0f94c2", "record_id": "flaws_cloudtrail:0000208:a127746e-f714-4f1e-833e-19a74d0f94c2", "row_index": 208, "timestamp": "2019-08-15T19:31:35Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "19.34.189.6", "user_agent": "aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 769, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a127746e-f714-4f1e-833e-19a74d0f94c2", "eventTime": "2019-08-15T19:31:35Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "19.34.189.6", "userAgent": "aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "094339c43-2e70-46b2-8584-e29c349abdb6", "record_id": "flaws_cloudtrail:0000209:094339c43-2e70-46b2-8584-e29c349abdb6", "row_index": 209, "timestamp": "2019-08-15T19:33:17Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "19.34.189.6", "user_agent": "aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 699, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "094339c43-2e70-46b2-8584-e29c349abdb6", "eventTime": "2019-08-15T19:33:17Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "19.34.189.6", "userAgent": "aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "094339c43-2e70-46b2-8584-e29c349abdb6", "record_id": "flaws_cloudtrail:0000210:094339c43-2e70-46b2-8584-e29c349abdb6", "row_index": 210, "timestamp": "2019-08-15T19:33:17Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "19.34.189.6", "user_agent": "aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 699, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "094339c43-2e70-46b2-8584-e29c349abdb6", "eventTime": "2019-08-15T19:33:17Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "19.34.189.6", "userAgent": "aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bfac7384-98ac-4f1a-aa07-44e13d652bb4", "record_id": "flaws_cloudtrail:0000211:bfac7384-98ac-4f1a-aa07-44e13d652bb4", "row_index": 211, "timestamp": "2019-08-15T19:37:58Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "19.34.189.6", "user_agent": "aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 819, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bfac7384-98ac-4f1a-aa07-44e13d652bb4", "eventTime": "2019-08-15T19:37:58Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "19.34.189.6", "userAgent": "aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {"items": [{"name": "volume-id", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bfac7384-98ac-4f1a-aa07-44e13d652bb4", "record_id": "flaws_cloudtrail:0000212:bfac7384-98ac-4f1a-aa07-44e13d652bb4", "row_index": 212, "timestamp": "2019-08-15T19:37:58Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "19.34.189.6", "user_agent": "aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 819, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bfac7384-98ac-4f1a-aa07-44e13d652bb4", "eventTime": "2019-08-15T19:37:58Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "19.34.189.6", "userAgent": "aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {"items": [{"name": "volume-id", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f26261b-a938-44f9-98a2-804f2e59386", "record_id": "flaws_cloudtrail:0000213:f26261b-a938-44f9-98a2-804f2e59386", "row_index": 213, "timestamp": "2019-08-15T19:39:24Z", "event_type": "DescribeSnapshotAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "19.34.189.6", "user_agent": "aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 752, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f26261b-a938-44f9-98a2-804f2e59386", "eventTime": "2019-08-15T19:39:24Z", "eventName": "DescribeSnapshotAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "19.34.189.6", "userAgent": "aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-83d15d668fb2941db", "attributeType": "CREATE_VOLUME_PERMISSION"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f26261b-a938-44f9-98a2-804f2e59386", "record_id": "flaws_cloudtrail:0000214:f26261b-a938-44f9-98a2-804f2e59386", "row_index": 214, "timestamp": "2019-08-15T19:39:24Z", "event_type": "DescribeSnapshotAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "19.34.189.6", "user_agent": "aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 752, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f26261b-a938-44f9-98a2-804f2e59386", "eventTime": "2019-08-15T19:39:24Z", "eventName": "DescribeSnapshotAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "19.34.189.6", "userAgent": "aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-83d15d668fb2941db", "attributeType": "CREATE_VOLUME_PERMISSION"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "579e7f48-0e0f-4523-b853-4cc7698f65d2", "record_id": "flaws_cloudtrail:0000215:579e7f48-0e0f-4523-b853-4cc7698f65d2", "row_index": 215, "timestamp": "2019-08-15T19:57:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1883, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "579e7f48-0e0f-4523-b853-4cc7698f65d2", "eventTime": "2019-08-15T19:57:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIA0H5LCFJEP3XH8S0M", "expiration": "Aug 16, 2019 2:07:42 AM", "sessionToken": "AgoJb3JpZ2luX2VjEJz//////////wEaCXVzLXdlc3QtMiJGMEQCIA6cfEu9cTMzPajRBs1lONrw/1YMTS8o9Noa4BNkOu0WAiBtns6B/fr6M8DyWQFgavNA/MjlwStD85iz14v05RyfWyraAwg1EAAaDDk3NTQyNjI2MjAyOSIM5AvQtCxymMeisizwKrcDmkcOwT/D/RRwZr82Fo4V9NOnL9gjbUIwGD/JWpaXA6ZqbVixsKOGGctGAAb1XlU3chcMFNrx6yh+Ergi8gqTntLpG3Y9/i1n3KgnzAx3yRcovO1vIcDB2KWDaS+CYyUwo7IDGOKXfVvKVFxLvhPKeaLF1WP0uHMYriGVgoQLzExB/HpRKcoLhEP0HNNwG3wN5KIrlGqJ7l5M4pVN/Xfm7cSu7xD1A7mIm7dCXkQEaIehq/YCzUUaCymVT4bNisEyLuEghw+VU7RejeJfLTowGyKZKISsqj3n8MXEJ89MHJGsXV9ig4G8xjxHewlTtodYN/Usz3zZm7PQXxOCaZUUoTBBeFROiA0mUVBC+FrpYUtKxaNWYLU9FBkFUKqvZrroRjVJMl+cKkRVHrr5jMtV/2zervAz99GK8Itb7FfCw4iWzgo3F6IikMkeIN88rf7vOQEF8Cr2iq5FJH40zIGdOLVTiRkjqiV1MYtammp2ckAADYbY5tThSBmCaIkDdVNjccJxy2ZwyX3opQ3VUD9qiJKa0ys3D0dWnlWHxxhZg4FPEHHsMxq8FeWe4VqUfu9wIY+8EX8oxDCi8tbqBTq1AWW54zlhNi3o0AG0gC6LkuwdVvsLhxrmh2RUDawCi30c7pd77Y5Vu6lAz5JEfPfle82fmBND+IqGqjZvs/HAnqBelm7E4tLwhNaZYAEYxDG9ujMW8ZbfeaQ/TIXG9np7YY6JHdOaloMiNdIUOMMobAVrKpGSNRFKbj7rOxhHnB43LL6fwiaToewwWDni0bEJoxdv3rY4QksydWN7f6kGQ+1HPegoF5HMLB+16ftitwtiE5GdFxg="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "579e7f48-0e0f-4523-b853-4cc7698f65d2", "record_id": "flaws_cloudtrail:0000216:579e7f48-0e0f-4523-b853-4cc7698f65d2", "row_index": 216, "timestamp": "2019-08-15T19:57:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1883, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "579e7f48-0e0f-4523-b853-4cc7698f65d2", "eventTime": "2019-08-15T19:57:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIA0H5LCFJEP3XH8S0M", "expiration": "Aug 16, 2019 2:07:42 AM", "sessionToken": "AgoJb3JpZ2luX2VjEJz//////////wEaCXVzLXdlc3QtMiJGMEQCIA6cfEu9cTMzPajRBs1lONrw/1YMTS8o9Noa4BNkOu0WAiBtns6B/fr6M8DyWQFgavNA/MjlwStD85iz14v05RyfWyraAwg1EAAaDDk3NTQyNjI2MjAyOSIM5AvQtCxymMeisizwKrcDmkcOwT/D/RRwZr82Fo4V9NOnL9gjbUIwGD/JWpaXA6ZqbVixsKOGGctGAAb1XlU3chcMFNrx6yh+Ergi8gqTntLpG3Y9/i1n3KgnzAx3yRcovO1vIcDB2KWDaS+CYyUwo7IDGOKXfVvKVFxLvhPKeaLF1WP0uHMYriGVgoQLzExB/HpRKcoLhEP0HNNwG3wN5KIrlGqJ7l5M4pVN/Xfm7cSu7xD1A7mIm7dCXkQEaIehq/YCzUUaCymVT4bNisEyLuEghw+VU7RejeJfLTowGyKZKISsqj3n8MXEJ89MHJGsXV9ig4G8xjxHewlTtodYN/Usz3zZm7PQXxOCaZUUoTBBeFROiA0mUVBC+FrpYUtKxaNWYLU9FBkFUKqvZrroRjVJMl+cKkRVHrr5jMtV/2zervAz99GK8Itb7FfCw4iWzgo3F6IikMkeIN88rf7vOQEF8Cr2iq5FJH40zIGdOLVTiRkjqiV1MYtammp2ckAADYbY5tThSBmCaIkDdVNjccJxy2ZwyX3opQ3VUD9qiJKa0ys3D0dWnlWHxxhZg4FPEHHsMxq8FeWe4VqUfu9wIY+8EX8oxDCi8tbqBTq1AWW54zlhNi3o0AG0gC6LkuwdVvsLhxrmh2RUDawCi30c7pd77Y5Vu6lAz5JEfPfle82fmBND+IqGqjZvs/HAnqBelm7E4tLwhNaZYAEYxDG9ujMW8ZbfeaQ/TIXG9np7YY6JHdOaloMiNdIUOMMobAVrKpGSNRFKbj7rOxhHnB43LL6fwiaToewwWDni0bEJoxdv3rY4QksydWN7f6kGQ+1HPegoF5HMLB+16ftitwtiE5GdFxg="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5aa8c3e6-a339-4dd9-9d5d-9cda7310286d", "record_id": "flaws_cloudtrail:0000217:5aa8c3e6-a339-4dd9-9d5d-9cda7310286d", "row_index": 217, "timestamp": "2019-08-15T20:35:31Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "19.34.189.6", "user_agent": "[aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 799, "raw_record_depth": 3, "raw_record_top_level_keys": ["additionalEventData", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5aa8c3e6-a339-4dd9-9d5d-9cda7310286d", "eventTime": "2019-08-15T20:35:31Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "19.34.189.6", "userAgent": "[aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135]", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"host": ["s3.amazonaws.com"]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5aa8c3e6-a339-4dd9-9d5d-9cda7310286d", "record_id": "flaws_cloudtrail:0000218:5aa8c3e6-a339-4dd9-9d5d-9cda7310286d", "row_index": 218, "timestamp": "2019-08-15T20:35:31Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "19.34.189.6", "user_agent": "[aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 799, "raw_record_depth": 3, "raw_record_top_level_keys": ["additionalEventData", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5aa8c3e6-a339-4dd9-9d5d-9cda7310286d", "eventTime": "2019-08-15T20:35:31Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "19.34.189.6", "userAgent": "[aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135]", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"host": ["s3.amazonaws.com"]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "faa02b8f-b423-4312-8ac1-feed7540dd45", "record_id": "flaws_cloudtrail:0000219:faa02b8f-b423-4312-8ac1-feed7540dd45", "row_index": 219, "timestamp": "2019-08-15T20:36:04Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "19.34.189.6", "user_agent": "aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 769, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "faa02b8f-b423-4312-8ac1-feed7540dd45", "eventTime": "2019-08-15T20:36:04Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "19.34.189.6", "userAgent": "aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "responseElements": {"userId": "AIDADO2GQD0K8TEF7KW1V", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "faa02b8f-b423-4312-8ac1-feed7540dd45", "record_id": "flaws_cloudtrail:0000220:faa02b8f-b423-4312-8ac1-feed7540dd45", "row_index": 220, "timestamp": "2019-08-15T20:36:04Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "19.34.189.6", "user_agent": "aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 769, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "faa02b8f-b423-4312-8ac1-feed7540dd45", "eventTime": "2019-08-15T20:36:04Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "19.34.189.6", "userAgent": "aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "responseElements": {"userId": "AIDADO2GQD0K8TEF7KW1V", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1cbc26fb-edc5-482a-9695-8661cbd838cc", "record_id": "flaws_cloudtrail:0000221:1cbc26fb-edc5-482a-9695-8661cbd838cc", "row_index": 221, "timestamp": "2019-08-15T20:36:43Z", "event_type": "ListAttachedUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "19.34.189.6", "user_agent": "aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 692, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1cbc26fb-edc5-482a-9695-8661cbd838cc", "eventTime": "2019-08-15T20:36:43Z", "eventName": "ListAttachedUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "19.34.189.6", "userAgent": "aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1cbc26fb-edc5-482a-9695-8661cbd838cc", "record_id": "flaws_cloudtrail:0000222:1cbc26fb-edc5-482a-9695-8661cbd838cc", "row_index": 222, "timestamp": "2019-08-15T20:36:43Z", "event_type": "ListAttachedUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "19.34.189.6", "user_agent": "aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 692, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1cbc26fb-edc5-482a-9695-8661cbd838cc", "eventTime": "2019-08-15T20:36:43Z", "eventName": "ListAttachedUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "19.34.189.6", "userAgent": "aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e73f44e0-d7b3-4a63-b890-9f3a25321c4e", "record_id": "flaws_cloudtrail:0000223:e73f44e0-d7b3-4a63-b890-9f3a25321c4e", "row_index": 223, "timestamp": "2019-08-15T20:42:26Z", "event_type": "GetPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "19.34.189.6", "user_agent": "aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 720, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e73f44e0-d7b3-4a63-b890-9f3a25321c4e", "eventTime": "2019-08-15T20:42:26Z", "eventName": "GetPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "19.34.189.6", "userAgent": "aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e73f44e0-d7b3-4a63-b890-9f3a25321c4e", "record_id": "flaws_cloudtrail:0000224:e73f44e0-d7b3-4a63-b890-9f3a25321c4e", "row_index": 224, "timestamp": "2019-08-15T20:42:26Z", "event_type": "GetPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "19.34.189.6", "user_agent": "aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 720, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e73f44e0-d7b3-4a63-b890-9f3a25321c4e", "eventTime": "2019-08-15T20:42:26Z", "eventName": "GetPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "19.34.189.6", "userAgent": "aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e8d117a7-6c04-4e6d-917c-6a5a4015f34c", "record_id": "flaws_cloudtrail:0000225:e8d117a7-6c04-4e6d-917c-6a5a4015f34c", "row_index": 225, "timestamp": "2019-08-15T20:43:25Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "19.34.189.6", "user_agent": "aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 745, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e8d117a7-6c04-4e6d-917c-6a5a4015f34c", "eventTime": "2019-08-15T20:43:25Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "19.34.189.6", "userAgent": "aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways", "versionId": "v4"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e8d117a7-6c04-4e6d-917c-6a5a4015f34c", "record_id": "flaws_cloudtrail:0000226:e8d117a7-6c04-4e6d-917c-6a5a4015f34c", "row_index": 226, "timestamp": "2019-08-15T20:43:25Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "19.34.189.6", "user_agent": "aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 745, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e8d117a7-6c04-4e6d-917c-6a5a4015f34c", "eventTime": "2019-08-15T20:43:25Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "19.34.189.6", "userAgent": "aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways", "versionId": "v4"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d9e5129d-bbd0-467e-bd73-453e2a0dcedc", "record_id": "flaws_cloudtrail:0000227:d9e5129d-bbd0-467e-bd73-453e2a0dcedc", "row_index": 227, "timestamp": "2019-08-15T20:44:43Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "19.34.189.6", "user_agent": "aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 673, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d9e5129d-bbd0-467e-bd73-453e2a0dcedc", "eventTime": "2019-08-15T20:44:43Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "19.34.189.6", "userAgent": "aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d9e5129d-bbd0-467e-bd73-453e2a0dcedc", "record_id": "flaws_cloudtrail:0000228:d9e5129d-bbd0-467e-bd73-453e2a0dcedc", "row_index": 228, "timestamp": "2019-08-15T20:44:43Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "19.34.189.6", "user_agent": "aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 673, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d9e5129d-bbd0-467e-bd73-453e2a0dcedc", "eventTime": "2019-08-15T20:44:43Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "19.34.189.6", "userAgent": "aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "44967-3ec0-4d33-ab66-647039c1f39d", "record_id": "flaws_cloudtrail:0000229:44967-3ec0-4d33-ab66-647039c1f39d", "row_index": 229, "timestamp": "2019-08-15T20:45:27Z", "event_type": "GetPolicy202224v2", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "19.34.189.6", "user_agent": "aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 689, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "44967-3ec0-4d33-ab66-647039c1f39d", "eventTime": "2019-08-15T20:45:27Z", "eventName": "GetPolicy202224v2", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "19.34.189.6", "userAgent": "aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"functionName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "44967-3ec0-4d33-ab66-647039c1f39d", "record_id": "flaws_cloudtrail:0000230:44967-3ec0-4d33-ab66-647039c1f39d", "row_index": 230, "timestamp": "2019-08-15T20:45:27Z", "event_type": "GetPolicy202224v2", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "19.34.189.6", "user_agent": "aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 689, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "44967-3ec0-4d33-ab66-647039c1f39d", "eventTime": "2019-08-15T20:45:27Z", "eventName": "GetPolicy202224v2", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "19.34.189.6", "userAgent": "aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"functionName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9e6f59b4-d834-4952-92f5-2b9fbd68637b", "record_id": "flaws_cloudtrail:0000231:9e6f59b4-d834-4952-92f5-2b9fbd68637b", "row_index": 231, "timestamp": "2019-08-15T20:46:47Z", "event_type": "GetStages", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "19.34.189.6", "user_agent": "aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 722, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9e6f59b4-d834-4952-92f5-2b9fbd68637b", "eventTime": "2019-08-15T20:46:47Z", "eventName": "GetStages", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "19.34.189.6", "userAgent": "aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "s33ppypa75", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9e6f59b4-d834-4952-92f5-2b9fbd68637b", "record_id": "flaws_cloudtrail:0000232:9e6f59b4-d834-4952-92f5-2b9fbd68637b", "row_index": 232, "timestamp": "2019-08-15T20:46:47Z", "event_type": "GetStages", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "19.34.189.6", "user_agent": "aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 722, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9e6f59b4-d834-4952-92f5-2b9fbd68637b", "eventTime": "2019-08-15T20:46:47Z", "eventName": "GetStages", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "19.34.189.6", "userAgent": "aws-cli/1.16.144 Python/3.7.3 Darwin/18.7.0 botocore/1.12.135", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "s33ppypa75", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1154ffb7-1a5e-471e-9c7f-2f7daa5e1443", "record_id": "flaws_cloudtrail:0000233:1154ffb7-1a5e-471e-9c7f-2f7daa5e1443", "row_index": 233, "timestamp": "2019-08-15T20:47:40Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "lambda.amazonaws.com", "user_agent": "lambda.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/service-role/Level6"], "raw_record_size_bytes": 1618, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1154ffb7-1a5e-471e-9c7f-2f7daa5e1443", "eventTime": "2019-08-15T20:47:40Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "lambda.amazonaws.com", "userAgent": "lambda.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "lambda.amazonaws.com"}, "requestParameters": {"roleSessionName": "Level6", "roleArn": "arn:aws:iam::811596193553:role/service-role/Level6"}, "responseElements": {"credentials": {"accessKeyId": "ASIAB3JH9U2JSTU1I5I7", "expiration": "Aug 16, 2019 8:47:40 AM", "sessionToken": "AgoJb3JpZ2luX2VjEJ3//////////wEaCXVzLXdlc3QtMiJHMEUCIQDMlcEYbx47t6QSCkQWwxUeo8u4GY5NDCAiRER+lLup3gIgYU6GwIuJCcNm6gO9G7Y1iYhP7y5WX1ho6LjviM0fmdgqggIINhAAGgw5NzU0MjYyNjIwMjkiDF0KZSsRyW8u3nwT8CrfAWFmecEglZyYfn6OtvUMYmevjIwFTba8g4qYWouGIO5mWHI1MeGC/sTlA7+KW6h9Zu5epY2oohAx4v9qPZ8I6IHP+eMkROp/hTG2dTSTh4w+mMlODH/dbLq8A19y55+W+I1u0WMjp66MVVOV1iLksVO4kICm0OVcgXlyGkks7auRg3jjRpoJOAOghY2FNhcJ/kJnH/NYtlGvZnqXB3vRxVwpR4zb4kPav/o2mvo/I+Y8zr3XqNy/l1wE9gczYd0Rdpk6NsD8GG+SwoFIZgXniklBE0n9DCyKNoiXUwLqIf0w7InX6gU6tAE/YFx3JxrTc7yZMg8xyI1E9GWXBJenjTq7b8o1PIygbKgBpu3ZoULjvJN4eAHJGdlPdo7VFuRdLhEz4pU2ohtnE/BtdXc8+7LiSJOF9od9WDEy/BZZGw950fPd8QiHJJjtB5KERgF4I5KFhzjWzTM/riIzlPay6300nv7rfI4Zfa++jdukUxgCilwOEc57CU9VzoHm57DNSBVhBXXu2VilZz3itZsoHP2YvFUnXywMbhq27yw="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d1cea32a-8c3d-4242-a381-a0bb570558b", "record_id": "flaws_cloudtrail:0000234:d1cea32a-8c3d-4242-a381-a0bb570558b", "row_index": 234, "timestamp": "2019-08-15T20:47:40Z", "event_type": "CreateLogStream", "event_source": "logs.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "account_id": "811596193553", "principal_id": "AROAI4E1FBACLY3FPC6BB:Level6", "user_name": null, "access_key_id": "ASIAB3JH9U2JSTU1I5I7", "session_issuer_arn": "arn:aws:iam::811596193553:role/service-role/Level6", "session_issuer_user_name": "Level6"}, "network": {"source_ip": "229.215.211.94", "user_agent": "awslambda-worker", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1031, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d1cea32a-8c3d-4242-a381-a0bb570558b", "eventTime": "2019-08-15T20:47:40Z", "eventName": "CreateLogStream", "eventSource": "logs.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "229.215.211.94", "userAgent": "awslambda-worker", "awsRegion": "us-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAI4E1FBACLY3FPC6BB:Level6", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "accountId": "811596193553", "accessKeyId": "ASIAB3JH9U2JSTU1I5I7", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-08-15T20:47:40Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAI4E1FBACLY3FPC6BB", "arn": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "userName": "Level6"}}}, "requestParameters": {"logGroupName": "/aws/lambda/Level6", "logStreamName": "2019/08/15/[$LATEST]907376a057d00679de1059c3ee9684de"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ff26b54b-c5d3-4a30-ae96-23c65a33dcfe", "record_id": "flaws_cloudtrail:0000235:ff26b54b-c5d3-4a30-ae96-23c65a33dcfe", "row_index": 235, "timestamp": "2019-08-15T20:47:40Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "lambda.amazonaws.com", "user_agent": "lambda.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/service-role/Level6"], "raw_record_size_bytes": 1618, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ff26b54b-c5d3-4a30-ae96-23c65a33dcfe", "eventTime": "2019-08-15T20:47:40Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "lambda.amazonaws.com", "userAgent": "lambda.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "lambda.amazonaws.com"}, "requestParameters": {"roleSessionName": "Level6", "roleArn": "arn:aws:iam::811596193553:role/service-role/Level6"}, "responseElements": {"credentials": {"accessKeyId": "ASIAAEAIX6RQ1RY723PI", "expiration": "Aug 16, 2019 8:47:40 AM", "sessionToken": "AgoJb3JpZ2luX2VjEJ3//////////wEaCXVzLXdlc3QtMiJGMEQCIHn6o+f6OqKu8X3v4ZKFE4NeDosWgqpCq1V36oHD2gzIAiBbN02814k0XD2JLpCkpJNBRuOL5yk2iELhGGzTYBDEbSqCAgg2EAAaDDk3NTQyNjI2MjAyOSIM3hwsrobDfdvKSQ4JKt8B3iaQSqEIYI4HmOvqjHuPo4Mof71yVnZIgSNBqUtPvAUAnNXObZtqbptWSndgfZCvYgYv3wTwdt2+LRdWbbC2WrHo4yaVVurQmvmDb+0fICHPNnj2w6lU6rQEkNHiyG+Ki1DxC8S28wHisPHD0WX3yiKhdPQG4LEjIm27LSCMF0P2AZqz9QRqb+Mz7RT2qrzkJe6m1Go8ZAU2d72R994bMbmqxvjB0i5f89mDQ6/56AOLOtj6IBfWEhFmCuOK0S+5lZ9qul83OqcI/VDoXnFHBQI7Gz/o8Pc3fMxiCXlD/TDsidfqBTq1ARkJe8aVuhAPThe275flAjxnUhVfCVv/xtc2HDnKecZ5z3/w0VV9YpLH/GAAJmFVlz39k+KDDP51v/pu4FgqaR6Z6eKM2nRIBU3ipnZXxiGLunfoI3Vh/y0/vjLb/OT6MOGTJpy3nzkBoXt1qJsAhG+iiVKCE/Lw0JnVspPyaEw7FQXFTZVEPHrtWvbAk9QjQJXiMWIsbsmSpFwO16xXdc2J9PJHWixynh+nUPb+oaFG8dpD5BI="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d1cea32a-8c3d-4242-a381-a0bb570558b", "record_id": "flaws_cloudtrail:0000236:d1cea32a-8c3d-4242-a381-a0bb570558b", "row_index": 236, "timestamp": "2019-08-15T20:47:40Z", "event_type": "CreateLogStream", "event_source": "logs.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "account_id": "811596193553", "principal_id": "AROAI4E1FBACLY3FPC6BB:Level6", "user_name": null, "access_key_id": "ASIAB3JH9U2JSTU1I5I7", "session_issuer_arn": "arn:aws:iam::811596193553:role/service-role/Level6", "session_issuer_user_name": "Level6"}, "network": {"source_ip": "229.215.211.94", "user_agent": "awslambda-worker", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1031, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d1cea32a-8c3d-4242-a381-a0bb570558b", "eventTime": "2019-08-15T20:47:40Z", "eventName": "CreateLogStream", "eventSource": "logs.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "229.215.211.94", "userAgent": "awslambda-worker", "awsRegion": "us-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAI4E1FBACLY3FPC6BB:Level6", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "accountId": "811596193553", "accessKeyId": "ASIAB3JH9U2JSTU1I5I7", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-08-15T20:47:40Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAI4E1FBACLY3FPC6BB", "arn": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "userName": "Level6"}}}, "requestParameters": {"logGroupName": "/aws/lambda/Level6", "logStreamName": "2019/08/15/[$LATEST]907376a057d00679de1059c3ee9684de"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ff26b54b-c5d3-4a30-ae96-23c65a33dcfe", "record_id": "flaws_cloudtrail:0000237:ff26b54b-c5d3-4a30-ae96-23c65a33dcfe", "row_index": 237, "timestamp": "2019-08-15T20:47:40Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "lambda.amazonaws.com", "user_agent": "lambda.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/service-role/Level6"], "raw_record_size_bytes": 1618, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ff26b54b-c5d3-4a30-ae96-23c65a33dcfe", "eventTime": "2019-08-15T20:47:40Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "lambda.amazonaws.com", "userAgent": "lambda.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "lambda.amazonaws.com"}, "requestParameters": {"roleSessionName": "Level6", "roleArn": "arn:aws:iam::811596193553:role/service-role/Level6"}, "responseElements": {"credentials": {"accessKeyId": "ASIAAEAIX6RQ1RY723PI", "expiration": "Aug 16, 2019 8:47:40 AM", "sessionToken": "AgoJb3JpZ2luX2VjEJ3//////////wEaCXVzLXdlc3QtMiJGMEQCIHn6o+f6OqKu8X3v4ZKFE4NeDosWgqpCq1V36oHD2gzIAiBbN02814k0XD2JLpCkpJNBRuOL5yk2iELhGGzTYBDEbSqCAgg2EAAaDDk3NTQyNjI2MjAyOSIM3hwsrobDfdvKSQ4JKt8B3iaQSqEIYI4HmOvqjHuPo4Mof71yVnZIgSNBqUtPvAUAnNXObZtqbptWSndgfZCvYgYv3wTwdt2+LRdWbbC2WrHo4yaVVurQmvmDb+0fICHPNnj2w6lU6rQEkNHiyG+Ki1DxC8S28wHisPHD0WX3yiKhdPQG4LEjIm27LSCMF0P2AZqz9QRqb+Mz7RT2qrzkJe6m1Go8ZAU2d72R994bMbmqxvjB0i5f89mDQ6/56AOLOtj6IBfWEhFmCuOK0S+5lZ9qul83OqcI/VDoXnFHBQI7Gz/o8Pc3fMxiCXlD/TDsidfqBTq1ARkJe8aVuhAPThe275flAjxnUhVfCVv/xtc2HDnKecZ5z3/w0VV9YpLH/GAAJmFVlz39k+KDDP51v/pu4FgqaR6Z6eKM2nRIBU3ipnZXxiGLunfoI3Vh/y0/vjLb/OT6MOGTJpy3nzkBoXt1qJsAhG+iiVKCE/Lw0JnVspPyaEw7FQXFTZVEPHrtWvbAk9QjQJXiMWIsbsmSpFwO16xXdc2J9PJHWixynh+nUPb+oaFG8dpD5BI="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1154ffb7-1a5e-471e-9c7f-2f7daa5e1443", "record_id": "flaws_cloudtrail:0000238:1154ffb7-1a5e-471e-9c7f-2f7daa5e1443", "row_index": 238, "timestamp": "2019-08-15T20:47:40Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "lambda.amazonaws.com", "user_agent": "lambda.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/service-role/Level6"], "raw_record_size_bytes": 1618, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1154ffb7-1a5e-471e-9c7f-2f7daa5e1443", "eventTime": "2019-08-15T20:47:40Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "lambda.amazonaws.com", "userAgent": "lambda.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "lambda.amazonaws.com"}, "requestParameters": {"roleSessionName": "Level6", "roleArn": "arn:aws:iam::811596193553:role/service-role/Level6"}, "responseElements": {"credentials": {"accessKeyId": "ASIAB3JH9U2JSTU1I5I7", "expiration": "Aug 16, 2019 8:47:40 AM", "sessionToken": "AgoJb3JpZ2luX2VjEJ3//////////wEaCXVzLXdlc3QtMiJHMEUCIQDMlcEYbx47t6QSCkQWwxUeo8u4GY5NDCAiRER+lLup3gIgYU6GwIuJCcNm6gO9G7Y1iYhP7y5WX1ho6LjviM0fmdgqggIINhAAGgw5NzU0MjYyNjIwMjkiDF0KZSsRyW8u3nwT8CrfAWFmecEglZyYfn6OtvUMYmevjIwFTba8g4qYWouGIO5mWHI1MeGC/sTlA7+KW6h9Zu5epY2oohAx4v9qPZ8I6IHP+eMkROp/hTG2dTSTh4w+mMlODH/dbLq8A19y55+W+I1u0WMjp66MVVOV1iLksVO4kICm0OVcgXlyGkks7auRg3jjRpoJOAOghY2FNhcJ/kJnH/NYtlGvZnqXB3vRxVwpR4zb4kPav/o2mvo/I+Y8zr3XqNy/l1wE9gczYd0Rdpk6NsD8GG+SwoFIZgXniklBE0n9DCyKNoiXUwLqIf0w7InX6gU6tAE/YFx3JxrTc7yZMg8xyI1E9GWXBJenjTq7b8o1PIygbKgBpu3ZoULjvJN4eAHJGdlPdo7VFuRdLhEz4pU2ohtnE/BtdXc8+7LiSJOF9od9WDEy/BZZGw950fPd8QiHJJjtB5KERgF4I5KFhzjWzTM/riIzlPay6300nv7rfI4Zfa++jdukUxgCilwOEc57CU9VzoHm57DNSBVhBXXu2VilZz3itZsoHP2YvFUnXywMbhq27yw="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1fa5edc7-9923-4adc-abd4-5fc197b5c0ef", "record_id": "flaws_cloudtrail:0000239:1fa5edc7-9923-4adc-abd4-5fc197b5c0ef", "row_index": 239, "timestamp": "2019-08-15T20:57:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1878, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1fa5edc7-9923-4adc-abd4-5fc197b5c0ef", "eventTime": "2019-08-15T20:57:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIAPUDU7T66LLXCE33A", "expiration": "Aug 16, 2019 3:06:54 AM", "sessionToken": "AgoJb3JpZ2luX2VjEJ3//////////wEaCXVzLXdlc3QtMiJHMEUCIHzkYTj3rkA3WgVUHfS4xfPbjAnS0+b0bA6AyJXI19P1AiEAsLvDin1hYxFS2sT0jPY3OSkx268OuQvOzoruKmF2XrAq2gMINhAAGgw5NzU0MjYyNjIwMjkiDCdYbG4uncQWCQ0OvCq3A0QbSZQWyxpeZcAxdCNjrBvOcjF3Jlrs4NUNmmEGfZqrEeCFPZR0kS+XrFeKqyuFgoRSpvacEyZ4m7Y5FP6/9JVSGkCh1TyKAab8VX3UAURYVHDqyhpuoYaYI6gyrkKm26wUfC8q3k1k4AuTwB5ohE5SHQjE+lp/7Xod4AOBxtJ5Rq51Q4/drzLfa3/FPG1npvsk7dalKaMQPySFEYkJ9NNtTs5G/yXIv3OzP3pM0Yif8/OrUIkqMogOhTQq44dKInibChQh7uc+fQ40oo1yfG6uHY13A/+tHgv3nlDgX0n3ED888Mgsylt6sqwDpHDz49kbjWHkFHvTtpgoLYFHY37D+VgtW/lp3T5ZI6gaWyHgT2R0zPeDyf7lOT/9tWZRuZhxqtdE/hAhnlMGMUL1nDMuv62SWXlAlKszFycf2yWlBTzWafNfjEPVEzJigEoZBdUYoVbm/FuqPgHWRP8Pg3yi/QjMhT496m2NHiy3N6wkKDkQu/IGob73sIaqRwkZzwC2g0qW88rARsdfo8hkV9tl/1PzLC5yQ7r/qdf65OaYZ10NxNd/B7yx87WfHzW8SwVgH57ASWswso7X6gU6tAFPTTdtYfk2LXifU/udsR8z8F6VSU1mYhzfb4wZ7YUbU2BvfjzBnV7LAIR1ZTARH3rugHDuJ0KViXQh/O0Q9Lmn0F9QoqkrNkRB86zwACj2mGhAXPTnwSzjsu49F+AdNOlQFrW6p+5Dwp3b0g+UE1g3ruCld3J2dLjTeG+qFxK5jXZZ7OdUGksmX9qMbHNYzXr5LdjwZZSvTmJKUwU+hT/8i28wNMi9SRQM1bCEjvkrlvb0ZaI="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1fa5edc7-9923-4adc-abd4-5fc197b5c0ef", "record_id": "flaws_cloudtrail:0000240:1fa5edc7-9923-4adc-abd4-5fc197b5c0ef", "row_index": 240, "timestamp": "2019-08-15T20:57:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1878, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1fa5edc7-9923-4adc-abd4-5fc197b5c0ef", "eventTime": "2019-08-15T20:57:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIAPUDU7T66LLXCE33A", "expiration": "Aug 16, 2019 3:06:54 AM", "sessionToken": "AgoJb3JpZ2luX2VjEJ3//////////wEaCXVzLXdlc3QtMiJHMEUCIHzkYTj3rkA3WgVUHfS4xfPbjAnS0+b0bA6AyJXI19P1AiEAsLvDin1hYxFS2sT0jPY3OSkx268OuQvOzoruKmF2XrAq2gMINhAAGgw5NzU0MjYyNjIwMjkiDCdYbG4uncQWCQ0OvCq3A0QbSZQWyxpeZcAxdCNjrBvOcjF3Jlrs4NUNmmEGfZqrEeCFPZR0kS+XrFeKqyuFgoRSpvacEyZ4m7Y5FP6/9JVSGkCh1TyKAab8VX3UAURYVHDqyhpuoYaYI6gyrkKm26wUfC8q3k1k4AuTwB5ohE5SHQjE+lp/7Xod4AOBxtJ5Rq51Q4/drzLfa3/FPG1npvsk7dalKaMQPySFEYkJ9NNtTs5G/yXIv3OzP3pM0Yif8/OrUIkqMogOhTQq44dKInibChQh7uc+fQ40oo1yfG6uHY13A/+tHgv3nlDgX0n3ED888Mgsylt6sqwDpHDz49kbjWHkFHvTtpgoLYFHY37D+VgtW/lp3T5ZI6gaWyHgT2R0zPeDyf7lOT/9tWZRuZhxqtdE/hAhnlMGMUL1nDMuv62SWXlAlKszFycf2yWlBTzWafNfjEPVEzJigEoZBdUYoVbm/FuqPgHWRP8Pg3yi/QjMhT496m2NHiy3N6wkKDkQu/IGob73sIaqRwkZzwC2g0qW88rARsdfo8hkV9tl/1PzLC5yQ7r/qdf65OaYZ10NxNd/B7yx87WfHzW8SwVgH57ASWswso7X6gU6tAFPTTdtYfk2LXifU/udsR8z8F6VSU1mYhzfb4wZ7YUbU2BvfjzBnV7LAIR1ZTARH3rugHDuJ0KViXQh/O0Q9Lmn0F9QoqkrNkRB86zwACj2mGhAXPTnwSzjsu49F+AdNOlQFrW6p+5Dwp3b0g+UE1g3ruCld3J2dLjTeG+qFxK5jXZZ7OdUGksmX9qMbHNYzXr5LdjwZZSvTmJKUwU+hT/8i28wNMi9SRQM1bCEjvkrlvb0ZaI="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "03347-0835-443c-84a7-496f8c11e6fc", "record_id": "flaws_cloudtrail:0000241:03347-0835-443c-84a7-496f8c11e6fc", "row_index": 241, "timestamp": "2019-08-15T21:23:54Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "lambda.amazonaws.com", "user_agent": "lambda.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/service-role/Level6"], "raw_record_size_bytes": 1615, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "03347-0835-443c-84a7-496f8c11e6fc", "eventTime": "2019-08-15T21:23:54Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "lambda.amazonaws.com", "userAgent": "lambda.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "lambda.amazonaws.com"}, "requestParameters": {"roleSessionName": "Level6", "roleArn": "arn:aws:iam::811596193553:role/service-role/Level6"}, "responseElements": {"credentials": {"accessKeyId": "ASIA9MH9IUJ3I1UWI9LY", "expiration": "Aug 16, 2019 9:23:54 AM", "sessionToken": "AgoJb3JpZ2luX2VjEJ7//////////wEaCXVzLXdlc3QtMiJHMEUCIDMeHGe7QjNTEuUoF0W7SSleICz+1RwhuyA9eLyLq3dEAiEA1bw2CJNV3SsccHoK4z0C9jzSDgCtLKBKbOeQqBg4tTsqggIINxAAGgw5NzU0MjYyNjIwMjkiDHffP/n3wxas3lzDUSrfAeY5Gpb3ZOpvXJUgMjZpaM1ekDCYVLW5idUJtfiFyHeiXBbAC4wnK3NLm0GeyLaU77UFry+hBQRQY7wDNJkH0Eovowy9jsvaiQASQD6krTsYASL9acbfKL8i4SzfO8iDJAYkcKpyrDs3j/9XtaO+qucbrqIRJW51COj4c71NI3IxSw8cipsFdwCiQoWUQyiVgglKFTE4Raa8UNdB6J/nqPrpacQr4zJUBJ5alKEZvLpJ3gTymSgqUh+7hHd8rs0SocqcUXgQWX5Ob4R9f2aYeZJuOpR6gXJ2AQXhIoaRWTsw6prX6gU6tAH1FDhg8nNY9Pa0fd4JUR9hh5Y2Czj+eqd8PQOA9xR+2A0zK4UJgXRijOfOVx5A8NbpgKYlyhHXXZotq6jNb2PcfhvlvYBMADIcyidTisWTxTAYgJV6bSUhgBTYAlInsELQSDNwVt5l/wfopzOXPTrgGOODWQpZG5H/AlE9gEz/md6Ct7GYMCbmt9XSc49UTrTJplvTP9zJnbnCqvWc+OKjr7jj6smKDWir782ENKJNtC+hsZA="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2e0e32d7-8efb-453b-b024-81e9ad3ecc73", "record_id": "flaws_cloudtrail:0000242:2e0e32d7-8efb-453b-b024-81e9ad3ecc73", "row_index": 242, "timestamp": "2019-08-15T21:23:54Z", "event_type": "CreateLogStream", "event_source": "logs.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "account_id": "811596193553", "principal_id": "AROAI4E1FBACLY3FPC6BB:Level6", "user_name": null, "access_key_id": "ASIAB3JH9U2JSTU1I5I7", "session_issuer_arn": "arn:aws:iam::811596193553:role/service-role/Level6", "session_issuer_user_name": "Level6"}, "network": {"source_ip": "32.113.86.251", "user_agent": "awslambda-worker", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1030, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2e0e32d7-8efb-453b-b024-81e9ad3ecc73", "eventTime": "2019-08-15T21:23:54Z", "eventName": "CreateLogStream", "eventSource": "logs.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "32.113.86.251", "userAgent": "awslambda-worker", "awsRegion": "us-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAI4E1FBACLY3FPC6BB:Level6", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "accountId": "811596193553", "accessKeyId": "ASIAB3JH9U2JSTU1I5I7", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-08-15T20:47:40Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAI4E1FBACLY3FPC6BB", "arn": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "userName": "Level6"}}}, "requestParameters": {"logStreamName": "2019/08/15/[$LATEST]0dc983645e6f6a827de76850b1321c00", "logGroupName": "/aws/lambda/Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "03347-0835-443c-84a7-496f8c11e6fc", "record_id": "flaws_cloudtrail:0000243:03347-0835-443c-84a7-496f8c11e6fc", "row_index": 243, "timestamp": "2019-08-15T21:23:54Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "lambda.amazonaws.com", "user_agent": "lambda.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/service-role/Level6"], "raw_record_size_bytes": 1615, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "03347-0835-443c-84a7-496f8c11e6fc", "eventTime": "2019-08-15T21:23:54Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "lambda.amazonaws.com", "userAgent": "lambda.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "lambda.amazonaws.com"}, "requestParameters": {"roleSessionName": "Level6", "roleArn": "arn:aws:iam::811596193553:role/service-role/Level6"}, "responseElements": {"credentials": {"accessKeyId": "ASIA9MH9IUJ3I1UWI9LY", "expiration": "Aug 16, 2019 9:23:54 AM", "sessionToken": "AgoJb3JpZ2luX2VjEJ7//////////wEaCXVzLXdlc3QtMiJHMEUCIDMeHGe7QjNTEuUoF0W7SSleICz+1RwhuyA9eLyLq3dEAiEA1bw2CJNV3SsccHoK4z0C9jzSDgCtLKBKbOeQqBg4tTsqggIINxAAGgw5NzU0MjYyNjIwMjkiDHffP/n3wxas3lzDUSrfAeY5Gpb3ZOpvXJUgMjZpaM1ekDCYVLW5idUJtfiFyHeiXBbAC4wnK3NLm0GeyLaU77UFry+hBQRQY7wDNJkH0Eovowy9jsvaiQASQD6krTsYASL9acbfKL8i4SzfO8iDJAYkcKpyrDs3j/9XtaO+qucbrqIRJW51COj4c71NI3IxSw8cipsFdwCiQoWUQyiVgglKFTE4Raa8UNdB6J/nqPrpacQr4zJUBJ5alKEZvLpJ3gTymSgqUh+7hHd8rs0SocqcUXgQWX5Ob4R9f2aYeZJuOpR6gXJ2AQXhIoaRWTsw6prX6gU6tAH1FDhg8nNY9Pa0fd4JUR9hh5Y2Czj+eqd8PQOA9xR+2A0zK4UJgXRijOfOVx5A8NbpgKYlyhHXXZotq6jNb2PcfhvlvYBMADIcyidTisWTxTAYgJV6bSUhgBTYAlInsELQSDNwVt5l/wfopzOXPTrgGOODWQpZG5H/AlE9gEz/md6Ct7GYMCbmt9XSc49UTrTJplvTP9zJnbnCqvWc+OKjr7jj6smKDWir782ENKJNtC+hsZA="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2e0e32d7-8efb-453b-b024-81e9ad3ecc73", "record_id": "flaws_cloudtrail:0000244:2e0e32d7-8efb-453b-b024-81e9ad3ecc73", "row_index": 244, "timestamp": "2019-08-15T21:23:54Z", "event_type": "CreateLogStream", "event_source": "logs.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "account_id": "811596193553", "principal_id": "AROAI4E1FBACLY3FPC6BB:Level6", "user_name": null, "access_key_id": "ASIAB3JH9U2JSTU1I5I7", "session_issuer_arn": "arn:aws:iam::811596193553:role/service-role/Level6", "session_issuer_user_name": "Level6"}, "network": {"source_ip": "32.113.86.251", "user_agent": "awslambda-worker", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1030, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2e0e32d7-8efb-453b-b024-81e9ad3ecc73", "eventTime": "2019-08-15T21:23:54Z", "eventName": "CreateLogStream", "eventSource": "logs.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "32.113.86.251", "userAgent": "awslambda-worker", "awsRegion": "us-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAI4E1FBACLY3FPC6BB:Level6", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "accountId": "811596193553", "accessKeyId": "ASIAB3JH9U2JSTU1I5I7", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-08-15T20:47:40Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAI4E1FBACLY3FPC6BB", "arn": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "userName": "Level6"}}}, "requestParameters": {"logStreamName": "2019/08/15/[$LATEST]0dc983645e6f6a827de76850b1321c00", "logGroupName": "/aws/lambda/Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3c2c67d4-5a34-4e19-9ec0-11e4f6c80fc0", "record_id": "flaws_cloudtrail:0000245:3c2c67d4-5a34-4e19-9ec0-11e4f6c80fc0", "row_index": 245, "timestamp": "2019-08-15T21:57:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1883, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3c2c67d4-5a34-4e19-9ec0-11e4f6c80fc0", "eventTime": "2019-08-15T21:57:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIAZ85FY38OI0Y7B5NL", "expiration": "Aug 16, 2019 4:22:38 AM", "sessionToken": "AgoJb3JpZ2luX2VjEJ7//////////wEaCXVzLXdlc3QtMiJHMEUCIQDk1YYTREcld8+fLRPLMDLXZgrEqWrc0rnQFWezuA7KuQIgC+fVU/gw4vUvs7emv09QEMDqklGk+cxv9NtiPZmGxdgq2gMINxAAGgw5NzU0MjYyNjIwMjkiDLVDn1YKMZU/ZfkaiCq3A2BmORiuhvlhocUKfKLw4IsJnD/D7vpHDFOemLPkOtgj3ZPr21Rp0i/hexu5dAwS3J94ib3nUkw+1D/3znQFDPpy3PDD0MewdKUh7a0V4Ci1Nt/mkul/KBEnrlwgaWDmnYAGLqtC9ztDzemhx/+XstZb0NhooDKtYA3fXBwm0o64bqneoEnzlOXVGcZdGaUHh/OMjCoWANVS8gu3bV2TOJkFHR0yFIBtmo5fNcLf4qDgVO7aDqh6za3dHBT7dVgOBAqYDAXuxWP38ZIBxD+UJMZKH8Mt6aSgCgRU148z9Wnb3Pvu0qsJNJWJtjqxVhHNwTZIwDfyCE98fjyx2C8qsum/JBh8QtgXKoXzZv8vFP0zKMzg5iEEOvqnFPUnc++fylne9Ikp5arrQ/2mlzPmRtxRdRgFo6GDdltjvL1eUcAkNC7tUPrRxmqIujNbd1qxjT4FHgikD1obizo54RJWvYGOkFDLHaIEsbWJIh0+qyE6cqS4TYBNIXQ8nB5pd+8cfAKUOi55Y4sgleI5Jg5QFw0YQ9U8hSpEVj8gUsnq5SyOuAEeCVWWr3i9hlwMClIo+8iJ6tc0svowwqrX6gU6tAFJ8PHzReRodMTdJg9WEKO38ftKniauUmhgLRrxS0MqrpsiEHX7VamMWh9Py+JLn2/vB3p0Bt7Bsd36ojyLq1wc4s2XX2onyiVrzf0SNhKlycPUxnCiSviNcjYyq03blD5WKEEmmhRdBtn8myDhqpxsjOdfXOf1iLirSVko5L3grSlmAEjQMR4C6xms3AgCGhW5Qwli687+jzX9fzStPObhJl2ManZMiP+G9QHtNLeamPdOihE="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3c2c67d4-5a34-4e19-9ec0-11e4f6c80fc0", "record_id": "flaws_cloudtrail:0000246:3c2c67d4-5a34-4e19-9ec0-11e4f6c80fc0", "row_index": 246, "timestamp": "2019-08-15T21:57:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1883, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3c2c67d4-5a34-4e19-9ec0-11e4f6c80fc0", "eventTime": "2019-08-15T21:57:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIAZ85FY38OI0Y7B5NL", "expiration": "Aug 16, 2019 4:22:38 AM", "sessionToken": "AgoJb3JpZ2luX2VjEJ7//////////wEaCXVzLXdlc3QtMiJHMEUCIQDk1YYTREcld8+fLRPLMDLXZgrEqWrc0rnQFWezuA7KuQIgC+fVU/gw4vUvs7emv09QEMDqklGk+cxv9NtiPZmGxdgq2gMINxAAGgw5NzU0MjYyNjIwMjkiDLVDn1YKMZU/ZfkaiCq3A2BmORiuhvlhocUKfKLw4IsJnD/D7vpHDFOemLPkOtgj3ZPr21Rp0i/hexu5dAwS3J94ib3nUkw+1D/3znQFDPpy3PDD0MewdKUh7a0V4Ci1Nt/mkul/KBEnrlwgaWDmnYAGLqtC9ztDzemhx/+XstZb0NhooDKtYA3fXBwm0o64bqneoEnzlOXVGcZdGaUHh/OMjCoWANVS8gu3bV2TOJkFHR0yFIBtmo5fNcLf4qDgVO7aDqh6za3dHBT7dVgOBAqYDAXuxWP38ZIBxD+UJMZKH8Mt6aSgCgRU148z9Wnb3Pvu0qsJNJWJtjqxVhHNwTZIwDfyCE98fjyx2C8qsum/JBh8QtgXKoXzZv8vFP0zKMzg5iEEOvqnFPUnc++fylne9Ikp5arrQ/2mlzPmRtxRdRgFo6GDdltjvL1eUcAkNC7tUPrRxmqIujNbd1qxjT4FHgikD1obizo54RJWvYGOkFDLHaIEsbWJIh0+qyE6cqS4TYBNIXQ8nB5pd+8cfAKUOi55Y4sgleI5Jg5QFw0YQ9U8hSpEVj8gUsnq5SyOuAEeCVWWr3i9hlwMClIo+8iJ6tc0svowwqrX6gU6tAFJ8PHzReRodMTdJg9WEKO38ftKniauUmhgLRrxS0MqrpsiEHX7VamMWh9Py+JLn2/vB3p0Bt7Bsd36ojyLq1wc4s2XX2onyiVrzf0SNhKlycPUxnCiSviNcjYyq03blD5WKEEmmhRdBtn8myDhqpxsjOdfXOf1iLirSVko5L3grSlmAEjQMR4C6xms3AgCGhW5Qwli687+jzX9fzStPObhJl2ManZMiP+G9QHtNLeamPdOihE="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9e30553-e5a0-42dd-9e56-8821a2d83462", "record_id": "flaws_cloudtrail:0000247:9e30553-e5a0-42dd-9e56-8821a2d83462", "row_index": 247, "timestamp": "2019-08-15T22:57:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1881, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9e30553-e5a0-42dd-9e56-8821a2d83462", "eventTime": "2019-08-15T22:57:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIA8Z7SPFG6UOG6KB0J", "expiration": "Aug 16, 2019 5:14:58 AM", "sessionToken": "AgoJb3JpZ2luX2VjEJ///////////wEaCXVzLXdlc3QtMiJHMEUCIQDbkgWyNwfNBhbcYwquYHmo3LUpM5Yu88ogbUmlz+1gwgIgdO7XhEWExesIAFaNnRcIJwwBO1xqW0M63fDsQkF4T0Eq2gMIOBAAGgw5NzU0MjYyNjIwMjkiDOJHPEz94iUN8+Hu3Sq3A0WVhCYwcr7ll9e170uS6BZInvGG/QdnQ+2yxQnew3+cGHaThSQbcwso5ffTPuJON8knqjCnjooLgMpf5L5uLPQvDkuuQmNflqJ8bWARu2kgCcBaypLkqJ3fR2mEyIKpbOwOr1JcPFjmuG3fZDXuKzSJSw6pAtbIolI4l4W2xrZ5zUaTjJ3JpSRN85njLTZONMk/PItL9wrXwxvn0XNbn6JwgBdzz8K9JlF477F7e9U48ZKm/Ai470KPStbcsU4XNzB5GCnCphfklSiptWYq1Ep4z3jnsgK342g8FIjKUaCbElasmvHPPVszz3ngk8/VLoNSHdfKpJbo6rjesBs9RgW6LHgG9UcCyQki/xxgMeOXw6ac/TsArRjYI6wwr7grQHMFO1uR769YIbqRFylkO0/VB5vQJDNCCQ+4xlj42KxSMwGphYIdbdENlCCGilS6UN037UzZfmLmWCPD9V15KOolMVfSt3XeqTP4KTSWw7lKgz5dlCvOHMLE6dVRFh19Ou8fbgA0JpYVtC1505HQ6IxV8tLbk1USdEIQVN+BNxKuJprJ3I4GNjlirfi2tWJGBA3ss+vRHWsw0sbX6gU6tAHpcsXR87J2o1Pt2NIECkvVpH7pPVAY1M9HeTkVSkb8zqDtooZQ5JXThkQyO33FXEuwoQELu2Vh3Ww6yRNtEefN/qlm2iHNO6gGw1QrRfT2tACUi9eaEb8vdK73ZDf2wDP3opVpNqR7heBZp4kTcxs4IVLEoS/QIs1m7Ceq+n0bsZOnOqXQjXqqGDdUohDZ/OPdpsiqdIqtS1+uiByZ/JCe0oPiXHmURp7mbF4BycnVIwgHKEc="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9e30553-e5a0-42dd-9e56-8821a2d83462", "record_id": "flaws_cloudtrail:0000248:9e30553-e5a0-42dd-9e56-8821a2d83462", "row_index": 248, "timestamp": "2019-08-15T22:57:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1881, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9e30553-e5a0-42dd-9e56-8821a2d83462", "eventTime": "2019-08-15T22:57:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIA8Z7SPFG6UOG6KB0J", "expiration": "Aug 16, 2019 5:14:58 AM", "sessionToken": "AgoJb3JpZ2luX2VjEJ///////////wEaCXVzLXdlc3QtMiJHMEUCIQDbkgWyNwfNBhbcYwquYHmo3LUpM5Yu88ogbUmlz+1gwgIgdO7XhEWExesIAFaNnRcIJwwBO1xqW0M63fDsQkF4T0Eq2gMIOBAAGgw5NzU0MjYyNjIwMjkiDOJHPEz94iUN8+Hu3Sq3A0WVhCYwcr7ll9e170uS6BZInvGG/QdnQ+2yxQnew3+cGHaThSQbcwso5ffTPuJON8knqjCnjooLgMpf5L5uLPQvDkuuQmNflqJ8bWARu2kgCcBaypLkqJ3fR2mEyIKpbOwOr1JcPFjmuG3fZDXuKzSJSw6pAtbIolI4l4W2xrZ5zUaTjJ3JpSRN85njLTZONMk/PItL9wrXwxvn0XNbn6JwgBdzz8K9JlF477F7e9U48ZKm/Ai470KPStbcsU4XNzB5GCnCphfklSiptWYq1Ep4z3jnsgK342g8FIjKUaCbElasmvHPPVszz3ngk8/VLoNSHdfKpJbo6rjesBs9RgW6LHgG9UcCyQki/xxgMeOXw6ac/TsArRjYI6wwr7grQHMFO1uR769YIbqRFylkO0/VB5vQJDNCCQ+4xlj42KxSMwGphYIdbdENlCCGilS6UN037UzZfmLmWCPD9V15KOolMVfSt3XeqTP4KTSWw7lKgz5dlCvOHMLE6dVRFh19Ou8fbgA0JpYVtC1505HQ6IxV8tLbk1USdEIQVN+BNxKuJprJ3I4GNjlirfi2tWJGBA3ss+vRHWsw0sbX6gU6tAHpcsXR87J2o1Pt2NIECkvVpH7pPVAY1M9HeTkVSkb8zqDtooZQ5JXThkQyO33FXEuwoQELu2Vh3Ww6yRNtEefN/qlm2iHNO6gGw1QrRfT2tACUi9eaEb8vdK73ZDf2wDP3opVpNqR7heBZp4kTcxs4IVLEoS/QIs1m7Ceq+n0bsZOnOqXQjXqqGDdUohDZ/OPdpsiqdIqtS1+uiByZ/JCe0oPiXHmURp7mbF4BycnVIwgHKEc="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d98b9acc-d19a-4bf2-b498-fc52af470a05", "record_id": "flaws_cloudtrail:0000249:d98b9acc-d19a-4bf2-b498-fc52af470a05", "row_index": 249, "timestamp": "2019-08-15T23:57:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1883, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d98b9acc-d19a-4bf2-b498-fc52af470a05", "eventTime": "2019-08-15T23:57:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIAYZDII3CCA6NRT0US", "expiration": "Aug 16, 2019 6:27:17 AM", "sessionToken": "AgoJb3JpZ2luX2VjEKD//////////wEaCXVzLXdlc3QtMiJHMEUCIQCw7FQbWv8rDbe4HaU1ruw4aLC6zclv0TdPmiWTex0KkQIgIzoOvDh6WiWb85YLCMTsMTGOvmAA2OlMNsK2l3wqZ78q2gMIORAAGgw5NzU0MjYyNjIwMjkiDPujz4uSsRFTHFfY7iq3A6bJV0EiKd4gb5IQlCBrRVwnJxmdP3nJvfOFgPnHIgY8Kz461bGu8wLmeZllJa5aFCLJIJNns/ktLhlchNBA5H1Jkku/XuveG6wJNLsduwneVUPoybbyiD71FP2lYmkR7jBXxhNzKNXXhCY9fF0fI4A+RShorHrxdicvVXEPSTF7m9Ceb95RUIHIYPwDH8MxQQEgaE56wnKFzqjQ7ACGoD04L0cb9OIat1WJDfVPbJ2XD4YUFDnr7JhTklVyIsRRcgLZyBvjFo/LzTUS4ym6wg+HSeRwMBtw+6cWPs2lXMF2ki9k25KaJ2XmmRi7mrnNyLIJoLXkwcvTIKv1Gk3MSExzYZiOMyPSJKtsxI2b4g7adM4l0u8NMCl7USdYODSQE21h8eUeGjG4fwVMHBEBcfHL6v4KvoFkaZs/hb9Q+YU0LIXwhaXzikZ82WpREJGsPfSsqqSi2VO5RjQE26xfvGsxyufwTYQRar5pBDk4lzqbCKpoqESxEKjH6e/bTUfseXBfsIjQZsZZdNnSxCW5K00ZSPZMKb+0GqU4XVc9ZWoLARpZJYx7oyqc3PzYpL/5rHo5/Fo3B7Qw4uLX6gU6tAFQ0xd1aSDA60WNPbfur7djGYlXz16PHogKhWoQWbeQe28FGiHvOOAn8totC38uj9IRwEj+zq1t3d0Wj5ELB4aXv8bje0DhL4yrvcaVdEO77Bq66VzHHXoNH2ED5hNfbew9a71ZX0fMeym7pKbLM50e4LHHHQA0HDmqldi9Ug+HE6ibUB+0O9Fmkulg1dwNw9gjdMxxtVpUSb1q4EMlQ0UfRjv1Nkt35Z00wf1ouKdi/JGEXsc="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d98b9acc-d19a-4bf2-b498-fc52af470a05", "record_id": "flaws_cloudtrail:0000250:d98b9acc-d19a-4bf2-b498-fc52af470a05", "row_index": 250, "timestamp": "2019-08-15T23:57:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1883, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d98b9acc-d19a-4bf2-b498-fc52af470a05", "eventTime": "2019-08-15T23:57:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIAYZDII3CCA6NRT0US", "expiration": "Aug 16, 2019 6:27:17 AM", "sessionToken": "AgoJb3JpZ2luX2VjEKD//////////wEaCXVzLXdlc3QtMiJHMEUCIQCw7FQbWv8rDbe4HaU1ruw4aLC6zclv0TdPmiWTex0KkQIgIzoOvDh6WiWb85YLCMTsMTGOvmAA2OlMNsK2l3wqZ78q2gMIORAAGgw5NzU0MjYyNjIwMjkiDPujz4uSsRFTHFfY7iq3A6bJV0EiKd4gb5IQlCBrRVwnJxmdP3nJvfOFgPnHIgY8Kz461bGu8wLmeZllJa5aFCLJIJNns/ktLhlchNBA5H1Jkku/XuveG6wJNLsduwneVUPoybbyiD71FP2lYmkR7jBXxhNzKNXXhCY9fF0fI4A+RShorHrxdicvVXEPSTF7m9Ceb95RUIHIYPwDH8MxQQEgaE56wnKFzqjQ7ACGoD04L0cb9OIat1WJDfVPbJ2XD4YUFDnr7JhTklVyIsRRcgLZyBvjFo/LzTUS4ym6wg+HSeRwMBtw+6cWPs2lXMF2ki9k25KaJ2XmmRi7mrnNyLIJoLXkwcvTIKv1Gk3MSExzYZiOMyPSJKtsxI2b4g7adM4l0u8NMCl7USdYODSQE21h8eUeGjG4fwVMHBEBcfHL6v4KvoFkaZs/hb9Q+YU0LIXwhaXzikZ82WpREJGsPfSsqqSi2VO5RjQE26xfvGsxyufwTYQRar5pBDk4lzqbCKpoqESxEKjH6e/bTUfseXBfsIjQZsZZdNnSxCW5K00ZSPZMKb+0GqU4XVc9ZWoLARpZJYx7oyqc3PzYpL/5rHo5/Fo3B7Qw4uLX6gU6tAFQ0xd1aSDA60WNPbfur7djGYlXz16PHogKhWoQWbeQe28FGiHvOOAn8totC38uj9IRwEj+zq1t3d0Wj5ELB4aXv8bje0DhL4yrvcaVdEO77Bq66VzHHXoNH2ED5hNfbew9a71ZX0fMeym7pKbLM50e4LHHHQA0HDmqldi9Ug+HE6ibUB+0O9Fmkulg1dwNw9gjdMxxtVpUSb1q4EMlQ0UfRjv1Nkt35Z00wf1ouKdi/JGEXsc="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "26c912e4-6aec-4463-84af-8434f8c7b9c9", "record_id": "flaws_cloudtrail:0000251:26c912e4-6aec-4463-84af-8434f8c7b9c9", "row_index": 251, "timestamp": "2019-08-16T00:26:49Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "config.amazonaws.com", "user_agent": "config.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/service-role/config-role-us-west-2"], "raw_record_size_bytes": 1938, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "26c912e4-6aec-4463-84af-8434f8c7b9c9", "eventTime": "2019-08-16T00:26:49Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "config.amazonaws.com", "userAgent": "config.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "config.amazonaws.com"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/service-role/config-role-us-west-2", "roleSessionName": "AWSConfig"}, "responseElements": {"credentials": {"accessKeyId": "ASIA8B7V1BOTDMB6FVFN", "expiration": "Aug 16, 2019 1:26:49 AM", "sessionToken": "AgoJb3JpZ2luX2VjEKH//////////wEaCXVzLXdlc3QtMiJHMEUCIQCiu8rahyjylHl8R3UfUVwPRpNl/godjCjZXDNsou/v/wIgDi7A5UqbQSZ55C5DHRWEMfiZRJYKaiua1HJWkZ7Rvkoq6AIIOhAAGgw5NzU0MjYyNjIwMjkiDLAoT6ZLSPy+TNJqvirFApezSwe5kIPLUiu4kB63k0CPPbkbRXriaXAq22JfmW+MSjGT19kZs8mMRe02tae+Q+PBKjVM48Bg6ggJ5t+45pg47VFncBsECbW3atOzEUTDmanMEFpxsbLepqj0kSpG7Mnty1Zva11Z6UQ9+xgslDb0ZRK/rTZ4mm2th0ryHLUu9DOOc9dNOslBBF5nP5d7e4x017PtQ6LSXuxND7PoNk2MjFAdKP6Xd7ucD2YR/00Qj0idVPxh2JuAYE4UhHGqLOwgfJ3L36+Jjl//zXl3fIDpTzdkozqE2kL9kgb8pIlnO5V7KkhGGKQLnk44t4aDeoSLjCt+g44TVfvuFbIJH2fYOZ6RbjJfz4Dya4BUmYonw2JJwhObTokxEnGigWQ5Uy9NxMxV46BgR+f+v/jPdTSENf/GFP4eNA+4AJ7+iTNaQ8ZAf1gwyfDX6gU6tAFeIdbJbnOCVtotz3efncgqgXauOpEtTdBTwXRHSEHJdZfgPGh+3sYaT006ro7hQd6TCGbbbXO0+dfu3b6yOc0Tw6M6AFg1kpMn+sTJqEP62ASU58joos4GOoSz7GAfAIWU+sutZCSzAdnZ0IBuuKloFeos/BV+ypVaza4fBTZA0kZ1hB+myBPlCfwBrcmPanQSdtPEr58KpT8+FChFeTrBW3ZXQTcxm471LXCz61eEnq869435="}, "assumedRoleUser": {"assumedRoleId": "AROASM3HWKK95VDO4HH81:AWSConfig", "arn": "arn:aws:sts::811596193553:assumed-role/config-role-us-west-2/AWSConfig"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/service-role/config-role-us-west-2", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "26c912e4-6aec-4463-84af-8434f8c7b9c9", "record_id": "flaws_cloudtrail:0000252:26c912e4-6aec-4463-84af-8434f8c7b9c9", "row_index": 252, "timestamp": "2019-08-16T00:26:49Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "config.amazonaws.com", "user_agent": "config.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/service-role/config-role-us-west-2"], "raw_record_size_bytes": 1938, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "26c912e4-6aec-4463-84af-8434f8c7b9c9", "eventTime": "2019-08-16T00:26:49Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "config.amazonaws.com", "userAgent": "config.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "config.amazonaws.com"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/service-role/config-role-us-west-2", "roleSessionName": "AWSConfig"}, "responseElements": {"credentials": {"accessKeyId": "ASIA8B7V1BOTDMB6FVFN", "expiration": "Aug 16, 2019 1:26:49 AM", "sessionToken": "AgoJb3JpZ2luX2VjEKH//////////wEaCXVzLXdlc3QtMiJHMEUCIQCiu8rahyjylHl8R3UfUVwPRpNl/godjCjZXDNsou/v/wIgDi7A5UqbQSZ55C5DHRWEMfiZRJYKaiua1HJWkZ7Rvkoq6AIIOhAAGgw5NzU0MjYyNjIwMjkiDLAoT6ZLSPy+TNJqvirFApezSwe5kIPLUiu4kB63k0CPPbkbRXriaXAq22JfmW+MSjGT19kZs8mMRe02tae+Q+PBKjVM48Bg6ggJ5t+45pg47VFncBsECbW3atOzEUTDmanMEFpxsbLepqj0kSpG7Mnty1Zva11Z6UQ9+xgslDb0ZRK/rTZ4mm2th0ryHLUu9DOOc9dNOslBBF5nP5d7e4x017PtQ6LSXuxND7PoNk2MjFAdKP6Xd7ucD2YR/00Qj0idVPxh2JuAYE4UhHGqLOwgfJ3L36+Jjl//zXl3fIDpTzdkozqE2kL9kgb8pIlnO5V7KkhGGKQLnk44t4aDeoSLjCt+g44TVfvuFbIJH2fYOZ6RbjJfz4Dya4BUmYonw2JJwhObTokxEnGigWQ5Uy9NxMxV46BgR+f+v/jPdTSENf/GFP4eNA+4AJ7+iTNaQ8ZAf1gwyfDX6gU6tAFeIdbJbnOCVtotz3efncgqgXauOpEtTdBTwXRHSEHJdZfgPGh+3sYaT006ro7hQd6TCGbbbXO0+dfu3b6yOc0Tw6M6AFg1kpMn+sTJqEP62ASU58joos4GOoSz7GAfAIWU+sutZCSzAdnZ0IBuuKloFeos/BV+ypVaza4fBTZA0kZ1hB+myBPlCfwBrcmPanQSdtPEr58KpT8+FChFeTrBW3ZXQTcxm471LXCz61eEnq869435="}, "assumedRoleUser": {"assumedRoleId": "AROASM3HWKK95VDO4HH81:AWSConfig", "arn": "arn:aws:sts::811596193553:assumed-role/config-role-us-west-2/AWSConfig"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/service-role/config-role-us-west-2", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b5a97a78-9832-45f8-ac07-3536e29a7a33", "record_id": "flaws_cloudtrail:0000253:b5a97a78-9832-45f8-ac07-3536e29a7a33", "row_index": 253, "timestamp": "2019-08-16T00:57:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1881, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b5a97a78-9832-45f8-ac07-3536e29a7a33", "eventTime": "2019-08-16T00:57:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIAP8H453V8OYOYYMKS", "expiration": "Aug 16, 2019 7:31:10 AM", "sessionToken": "AgoJb3JpZ2luX2VjEKH//////////wEaCXVzLXdlc3QtMiJHMEUCIQC5l1ykQV4Dj72D/95j26fnbrJFYv1PCLbhIbiAFEmZPgIgBuzXRJfW8JHFrIbkWlJeSYeOUb6F0Dv1vTaV3YpMR8wq2gMIOhAAGgw5NzU0MjYyNjIwMjkiDC9g14FriqFIn0K5Qiq3A2YaApn07rccxnPgAdG5LgNhiRGM/dTYH9xwuTSXnOz+sOezG45bkduNp/BOtFB2lVTdJ/EjpNi2VyMa2cOepWireXYWPQbgeTKLpO6kEI/Fm2rQEblJv9w+JuOuszVASU/NMuYfPxQEhi06rIBJfnx9sDNN1GWz6elSTHfa2OoexaIuoOmzSB8JNe/Zso85yaRvi9CvI/IhCI5tPvF+725590YI1q1utUILp7NhevLUB9KJGTlp/cDWexhUHq3nW9x2ZrJquD9Ud5go7MVmmlp51wo93UlNyWAI+QODRQC5ztjm8+jNt+V/2eMhb7TbxxT0ipcFrB9xqf1JqHfftTTGh6LJYjiSQXXCDqFEHnmGfYDXAPN7LFBbdPfOjO7ieZ1V2l58Zu4wrgMF9Yo/+vRxS/idEwLBebijE5LPqSZoX4cJ1tqbVADnaPBKuR7Tk3hLsSTO5+s75p64vP5gAFXfYRT2kSPTn5V85zAYwcQfH2SN99HTPLdEwLTtsLHmHVQBRn6Ls+Vmo1zJew4FLg+VmB6DisLAvyYAnkCH9COOQNlXCu5UydbNV9di6s6ihoTd7f8W3dCIw8v7X6gU6tAEZKZdHEqmg+OvFGsvLAgWsAmCPkJUj93q+3V5WIEliVnABo0sCd6YULpQL2yli8izZBka60RbhCsLZJLmnsZCYHixLEwkhtDqFI40N3OPsQ6Dbd+TS5td9IATOE2WaG6AV5pdK3UUs0T76iC19ZYRR4kPIqPXJBmnscwOqQvx2rglCvnIf1KIIS5Waw/e1EZ20rQOwmYAAjtAH52Cok4Da/A0GU4TMUyZvFeAiG9G0MZlG/R8="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b5a97a78-9832-45f8-ac07-3536e29a7a33", "record_id": "flaws_cloudtrail:0000254:b5a97a78-9832-45f8-ac07-3536e29a7a33", "row_index": 254, "timestamp": "2019-08-16T00:57:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1881, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b5a97a78-9832-45f8-ac07-3536e29a7a33", "eventTime": "2019-08-16T00:57:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIAP8H453V8OYOYYMKS", "expiration": "Aug 16, 2019 7:31:10 AM", "sessionToken": "AgoJb3JpZ2luX2VjEKH//////////wEaCXVzLXdlc3QtMiJHMEUCIQC5l1ykQV4Dj72D/95j26fnbrJFYv1PCLbhIbiAFEmZPgIgBuzXRJfW8JHFrIbkWlJeSYeOUb6F0Dv1vTaV3YpMR8wq2gMIOhAAGgw5NzU0MjYyNjIwMjkiDC9g14FriqFIn0K5Qiq3A2YaApn07rccxnPgAdG5LgNhiRGM/dTYH9xwuTSXnOz+sOezG45bkduNp/BOtFB2lVTdJ/EjpNi2VyMa2cOepWireXYWPQbgeTKLpO6kEI/Fm2rQEblJv9w+JuOuszVASU/NMuYfPxQEhi06rIBJfnx9sDNN1GWz6elSTHfa2OoexaIuoOmzSB8JNe/Zso85yaRvi9CvI/IhCI5tPvF+725590YI1q1utUILp7NhevLUB9KJGTlp/cDWexhUHq3nW9x2ZrJquD9Ud5go7MVmmlp51wo93UlNyWAI+QODRQC5ztjm8+jNt+V/2eMhb7TbxxT0ipcFrB9xqf1JqHfftTTGh6LJYjiSQXXCDqFEHnmGfYDXAPN7LFBbdPfOjO7ieZ1V2l58Zu4wrgMF9Yo/+vRxS/idEwLBebijE5LPqSZoX4cJ1tqbVADnaPBKuR7Tk3hLsSTO5+s75p64vP5gAFXfYRT2kSPTn5V85zAYwcQfH2SN99HTPLdEwLTtsLHmHVQBRn6Ls+Vmo1zJew4FLg+VmB6DisLAvyYAnkCH9COOQNlXCu5UydbNV9di6s6ihoTd7f8W3dCIw8v7X6gU6tAEZKZdHEqmg+OvFGsvLAgWsAmCPkJUj93q+3V5WIEliVnABo0sCd6YULpQL2yli8izZBka60RbhCsLZJLmnsZCYHixLEwkhtDqFI40N3OPsQ6Dbd+TS5td9IATOE2WaG6AV5pdK3UUs0T76iC19ZYRR4kPIqPXJBmnscwOqQvx2rglCvnIf1KIIS5Waw/e1EZ20rQOwmYAAjtAH52Cok4Da/A0GU4TMUyZvFeAiG9G0MZlG/R8="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "db7c12e5-0e6d-40ed-a72c-2439870d4a58", "record_id": "flaws_cloudtrail:0000255:db7c12e5-0e6d-40ed-a72c-2439870d4a58", "row_index": 255, "timestamp": "2019-08-16T01:44:33Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIAA9PEBITMHWKDVUS9", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "210.35.53.53", "user_agent": "Boto3/1.18.4 Python/3.9.6 Linux/5.10.0-8-amd64 Botocore/1.21.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 512, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "db7c12e5-0e6d-40ed-a72c-2439870d4a58", "eventTime": "2019-08-16T01:44:33Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "210.35.53.53", "userAgent": "Boto3/1.18.4 Python/3.9.6 Linux/5.10.0-8-amd64 Botocore/1.21.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIAA9PEBITMHWKDVUS9", "userName": "backup"}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b8f3ccb1-bddb-4bb9-94d6-c4415c855587", "record_id": "flaws_cloudtrail:0000256:b8f3ccb1-bddb-4bb9-94d6-c4415c855587", "row_index": 256, "timestamp": "2019-08-16T01:45:28Z", "event_type": "ListUsers", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIAA9PEBITMHWKDVUS9", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "210.35.53.53", "user_agent": "Boto3/1.18.4 Python/3.9.6 Linux/5.10.0-8-amd64 Botocore/1.21.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 541, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b8f3ccb1-bddb-4bb9-94d6-c4415c855587", "eventTime": "2019-08-16T01:45:28Z", "eventName": "ListUsers", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "210.35.53.53", "userAgent": "Boto3/1.18.4 Python/3.9.6 Linux/5.10.0-8-amd64 Botocore/1.21.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIAA9PEBITMHWKDVUS9", "userName": "backup"}, "requestParameters": {"maxItems": 100}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "60255093-61f9-455d-babd-a4010ae1c512", "record_id": "flaws_cloudtrail:0000257:60255093-61f9-455d-babd-a4010ae1c512", "row_index": 257, "timestamp": "2019-08-16T01:46:08Z", "event_type": "ListRoles", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIAA9PEBITMHWKDVUS9", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "210.35.53.53", "user_agent": "Boto3/1.18.4 Python/3.9.6 Linux/5.10.0-8-amd64 Botocore/1.21.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 541, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "60255093-61f9-455d-babd-a4010ae1c512", "eventTime": "2019-08-16T01:46:08Z", "eventName": "ListRoles", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "210.35.53.53", "userAgent": "Boto3/1.18.4 Python/3.9.6 Linux/5.10.0-8-amd64 Botocore/1.21.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIAA9PEBITMHWKDVUS9", "userName": "backup"}, "requestParameters": {"maxItems": 100}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a25bde9c-6a86-4828-8d7d-43fbe2485585", "record_id": "flaws_cloudtrail:0000258:a25bde9c-6a86-4828-8d7d-43fbe2485585", "row_index": 258, "timestamp": "2019-08-16T01:47:24Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIAA9PEBITMHWKDVUS9", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "210.35.53.53", "user_agent": "Boto3/1.18.4 Python/3.9.6 Linux/5.10.0-8-amd64 Botocore/1.21.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 544, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a25bde9c-6a86-4828-8d7d-43fbe2485585", "eventTime": "2019-08-16T01:47:24Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "210.35.53.53", "userAgent": "Boto3/1.18.4 Python/3.9.6 Linux/5.10.0-8-amd64 Botocore/1.21.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIAA9PEBITMHWKDVUS9", "userName": "backup"}, "requestParameters": {"maxItems": 100}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c6107e01-f625-46d4-8edf-e42dab28f0f4", "record_id": "flaws_cloudtrail:0000259:c6107e01-f625-46d4-8edf-e42dab28f0f4", "row_index": 259, "timestamp": "2019-08-16T01:48:37Z", "event_type": "ListGroups", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIAA9PEBITMHWKDVUS9", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "210.35.53.53", "user_agent": "Boto3/1.18.4 Python/3.9.6 Linux/5.10.0-8-amd64 Botocore/1.21.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 542, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c6107e01-f625-46d4-8edf-e42dab28f0f4", "eventTime": "2019-08-16T01:48:37Z", "eventName": "ListGroups", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "210.35.53.53", "userAgent": "Boto3/1.18.4 Python/3.9.6 Linux/5.10.0-8-amd64 Botocore/1.21.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIAA9PEBITMHWKDVUS9", "userName": "backup"}, "requestParameters": {"maxItems": 100}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "56e5fb64-f447-4cb7-89f7-4f9e56fe5c1a", "record_id": "flaws_cloudtrail:0000260:56e5fb64-f447-4cb7-89f7-4f9e56fe5c1a", "row_index": 260, "timestamp": "2019-08-16T01:49:46Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIAA9PEBITMHWKDVUS9", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "210.35.53.53", "user_agent": "Boto3/1.18.4 Python/3.9.6 Linux/5.10.0-8-amd64 Botocore/1.21.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 512, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "56e5fb64-f447-4cb7-89f7-4f9e56fe5c1a", "eventTime": "2019-08-16T01:49:46Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "210.35.53.53", "userAgent": "Boto3/1.18.4 Python/3.9.6 Linux/5.10.0-8-amd64 Botocore/1.21.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIAA9PEBITMHWKDVUS9", "userName": "backup"}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d80f3816-6d7f-4572-9004-f966eed77630", "record_id": "flaws_cloudtrail:0000261:d80f3816-6d7f-4572-9004-f966eed77630", "row_index": 261, "timestamp": "2019-08-16T01:50:29Z", "event_type": "DescribeVpcs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIAA9PEBITMHWKDVUS9", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "210.35.53.53", "user_agent": "Boto3/1.18.4 Python/3.9.6 Linux/5.10.0-8-amd64 Botocore/1.21.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 507, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d80f3816-6d7f-4572-9004-f966eed77630", "eventTime": "2019-08-16T01:50:29Z", "eventName": "DescribeVpcs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "210.35.53.53", "userAgent": "Boto3/1.18.4 Python/3.9.6 Linux/5.10.0-8-amd64 Botocore/1.21.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIAA9PEBITMHWKDVUS9", "userName": "backup"}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "49274da7-900b-45f6-be3d-722839917e32", "record_id": "flaws_cloudtrail:0000262:49274da7-900b-45f6-be3d-722839917e32", "row_index": 262, "timestamp": "2019-08-16T01:51:09Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIAA9PEBITMHWKDVUS9", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "210.35.53.53", "user_agent": "Boto3/1.18.4 Python/3.9.6 Linux/5.10.0-8-amd64 Botocore/1.21.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 517, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "49274da7-900b-45f6-be3d-722839917e32", "eventTime": "2019-08-16T01:51:09Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "210.35.53.53", "userAgent": "Boto3/1.18.4 Python/3.9.6 Linux/5.10.0-8-amd64 Botocore/1.21.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIAA9PEBITMHWKDVUS9", "userName": "backup"}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "310d2c6c-3f3c-4c44-b795-4cefbdd58b33", "record_id": "flaws_cloudtrail:0000263:310d2c6c-3f3c-4c44-b795-4cefbdd58b33", "row_index": 263, "timestamp": "2019-08-16T01:52:36Z", "event_type": "DescribeKeyPairs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIAA9PEBITMHWKDVUS9", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "210.35.53.53", "user_agent": "Boto3/1.18.4 Python/3.9.6 Linux/5.10.0-8-amd64 Botocore/1.21.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 511, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "310d2c6c-3f3c-4c44-b795-4cefbdd58b33", "eventTime": "2019-08-16T01:52:36Z", "eventName": "DescribeKeyPairs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "210.35.53.53", "userAgent": "Boto3/1.18.4 Python/3.9.6 Linux/5.10.0-8-amd64 Botocore/1.21.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIAA9PEBITMHWKDVUS9", "userName": "backup"}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "529b51ee-a37c-4999-a026-9aaeaad4b588", "record_id": "flaws_cloudtrail:0000264:529b51ee-a37c-4999-a026-9aaeaad4b588", "row_index": 264, "timestamp": "2019-08-16T01:53:37Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIAA9PEBITMHWKDVUS9", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "210.35.53.53", "user_agent": "Boto3/1.18.4 Python/3.9.6 Linux/5.10.0-8-amd64 Botocore/1.21.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 505, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "529b51ee-a37c-4999-a026-9aaeaad4b588", "eventTime": "2019-08-16T01:53:37Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "210.35.53.53", "userAgent": "Boto3/1.18.4 Python/3.9.6 Linux/5.10.0-8-amd64 Botocore/1.21.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIAA9PEBITMHWKDVUS9", "userName": "backup"}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c572fdfe-bcc7-47e8-b8c1-e19c00187a83", "record_id": "flaws_cloudtrail:0000265:c572fdfe-bcc7-47e8-b8c1-e19c00187a83", "row_index": 265, "timestamp": "2019-08-16T01:55:45Z", "event_type": "ListFunctions", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIAA9PEBITMHWKDVUS9", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "210.35.53.53", "user_agent": "Boto3/1.18.4 Python/3.9.6 Linux/5.10.0-8-amd64 Botocore/1.21.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 511, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c572fdfe-bcc7-47e8-b8c1-e19c00187a83", "eventTime": "2019-08-16T01:55:45Z", "eventName": "ListFunctions", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "210.35.53.53", "userAgent": "Boto3/1.18.4 Python/3.9.6 Linux/5.10.0-8-amd64 Botocore/1.21.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIAA9PEBITMHWKDVUS9", "userName": "backup"}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "43444ff6-9acf-497b-ae1e-b9f74b4ee2ae", "record_id": "flaws_cloudtrail:0000266:43444ff6-9acf-497b-ae1e-b9f74b4ee2ae", "row_index": 266, "timestamp": "2019-08-16T01:57:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1882, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "43444ff6-9acf-497b-ae1e-b9f74b4ee2ae", "eventTime": "2019-08-16T01:57:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIA0XPUHOBUIYF3HGDZ", "expiration": "Aug 16, 2019 8:20:08 AM", "sessionToken": "AgoJb3JpZ2luX2VjEKL//////////wEaCXVzLXdlc3QtMiJIMEYCIQCBDxBRGqMjuQxwCa7Km/n5Yh2Igi63Xjr2mngMzknh0AIhAMoMBzyQ9WHgfVLNwr+zk8bhzoSrzE2X2K/hfvfQudRIKtoDCDsQABoMOTc1NDI2MjYyMDI5IgyKl+xrhxp/2nuW1KcqtwM+H3JkBU0aUfmF1OUbfmouZX1CIAqKf6VNcYew+0yOIAx2NL/PBhmlrlJga4fvD6lfg8+o0Jh+9lUC6JBDH4uM+OnnvDs/VSN3bR09I/JeNRJfMARTLQA/sNDBAwpfIgvRsC64NUqjZ/CWvsYhH3HQxrqQBJXtoK78xeMSdUiSaLJYI5MxbaWb3ceQrA0P1kjsnZ2CAqyZa6qZ4fP6WP8JT0k1SIpoNEAuGWRafXSMV9FDtGZJ1fGEVe70PhKImhq7bRsgfgmXHv6PYGZzcf14rhA4Rnk6HXJO6gSx0xS36r/J4wq3mR15bI2hiWnXeA3Y8GV+OXErESHtSo0uE8xrwP4lzq2PJlw8GnA6dQhmOe7RCLb2yjOm9bnBzqMCRuRlYjs2bVMX9F3WJfdqcFSuBdEyKGh8hyoK0Smn4YUE7otojKHLl47jIlNrrBX0avLkoGTnnYix+kCRzPVQnjtiGWGM0xYkekmT4RbjGRjHndOks+HZSh/Q5DUiDxOtgdEu5yY20E5CTZlCxRVIYKvqqrhfPzwMfiRXgarXdPO8XJl+ynRpFT0Sw8FZU0LlY8lfoh/87RtEMIKb2OoFOrMBPGU5KSpe7U7vRnIg2yKDGg90EXE1FxIkiQ4b6OGjY52BiFjq7EldQMV4xeQtfHuYRcl0eOY+1WwthRsYJ2xmN7W3L13jFWkI8Y0kQswDm+B9lBBE76Su+t6GjzsdHBd+sm4xlI/QHhPBe7L/8QUslHL0+JDOiB6sFscAnvzrpv4DcpavKFqaCMMPBag5ePa3J1NWjPYPpMAeLwXyNDBe1SUoxrzqUAiY2RM2sjQMwILgJEc="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "43444ff6-9acf-497b-ae1e-b9f74b4ee2ae", "record_id": "flaws_cloudtrail:0000267:43444ff6-9acf-497b-ae1e-b9f74b4ee2ae", "row_index": 267, "timestamp": "2019-08-16T01:57:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1882, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "43444ff6-9acf-497b-ae1e-b9f74b4ee2ae", "eventTime": "2019-08-16T01:57:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIA0XPUHOBUIYF3HGDZ", "expiration": "Aug 16, 2019 8:20:08 AM", "sessionToken": "AgoJb3JpZ2luX2VjEKL//////////wEaCXVzLXdlc3QtMiJIMEYCIQCBDxBRGqMjuQxwCa7Km/n5Yh2Igi63Xjr2mngMzknh0AIhAMoMBzyQ9WHgfVLNwr+zk8bhzoSrzE2X2K/hfvfQudRIKtoDCDsQABoMOTc1NDI2MjYyMDI5IgyKl+xrhxp/2nuW1KcqtwM+H3JkBU0aUfmF1OUbfmouZX1CIAqKf6VNcYew+0yOIAx2NL/PBhmlrlJga4fvD6lfg8+o0Jh+9lUC6JBDH4uM+OnnvDs/VSN3bR09I/JeNRJfMARTLQA/sNDBAwpfIgvRsC64NUqjZ/CWvsYhH3HQxrqQBJXtoK78xeMSdUiSaLJYI5MxbaWb3ceQrA0P1kjsnZ2CAqyZa6qZ4fP6WP8JT0k1SIpoNEAuGWRafXSMV9FDtGZJ1fGEVe70PhKImhq7bRsgfgmXHv6PYGZzcf14rhA4Rnk6HXJO6gSx0xS36r/J4wq3mR15bI2hiWnXeA3Y8GV+OXErESHtSo0uE8xrwP4lzq2PJlw8GnA6dQhmOe7RCLb2yjOm9bnBzqMCRuRlYjs2bVMX9F3WJfdqcFSuBdEyKGh8hyoK0Smn4YUE7otojKHLl47jIlNrrBX0avLkoGTnnYix+kCRzPVQnjtiGWGM0xYkekmT4RbjGRjHndOks+HZSh/Q5DUiDxOtgdEu5yY20E5CTZlCxRVIYKvqqrhfPzwMfiRXgarXdPO8XJl+ynRpFT0Sw8FZU0LlY8lfoh/87RtEMIKb2OoFOrMBPGU5KSpe7U7vRnIg2yKDGg90EXE1FxIkiQ4b6OGjY52BiFjq7EldQMV4xeQtfHuYRcl0eOY+1WwthRsYJ2xmN7W3L13jFWkI8Y0kQswDm+B9lBBE76Su+t6GjzsdHBd+sm4xlI/QHhPBe7L/8QUslHL0+JDOiB6sFscAnvzrpv4DcpavKFqaCMMPBag5ePa3J1NWjPYPpMAeLwXyNDBe1SUoxrzqUAiY2RM2sjQMwILgJEc="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a795d4e7-7d2b-4ea6-92a5-38cf4120891e", "record_id": "flaws_cloudtrail:0000268:a795d4e7-7d2b-4ea6-92a5-38cf4120891e", "row_index": 268, "timestamp": "2019-08-16T01:57:31Z", "event_type": "DescribeDBInstances", "event_source": "rds.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIAA9PEBITMHWKDVUS9", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "210.35.53.53", "user_agent": "Boto3/1.18.4 Python/3.9.6 Linux/5.10.0-8-amd64 Botocore/1.21.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 514, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a795d4e7-7d2b-4ea6-92a5-38cf4120891e", "eventTime": "2019-08-16T01:57:31Z", "eventName": "DescribeDBInstances", "eventSource": "rds.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "210.35.53.53", "userAgent": "Boto3/1.18.4 Python/3.9.6 Linux/5.10.0-8-amd64 Botocore/1.21.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIAA9PEBITMHWKDVUS9", "userName": "backup"}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "df2de542-e134-4755-ba22-6dd5e7d7ae7f", "record_id": "flaws_cloudtrail:0000269:df2de542-e134-4755-ba22-6dd5e7d7ae7f", "row_index": 269, "timestamp": "2019-08-16T02:57:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1882, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "df2de542-e134-4755-ba22-6dd5e7d7ae7f", "eventTime": "2019-08-16T02:57:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIAGQ3J1CU4N8N1SWDM", "expiration": "Aug 16, 2019 9:25:44 AM", "sessionToken": "AgoJb3JpZ2luX2VjEKP//////////wEaCXVzLXdlc3QtMiJHMEUCIBds0dq9u65IgAA0w5iXTM+TQXH8SYuGy0ZZFRRUGi1bAiEA/fAlRZcIT5PEHSX3rNAV8/Dz9j1ikXlilAggQHmpl0Aq2gMIPBAAGgw5NzU0MjYyNjIwMjkiDLNJFO/qP1Qn5/o4Uiq3A4zeBDHa5FuRt0gkwwJXw+UfBOF4AOMRlWzlmd+BOSq3rEs0USoMN+oM15+azuOEVVVL+QCIAuiN5EOvJBX3UfyiOI+npvAMLVmc4NTmq+tMKP5Qqx++Tj0+lg8JNZUDJOiNPI3u4mLKTw5YMwM225RMiglsJnp33db/j9HxDdC5eGtFVnwrTNO/3E/+QOs1mT8GdrvjZLxlp6rqw+gn4h6aB2Q9iz5uVC3rKJc4xpH0I0sjhn1v7PS68WXznOQxO/ZUVTOZ2qK2OPNF5kK1vc7q5IDsUw59yw/XLosi4XfzhVExYRq3QNoQqyxAlZpwMjAdKv5m552L1A7a4jAhWoEZGT6jIXPQs2EvJxaQaA90mBTfyK9ygbbVtdOAK7zNSGtT76fhBkS6LanMLW4dFBhS4RbopCwK1GCXiIc4YZLctyaqg/6f1mdAD7xEQj9TmToRoU/otC8HfUF2FEaUFj/Wd9xgAnP6/4JRC8LkkfC/izbt2gyWAsulRO3Iilhob0qyQRSokpARkkua7x7ptQ8uFaHB+4jV2V8n3repqt3N1ptLLxh6uAZSZUGIwXvGiSWSzV4NiaUwkrfY6gU6tAFPksVVWzKgrv/bfAipXRQjrkcIfkn5rxktDRmq6W4BcvLND+Sr36Z2g6k28cWiYg0+uboq/C1GfEmoJ4vIQHKhpOBDMGqxCRE973CZdYepJt3DbuyafNmwNra0bBGdnnaPPapZVAUiKroWo0aK8hGAxToLbwKusQcYjkFbpa8v5FxAXZb0wT5SKRKQ7HCLkxG8MiJK1APZXV6uSQHDxRrlGyCuxXjLGjQJH347L0SUknW0jfw="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "df2de542-e134-4755-ba22-6dd5e7d7ae7f", "record_id": "flaws_cloudtrail:0000270:df2de542-e134-4755-ba22-6dd5e7d7ae7f", "row_index": 270, "timestamp": "2019-08-16T02:57:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1882, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "df2de542-e134-4755-ba22-6dd5e7d7ae7f", "eventTime": "2019-08-16T02:57:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIAGQ3J1CU4N8N1SWDM", "expiration": "Aug 16, 2019 9:25:44 AM", "sessionToken": "AgoJb3JpZ2luX2VjEKP//////////wEaCXVzLXdlc3QtMiJHMEUCIBds0dq9u65IgAA0w5iXTM+TQXH8SYuGy0ZZFRRUGi1bAiEA/fAlRZcIT5PEHSX3rNAV8/Dz9j1ikXlilAggQHmpl0Aq2gMIPBAAGgw5NzU0MjYyNjIwMjkiDLNJFO/qP1Qn5/o4Uiq3A4zeBDHa5FuRt0gkwwJXw+UfBOF4AOMRlWzlmd+BOSq3rEs0USoMN+oM15+azuOEVVVL+QCIAuiN5EOvJBX3UfyiOI+npvAMLVmc4NTmq+tMKP5Qqx++Tj0+lg8JNZUDJOiNPI3u4mLKTw5YMwM225RMiglsJnp33db/j9HxDdC5eGtFVnwrTNO/3E/+QOs1mT8GdrvjZLxlp6rqw+gn4h6aB2Q9iz5uVC3rKJc4xpH0I0sjhn1v7PS68WXznOQxO/ZUVTOZ2qK2OPNF5kK1vc7q5IDsUw59yw/XLosi4XfzhVExYRq3QNoQqyxAlZpwMjAdKv5m552L1A7a4jAhWoEZGT6jIXPQs2EvJxaQaA90mBTfyK9ygbbVtdOAK7zNSGtT76fhBkS6LanMLW4dFBhS4RbopCwK1GCXiIc4YZLctyaqg/6f1mdAD7xEQj9TmToRoU/otC8HfUF2FEaUFj/Wd9xgAnP6/4JRC8LkkfC/izbt2gyWAsulRO3Iilhob0qyQRSokpARkkua7x7ptQ8uFaHB+4jV2V8n3repqt3N1ptLLxh6uAZSZUGIwXvGiSWSzV4NiaUwkrfY6gU6tAFPksVVWzKgrv/bfAipXRQjrkcIfkn5rxktDRmq6W4BcvLND+Sr36Z2g6k28cWiYg0+uboq/C1GfEmoJ4vIQHKhpOBDMGqxCRE973CZdYepJt3DbuyafNmwNra0bBGdnnaPPapZVAUiKroWo0aK8hGAxToLbwKusQcYjkFbpa8v5FxAXZb0wT5SKRKQ7HCLkxG8MiJK1APZXV6uSQHDxRrlGyCuxXjLGjQJH347L0SUknW0jfw="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "69da8dce-9916-4f2a-b16c-ad01bf1c5987", "record_id": "flaws_cloudtrail:0000271:69da8dce-9916-4f2a-b16c-ad01bf1c5987", "row_index": 271, "timestamp": "2019-08-16T03:25:17Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.7.252.199", "user_agent": "[aws-cli/1.16.219 Python/2.7.15+ Linux/4.15.0-1044-aws botocore/1.12.209]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 821, "raw_record_depth": 3, "raw_record_top_level_keys": ["additionalEventData", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "69da8dce-9916-4f2a-b16c-ad01bf1c5987", "eventTime": "2019-08-16T03:25:17Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.7.252.199", "userAgent": "[aws-cli/1.16.219 Python/2.7.15+ Linux/4.15.0-1044-aws botocore/1.12.209]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"host": ["s3.us-west-2.amazonaws.com"]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "69da8dce-9916-4f2a-b16c-ad01bf1c5987", "record_id": "flaws_cloudtrail:0000272:69da8dce-9916-4f2a-b16c-ad01bf1c5987", "row_index": 272, "timestamp": "2019-08-16T03:25:17Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.7.252.199", "user_agent": "[aws-cli/1.16.219 Python/2.7.15+ Linux/4.15.0-1044-aws botocore/1.12.209]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 821, "raw_record_depth": 3, "raw_record_top_level_keys": ["additionalEventData", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "69da8dce-9916-4f2a-b16c-ad01bf1c5987", "eventTime": "2019-08-16T03:25:17Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.7.252.199", "userAgent": "[aws-cli/1.16.219 Python/2.7.15+ Linux/4.15.0-1044-aws botocore/1.12.209]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"host": ["s3.us-west-2.amazonaws.com"]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ea932331b-61c6-4987-9323-6a0d65311", "record_id": "flaws_cloudtrail:0000273:ea932331b-61c6-4987-9323-6a0d65311", "row_index": 273, "timestamp": "2019-08-16T03:30:33Z", "event_type": "PutBucketWebsite", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.7.252.199", "user_agent": "[aws-cli/1.16.219 Python/2.7.15+ Linux/4.15.0-1044-aws botocore/1.12.209]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1111, "raw_record_depth": 3, "raw_record_top_level_keys": ["additionalEventData", "awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ea932331b-61c6-4987-9323-6a0d65311", "eventTime": "2019-08-16T03:30:33Z", "eventName": "PutBucketWebsite", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.7.252.199", "userAgent": "[aws-cli/1.16.219 Python/2.7.15+ Linux/4.15.0-1044-aws botocore/1.12.209]", "awsRegion": "us-west-2", "errorCode": "InvalidArgument", "errorMessage": "A value for IndexDocument Suffix must be provided if RedirectAllRequestsTo is empty", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"bucketName": "level3-2644b9e749c3d14e400f847199800c14.flaws.cloud", "website": [""], "WebsiteConfiguration": {"xmlns": "http://s3.amazonaws.com/doc/2006-03-01/"}, "host": ["s3.us-west-2.amazonaws.com"]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ea932331b-61c6-4987-9323-6a0d65311", "record_id": "flaws_cloudtrail:0000274:ea932331b-61c6-4987-9323-6a0d65311", "row_index": 274, "timestamp": "2019-08-16T03:30:33Z", "event_type": "PutBucketWebsite", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.7.252.199", "user_agent": "[aws-cli/1.16.219 Python/2.7.15+ Linux/4.15.0-1044-aws botocore/1.12.209]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1111, "raw_record_depth": 3, "raw_record_top_level_keys": ["additionalEventData", "awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ea932331b-61c6-4987-9323-6a0d65311", "eventTime": "2019-08-16T03:30:33Z", "eventName": "PutBucketWebsite", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.7.252.199", "userAgent": "[aws-cli/1.16.219 Python/2.7.15+ Linux/4.15.0-1044-aws botocore/1.12.209]", "awsRegion": "us-west-2", "errorCode": "InvalidArgument", "errorMessage": "A value for IndexDocument Suffix must be provided if RedirectAllRequestsTo is empty", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"bucketName": "level3-2644b9e749c3d14e400f847199800c14.flaws.cloud", "website": [""], "WebsiteConfiguration": {"xmlns": "http://s3.amazonaws.com/doc/2006-03-01/"}, "host": ["s3.us-west-2.amazonaws.com"]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8303d3b1-4394-4fa8-911e-52547d07eb5c", "record_id": "flaws_cloudtrail:0000275:8303d3b1-4394-4fa8-911e-52547d07eb5c", "row_index": 275, "timestamp": "2019-08-16T03:57:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1883, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8303d3b1-4394-4fa8-911e-52547d07eb5c", "eventTime": "2019-08-16T03:57:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIAMS4FAAXY23NJM1G4", "expiration": "Aug 16, 2019 10:05:37 AM", "sessionToken": "AgoJb3JpZ2luX2VjEKT//////////wEaCXVzLXdlc3QtMiJGMEQCIH+EJe9AF+AbxPII6Oso9vyPjf2CIi1RaY3Nq0AhRQPRAiBq66klNDdY6b/DYlwkihgX981XSo+1fFQ3sDvS/nc60CraAwg9EAAaDDk3NTQyNjI2MjAyOSIMyHQwJNlcFh7Ass6oKrcDufZYZAnOmnqqYVv0lkr7JdcG5Nrgxp/SKg53ziotoSSJRV0gykBMq6v9gENBOKddMvMyFiJW4FUcywJSQu0S98+ml0V56HPi8L5Fph4oJfmI7VQ5JOTrucer87W+h5Xcs1wZ+BbkAWxkzHVXTVDFrczkD/3MVs5LNGz0zJBvEomx3M/R+nPGB4gXfIgXEaldDdJs9oflhzqJJ52EtcZ6a0Hc+kcN1IhECNIRBjBOUdPFSNsknmD59NJzypZorPKTHnuXA0EOpj8DXyW+JKAAOLbJ/A1JTXUZIjK69cvoSLJYK8bjNTdkETp0+wXp+GqPkCDxUK9NCLSOwg496RkJn8Ty8NzzXF2yagb0fIzL9TafD2bCmATH7nV2Zb8ODK5LvaHczn6AF0K2HYMuCB6ml/MZDvfixXQJO7B5pe9nzsyNS0ovcLtepvOhmh0mqw6BsJj07OfwS+DnnSh3KZOXrrzP1+nQ2rK8kPF/CnW3hO1dwBYfu0Vdwki6womhhXJ0ui6fZ8Kfekw9wrUpsUxe5T8oawDgsr8+NScVnn5X6dLo2dcJeu7mKSByfvtIVHbhmr4QeyLtYDCi09jqBTq1ASsi/wMLbQIsFOvrRsPU2KHka7vtIQNJYdoasKckRx6vt923boJiI7JykLdJ6L1iSL2ouZJ1Qdgi6UROzTtsAIVAO7qAbOyNdzOLfnmsG0ob+khlk5Oa+4ehAYIOJFwhg70VIGHgUiYl5pXaGofWCaEau5Hv10l1Za0ckjAWFtMztug5w+AMnZkQxCxykjR63gaaMquOyEiqM7HNxEkdEup4X3WkvJM0XrlxvPerc0WTX77ASyY="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8303d3b1-4394-4fa8-911e-52547d07eb5c", "record_id": "flaws_cloudtrail:0000276:8303d3b1-4394-4fa8-911e-52547d07eb5c", "row_index": 276, "timestamp": "2019-08-16T03:57:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1883, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8303d3b1-4394-4fa8-911e-52547d07eb5c", "eventTime": "2019-08-16T03:57:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIAMS4FAAXY23NJM1G4", "expiration": "Aug 16, 2019 10:05:37 AM", "sessionToken": "AgoJb3JpZ2luX2VjEKT//////////wEaCXVzLXdlc3QtMiJGMEQCIH+EJe9AF+AbxPII6Oso9vyPjf2CIi1RaY3Nq0AhRQPRAiBq66klNDdY6b/DYlwkihgX981XSo+1fFQ3sDvS/nc60CraAwg9EAAaDDk3NTQyNjI2MjAyOSIMyHQwJNlcFh7Ass6oKrcDufZYZAnOmnqqYVv0lkr7JdcG5Nrgxp/SKg53ziotoSSJRV0gykBMq6v9gENBOKddMvMyFiJW4FUcywJSQu0S98+ml0V56HPi8L5Fph4oJfmI7VQ5JOTrucer87W+h5Xcs1wZ+BbkAWxkzHVXTVDFrczkD/3MVs5LNGz0zJBvEomx3M/R+nPGB4gXfIgXEaldDdJs9oflhzqJJ52EtcZ6a0Hc+kcN1IhECNIRBjBOUdPFSNsknmD59NJzypZorPKTHnuXA0EOpj8DXyW+JKAAOLbJ/A1JTXUZIjK69cvoSLJYK8bjNTdkETp0+wXp+GqPkCDxUK9NCLSOwg496RkJn8Ty8NzzXF2yagb0fIzL9TafD2bCmATH7nV2Zb8ODK5LvaHczn6AF0K2HYMuCB6ml/MZDvfixXQJO7B5pe9nzsyNS0ovcLtepvOhmh0mqw6BsJj07OfwS+DnnSh3KZOXrrzP1+nQ2rK8kPF/CnW3hO1dwBYfu0Vdwki6womhhXJ0ui6fZ8Kfekw9wrUpsUxe5T8oawDgsr8+NScVnn5X6dLo2dcJeu7mKSByfvtIVHbhmr4QeyLtYDCi09jqBTq1ASsi/wMLbQIsFOvrRsPU2KHka7vtIQNJYdoasKckRx6vt923boJiI7JykLdJ6L1iSL2ouZJ1Qdgi6UROzTtsAIVAO7qAbOyNdzOLfnmsG0ob+khlk5Oa+4ehAYIOJFwhg70VIGHgUiYl5pXaGofWCaEau5Hv10l1Za0ckjAWFtMztug5w+AMnZkQxCxykjR63gaaMquOyEiqM7HNxEkdEup4X3WkvJM0XrlxvPerc0WTX77ASyY="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "35fba091-c864-4f61-b33d-26bf7016335f", "record_id": "flaws_cloudtrail:0000277:35fba091-c864-4f61-b33d-26bf7016335f", "row_index": 277, "timestamp": "2019-08-16T04:57:23Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1882, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "35fba091-c864-4f61-b33d-26bf7016335f", "eventTime": "2019-08-16T04:57:23Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIA8TEV2EVDMDGCZ78R", "expiration": "Aug 16, 2019 11:17:29 AM", "sessionToken": "AgoJb3JpZ2luX2VjEKX//////////wEaCXVzLXdlc3QtMiJIMEYCIQDDQZLyFO0LFrJqcOKMVIoophDi2TPR70bdJwnNDeeGoQIhAJt+hDkiWHlVxy+Mf6BpdrK04ymPjeOpsKCssLxPRDU4KtoDCD4QABoMOTc1NDI2MjYyMDI5IgyKb7C0vfoQg+Sfn0gqtwM+n8JQWxCA5uDIYmtEwKKISfMH0aXeiMSUAxXT00LuBTiqyJo/e6a5uB7EvacoJKBdArlOvohdyXtL9lvV6O3INF0QxYBzf+AtLF2fSPRQayjupYjg7+PXjh8g4pOvxrnRGfjsW4cMz7KGXlkD86ublOLBwHmP4gT2ktAsOl9xSho6PAaS6u1ICYyMt7/Mfv9nCK2mel7Zszq3BDoDt9na256RpTJdg/A3Qc0eX9t12pb0+r357dw518AXriwclL4Qf1i1q7BDpuEvMWiiyxM97m89Nlw4si0nqMSUMSX5CB6+gYa56744RjeIOddv+xd62LrZc1PbKtsPyec3iP6uhxNaJYM1AjjXmLWJvXGFeesD1ad/UMX319c2LIg+gh3UbRnC/W2LDovafoUwWYwh0venyuam6k+0klcNHBZLs+D3Emdy6XYkGX8OjYsEPoRez4dYlAa5GHVcHllP0rBrPhkpJL4xZU/0Jo1FMUmZBlIQ+fc83Po2z2yGudlYzuZhs8J8JxkqSaTW86dodbyobmnt8fSCCUqRi7l1KVLdQ7rYOcjUKn+xKwZPL2tuTQo+tvxmZm+aMLPv2OoFOrMBQauEL8Mk5gEbqUVhPZ3nszAcDZWE9dhURdUtdctlRHXQwSwmVX46+IfeIQswfKuEU0abKakK9ZP2oQEnBlFhSHuRTD+VS2rU/l5qMQn5zeR9cwrqTQuRcEjqJL/CsuV8/Vga/KruX/rZ0pbJjCXi5Pm3thacRAqftsJ7jH5DvcxSu1m7KSFkUNqg6fDHvkzMha88iNQRed0rTUILZgNGHapm+lZbTp+XpIpE7zv3zTUiU34="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "35fba091-c864-4f61-b33d-26bf7016335f", "record_id": "flaws_cloudtrail:0000278:35fba091-c864-4f61-b33d-26bf7016335f", "row_index": 278, "timestamp": "2019-08-16T04:57:23Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1882, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "35fba091-c864-4f61-b33d-26bf7016335f", "eventTime": "2019-08-16T04:57:23Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIA8TEV2EVDMDGCZ78R", "expiration": "Aug 16, 2019 11:17:29 AM", "sessionToken": "AgoJb3JpZ2luX2VjEKX//////////wEaCXVzLXdlc3QtMiJIMEYCIQDDQZLyFO0LFrJqcOKMVIoophDi2TPR70bdJwnNDeeGoQIhAJt+hDkiWHlVxy+Mf6BpdrK04ymPjeOpsKCssLxPRDU4KtoDCD4QABoMOTc1NDI2MjYyMDI5IgyKb7C0vfoQg+Sfn0gqtwM+n8JQWxCA5uDIYmtEwKKISfMH0aXeiMSUAxXT00LuBTiqyJo/e6a5uB7EvacoJKBdArlOvohdyXtL9lvV6O3INF0QxYBzf+AtLF2fSPRQayjupYjg7+PXjh8g4pOvxrnRGfjsW4cMz7KGXlkD86ublOLBwHmP4gT2ktAsOl9xSho6PAaS6u1ICYyMt7/Mfv9nCK2mel7Zszq3BDoDt9na256RpTJdg/A3Qc0eX9t12pb0+r357dw518AXriwclL4Qf1i1q7BDpuEvMWiiyxM97m89Nlw4si0nqMSUMSX5CB6+gYa56744RjeIOddv+xd62LrZc1PbKtsPyec3iP6uhxNaJYM1AjjXmLWJvXGFeesD1ad/UMX319c2LIg+gh3UbRnC/W2LDovafoUwWYwh0venyuam6k+0klcNHBZLs+D3Emdy6XYkGX8OjYsEPoRez4dYlAa5GHVcHllP0rBrPhkpJL4xZU/0Jo1FMUmZBlIQ+fc83Po2z2yGudlYzuZhs8J8JxkqSaTW86dodbyobmnt8fSCCUqRi7l1KVLdQ7rYOcjUKn+xKwZPL2tuTQo+tvxmZm+aMLPv2OoFOrMBQauEL8Mk5gEbqUVhPZ3nszAcDZWE9dhURdUtdctlRHXQwSwmVX46+IfeIQswfKuEU0abKakK9ZP2oQEnBlFhSHuRTD+VS2rU/l5qMQn5zeR9cwrqTQuRcEjqJL/CsuV8/Vga/KruX/rZ0pbJjCXi5Pm3thacRAqftsJ7jH5DvcxSu1m7KSFkUNqg6fDHvkzMha88iNQRed0rTUILZgNGHapm+lZbTp+XpIpE7zv3zTUiU34="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f97d6b4c-c00f-4399-a92e-739a1a88fcf8", "record_id": "flaws_cloudtrail:0000279:f97d6b4c-c00f-4399-a92e-739a1a88fcf8", "row_index": 279, "timestamp": "2019-08-16T05:57:23Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1885, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f97d6b4c-c00f-4399-a92e-739a1a88fcf8", "eventTime": "2019-08-16T05:57:23Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIAUUA7D2TDNDHGIELU", "expiration": "Aug 16, 2019 12:25:48 PM", "sessionToken": "AgoJb3JpZ2luX2VjEKb//////////wEaCXVzLXdlc3QtMiJHMEUCIQCZbrKdKFS/LTALk+GmH6iyG0GQiVmFT7QywgZrLU7RmgIgPLjis2VVlbQWEzEeu4f+aKIcx9JfkLsIAPDmsLyMxrwq2gMIPxAAGgw5NzU0MjYyNjIwMjkiDBoaAAoFEINb5NSXCyq3A4Jj4S7AsffpTj+7nRrb7igMe1Ttfwm4B/L+eLMI762Ph81SI7kQiJ8X7QXJftSsBrnEZ53lF5ieUO2PEOySnvjUj7q/pBA2v+s0Y6GdkyFTEQgAh0zjSshCUjiU5OQMqexw5PjSmDJGCULqlICLp8hrEUTwarWtrfju8PWdfayDZPCbYL9QWcz3h6qwG3sNrfdRXM+AsEuV2I40cehwkGwdg7ha9jfVzAP7bfrqK++4k5pPdLExG2CMkM02/Lfmid0kYDBV5XEfV9Qg7ShpFDbfvE1P/lv/e6+Le2oupwYRMmTWKQBJxZIx4QTg8UryYAcU4Tn/R2C5wRA6W6otvsXyCwXK5ozrHQMcgxgUP3F0kqtaa/Sx9f/P7+Qh1UaIa79S4XMNOpBcYGijsmw4YpvcjM7zUvsC96x5z9/g+CRKmY/VGjazwY+xrd54aTPLWOC800110cOsbMDG91J/DYtcdRalClEgLwytpKeFy/GJYO9wnhx25gGprev5YyhVD6rfpA+6LadEEjQ6tLQl/EBzsTe1fbayJf8JOTARbpACz4g7d8MWHlBdbXzG4TUrpj0jTLdc4nLgww4vZ6gU6tAE4dzCRvbLG92NWeqhKuyrt4BInrC/M5A61/aOkjYAZDX/fHmdcsdqAF/iiBDMfBVPxNqNVdCqH++OXT7Bhbk7lFZH43KfIaO309C+xhbM5k+gLOp2aARHc6Ew0z/81BpoAze1oYorsJgApje48e+ZuUOlX0TJEt0xpk+F4qcjITeYaGTUprFNf4tyDcYQAf4qlDaojt+vBLW9s0bef4mEITy31axQsmwRA4G7fLBi9nQQ5/Pw="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f97d6b4c-c00f-4399-a92e-739a1a88fcf8", "record_id": "flaws_cloudtrail:0000280:f97d6b4c-c00f-4399-a92e-739a1a88fcf8", "row_index": 280, "timestamp": "2019-08-16T05:57:23Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1885, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f97d6b4c-c00f-4399-a92e-739a1a88fcf8", "eventTime": "2019-08-16T05:57:23Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIAUUA7D2TDNDHGIELU", "expiration": "Aug 16, 2019 12:25:48 PM", "sessionToken": "AgoJb3JpZ2luX2VjEKb//////////wEaCXVzLXdlc3QtMiJHMEUCIQCZbrKdKFS/LTALk+GmH6iyG0GQiVmFT7QywgZrLU7RmgIgPLjis2VVlbQWEzEeu4f+aKIcx9JfkLsIAPDmsLyMxrwq2gMIPxAAGgw5NzU0MjYyNjIwMjkiDBoaAAoFEINb5NSXCyq3A4Jj4S7AsffpTj+7nRrb7igMe1Ttfwm4B/L+eLMI762Ph81SI7kQiJ8X7QXJftSsBrnEZ53lF5ieUO2PEOySnvjUj7q/pBA2v+s0Y6GdkyFTEQgAh0zjSshCUjiU5OQMqexw5PjSmDJGCULqlICLp8hrEUTwarWtrfju8PWdfayDZPCbYL9QWcz3h6qwG3sNrfdRXM+AsEuV2I40cehwkGwdg7ha9jfVzAP7bfrqK++4k5pPdLExG2CMkM02/Lfmid0kYDBV5XEfV9Qg7ShpFDbfvE1P/lv/e6+Le2oupwYRMmTWKQBJxZIx4QTg8UryYAcU4Tn/R2C5wRA6W6otvsXyCwXK5ozrHQMcgxgUP3F0kqtaa/Sx9f/P7+Qh1UaIa79S4XMNOpBcYGijsmw4YpvcjM7zUvsC96x5z9/g+CRKmY/VGjazwY+xrd54aTPLWOC800110cOsbMDG91J/DYtcdRalClEgLwytpKeFy/GJYO9wnhx25gGprev5YyhVD6rfpA+6LadEEjQ6tLQl/EBzsTe1fbayJf8JOTARbpACz4g7d8MWHlBdbXzG4TUrpj0jTLdc4nLgww4vZ6gU6tAE4dzCRvbLG92NWeqhKuyrt4BInrC/M5A61/aOkjYAZDX/fHmdcsdqAF/iiBDMfBVPxNqNVdCqH++OXT7Bhbk7lFZH43KfIaO309C+xhbM5k+gLOp2aARHc6Ew0z/81BpoAze1oYorsJgApje48e+ZuUOlX0TJEt0xpk+F4qcjITeYaGTUprFNf4tyDcYQAf4qlDaojt+vBLW9s0bef4mEITy31axQsmwRA4G7fLBi9nQQ5/Pw="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "196df8e0-ad57-49d8-b8d6-52ef364f5055", "record_id": "flaws_cloudtrail:0000281:196df8e0-ad57-49d8-b8d6-52ef364f5055", "row_index": 281, "timestamp": "2019-08-16T06:26:59Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "config.amazonaws.com", "user_agent": "config.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/service-role/config-role-us-west-2"], "raw_record_size_bytes": 1935, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "196df8e0-ad57-49d8-b8d6-52ef364f5055", "eventTime": "2019-08-16T06:26:59Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "config.amazonaws.com", "userAgent": "config.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "config.amazonaws.com"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/service-role/config-role-us-west-2", "roleSessionName": "AWSConfig"}, "responseElements": {"credentials": {"accessKeyId": "ASIAOZXQG5F990LB40QD", "expiration": "Aug 16, 2019 7:26:59 AM", "sessionToken": "AgoJb3JpZ2luX2VjEKf//////////wEaCXVzLXdlc3QtMiJHMEUCIBPgygOlW5PhLkwQzt8gO2VlukuNSpaLMDfDmsRXbWzMAiEAkI3VDNMlDBBnaE+0Gix07aYa936u0vOLoE4o3qEtP98q6AIIQBAAGgw5NzU0MjYyNjIwMjkiDGIDzmCacr3W1dt/uyrFApRY50BHfqTZ8GofDPXYG490Zb+vf5l/n0i742Sb8nJ0KxvpmGeGQcYOvhTI0UQ62OIRWr4XtkvyM32ra7HqGlko7nM8XPdjtwMTHzuAwqKCpTIFWIRztNpPGSbyr07ukLDh0I0P68srqQtfeZl63a6XU6KZtMxOSe/K8EBqGWOi77d7RiddBCuJwXLQ6Ivtd+ras2HcWaFFEoz3EAJXQgpSSkxx5ugQb0je2ncxL9+6dHMdXkR2ANLdvQD8gNdJP18jqlhZf2TJEMPbaIymMJgbg+UVR6oBwzsDuAj544HAm6mbZFjRgbKwAyHD6qudYaeaOhQSRmLuhtKJ9JLuMmaH9/HqN/hC/mI1Gb5iBfQOR11WtAKSBTLDnK3kSwqajkzCMWajUpx9pQfG9PXhZzwNgHFW4RHXSHp8xC2dliW2ZhFCHMEws5nZ6gU6tAERaxJct0uzWEwCzNhssbRT5vhOkxjcLaLv+nemu4iTi7wDkzMvVod+4uzZRNQkhc1sjHdipIJtYb/+pOtLKXo0eUoWw9D7ndRNoPML0/6yjWVd3gFU6pqcwDGZUVWmDj2pQ+BcR7jJCAZ7Si4qgL1PRyn1Ahkf74R77lFOTAN6U5AfLfxDMDKTmt4235fFEoeQTSPdUxrDAk721jZGfGjuwp/mKm8j4bmwTXu48HJm1EQCFq4="}, "assumedRoleUser": {"assumedRoleId": "AROASM3HWKK95VDO4HH81:AWSConfig", "arn": "arn:aws:sts::811596193553:assumed-role/config-role-us-west-2/AWSConfig"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/service-role/config-role-us-west-2", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "196df8e0-ad57-49d8-b8d6-52ef364f5055", "record_id": "flaws_cloudtrail:0000282:196df8e0-ad57-49d8-b8d6-52ef364f5055", "row_index": 282, "timestamp": "2019-08-16T06:26:59Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "config.amazonaws.com", "user_agent": "config.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/service-role/config-role-us-west-2"], "raw_record_size_bytes": 1935, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "196df8e0-ad57-49d8-b8d6-52ef364f5055", "eventTime": "2019-08-16T06:26:59Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "config.amazonaws.com", "userAgent": "config.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "config.amazonaws.com"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/service-role/config-role-us-west-2", "roleSessionName": "AWSConfig"}, "responseElements": {"credentials": {"accessKeyId": "ASIAOZXQG5F990LB40QD", "expiration": "Aug 16, 2019 7:26:59 AM", "sessionToken": "AgoJb3JpZ2luX2VjEKf//////////wEaCXVzLXdlc3QtMiJHMEUCIBPgygOlW5PhLkwQzt8gO2VlukuNSpaLMDfDmsRXbWzMAiEAkI3VDNMlDBBnaE+0Gix07aYa936u0vOLoE4o3qEtP98q6AIIQBAAGgw5NzU0MjYyNjIwMjkiDGIDzmCacr3W1dt/uyrFApRY50BHfqTZ8GofDPXYG490Zb+vf5l/n0i742Sb8nJ0KxvpmGeGQcYOvhTI0UQ62OIRWr4XtkvyM32ra7HqGlko7nM8XPdjtwMTHzuAwqKCpTIFWIRztNpPGSbyr07ukLDh0I0P68srqQtfeZl63a6XU6KZtMxOSe/K8EBqGWOi77d7RiddBCuJwXLQ6Ivtd+ras2HcWaFFEoz3EAJXQgpSSkxx5ugQb0je2ncxL9+6dHMdXkR2ANLdvQD8gNdJP18jqlhZf2TJEMPbaIymMJgbg+UVR6oBwzsDuAj544HAm6mbZFjRgbKwAyHD6qudYaeaOhQSRmLuhtKJ9JLuMmaH9/HqN/hC/mI1Gb5iBfQOR11WtAKSBTLDnK3kSwqajkzCMWajUpx9pQfG9PXhZzwNgHFW4RHXSHp8xC2dliW2ZhFCHMEws5nZ6gU6tAERaxJct0uzWEwCzNhssbRT5vhOkxjcLaLv+nemu4iTi7wDkzMvVod+4uzZRNQkhc1sjHdipIJtYb/+pOtLKXo0eUoWw9D7ndRNoPML0/6yjWVd3gFU6pqcwDGZUVWmDj2pQ+BcR7jJCAZ7Si4qgL1PRyn1Ahkf74R77lFOTAN6U5AfLfxDMDKTmt4235fFEoeQTSPdUxrDAk721jZGfGjuwp/mKm8j4bmwTXu48HJm1EQCFq4="}, "assumedRoleUser": {"assumedRoleId": "AROASM3HWKK95VDO4HH81:AWSConfig", "arn": "arn:aws:sts::811596193553:assumed-role/config-role-us-west-2/AWSConfig"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/service-role/config-role-us-west-2", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "442839c8e-4864-45d2-a1da-2159b466888c", "record_id": "flaws_cloudtrail:0000283:442839c8e-4864-45d2-a1da-2159b466888c", "row_index": 283, "timestamp": "2019-08-16T06:56:22Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAUUA7D2TDNDHGIELU", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "129.5.8.15", "user_agent": "[aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1145, "raw_record_depth": 4, "raw_record_top_level_keys": ["additionalEventData", "awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "442839c8e-4864-45d2-a1da-2159b466888c", "eventTime": "2019-08-16T06:56:22Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "[aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207]", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Access Denied", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAUUA7D2TDNDHGIELU", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-08-16T05:57:23Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "requestParameters": {"host": ["s3.amazonaws.com"]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "442839c8e-4864-45d2-a1da-2159b466888c", "record_id": "flaws_cloudtrail:0000284:442839c8e-4864-45d2-a1da-2159b466888c", "row_index": 284, "timestamp": "2019-08-16T06:56:22Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAUUA7D2TDNDHGIELU", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "129.5.8.15", "user_agent": "[aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1145, "raw_record_depth": 4, "raw_record_top_level_keys": ["additionalEventData", "awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "442839c8e-4864-45d2-a1da-2159b466888c", "eventTime": "2019-08-16T06:56:22Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "[aws-cli/1.16.217 Python/3.7.2 Windows/10 botocore/1.12.207]", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Access Denied", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAUUA7D2TDNDHGIELU", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-08-16T05:57:23Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "requestParameters": {"host": ["s3.amazonaws.com"]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "38714f1-87a0-4c23-a8e0-d38633ce412", "record_id": "flaws_cloudtrail:0000285:38714f1-87a0-4c23-a8e0-d38633ce412", "row_index": 285, "timestamp": "2019-08-16T06:57:23Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1881, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "38714f1-87a0-4c23-a8e0-d38633ce412", "eventTime": "2019-08-16T06:57:23Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIA18Z5POZW2UH5JGGW", "expiration": "Aug 16, 2019 1:14:56 PM", "sessionToken": "AgoJb3JpZ2luX2VjEKf//////////wEaCXVzLXdlc3QtMiJIMEYCIQDN5mZftnjU9YBGBeajwfBtpFI5Uk6T/Xy2QGY2ihBqEAIhAO3+XK0/cjJ21d6dkkPUgcaZd0BtD3Y/dNgX1GjjwAMRKtoDCEAQABoMOTc1NDI2MjYyMDI5IgxSsJC16Pty1gIheIAqtwNu4vDtWKHHy3Ppn+2TeQisHQMljb6E7FImUuoN62jgv9ejGwmJngqPYuMozTGXYLGLImzMMDkRxBOaUAgBd6yQbdNEl0tT2u/cse/nY/MM/ykrINYG0nubF/kCDVRW7yJVIpPjV/yX4vfuT5Rt2jCFKhwCRYF1QFtUgbINxVi4nU2NmziLqq1+6PYkuytW18O4Dx6NEt2EKUhUZyS5pdsUxFMzdbrUL42+22aa+i6QRCsghBtxEq2D8SKAg5imEccPX5SZfXjabyc45AnOpgqZNECW3KBkbvnpAeEJ2nbySofSxfWhJKkMWOSmEiFEn/qhhn2ZKncg2ZmuZxeJHcEJ1M7iN+GS3ZQpa5TUZC8QD4WUJdxaahG1awFaW8bIpFG7lkaStnKEsOxPc90BbHt1SYnsfxf0wuuNErpRr8GYwQr37OZr4vO2xJBd8uINZPUmxcq2AbuCgJgXrBK+b0cC/yh2soaBIjd/D30oiN8zTWtW3bVrE39w7Z04xxsP7MYFjsRHek4EzcyaH9vBrTN4CEoc4LxcgA16Gu7KV2BlC1sKwweg73upBVc0Y+mxrZN0DSYBOZH2MNOn2eoFOrMBmE1NiT5itTh051CVxFCD0xRd2X20Tb+sXRpF1I8VZeD9ZhH1q9WwaCwRwV6fJwVkIwyVLsyM3ckwwKTud1sPQ3Hn1vpS88/uqHHPwPasOxMDpGcIIDjDHBRutN1nPA3mxE/9EZWDdNigNzXbhyRzXNTljhHrt6TAXo0LT94CwvO5twklpCIn0gIDUiz28TsqSXWR8Xud+P4U5a6AQKrE2N+1nvwIWEMAo/i9Zb0oPTEVVRE="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "38714f1-87a0-4c23-a8e0-d38633ce412", "record_id": "flaws_cloudtrail:0000286:38714f1-87a0-4c23-a8e0-d38633ce412", "row_index": 286, "timestamp": "2019-08-16T06:57:23Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1881, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "38714f1-87a0-4c23-a8e0-d38633ce412", "eventTime": "2019-08-16T06:57:23Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIA18Z5POZW2UH5JGGW", "expiration": "Aug 16, 2019 1:14:56 PM", "sessionToken": "AgoJb3JpZ2luX2VjEKf//////////wEaCXVzLXdlc3QtMiJIMEYCIQDN5mZftnjU9YBGBeajwfBtpFI5Uk6T/Xy2QGY2ihBqEAIhAO3+XK0/cjJ21d6dkkPUgcaZd0BtD3Y/dNgX1GjjwAMRKtoDCEAQABoMOTc1NDI2MjYyMDI5IgxSsJC16Pty1gIheIAqtwNu4vDtWKHHy3Ppn+2TeQisHQMljb6E7FImUuoN62jgv9ejGwmJngqPYuMozTGXYLGLImzMMDkRxBOaUAgBd6yQbdNEl0tT2u/cse/nY/MM/ykrINYG0nubF/kCDVRW7yJVIpPjV/yX4vfuT5Rt2jCFKhwCRYF1QFtUgbINxVi4nU2NmziLqq1+6PYkuytW18O4Dx6NEt2EKUhUZyS5pdsUxFMzdbrUL42+22aa+i6QRCsghBtxEq2D8SKAg5imEccPX5SZfXjabyc45AnOpgqZNECW3KBkbvnpAeEJ2nbySofSxfWhJKkMWOSmEiFEn/qhhn2ZKncg2ZmuZxeJHcEJ1M7iN+GS3ZQpa5TUZC8QD4WUJdxaahG1awFaW8bIpFG7lkaStnKEsOxPc90BbHt1SYnsfxf0wuuNErpRr8GYwQr37OZr4vO2xJBd8uINZPUmxcq2AbuCgJgXrBK+b0cC/yh2soaBIjd/D30oiN8zTWtW3bVrE39w7Z04xxsP7MYFjsRHek4EzcyaH9vBrTN4CEoc4LxcgA16Gu7KV2BlC1sKwweg73upBVc0Y+mxrZN0DSYBOZH2MNOn2eoFOrMBmE1NiT5itTh051CVxFCD0xRd2X20Tb+sXRpF1I8VZeD9ZhH1q9WwaCwRwV6fJwVkIwyVLsyM3ckwwKTud1sPQ3Hn1vpS88/uqHHPwPasOxMDpGcIIDjDHBRutN1nPA3mxE/9EZWDdNigNzXbhyRzXNTljhHrt6TAXo0LT94CwvO5twklpCIn0gIDUiz28TsqSXWR8Xud+P4U5a6AQKrE2N+1nvwIWEMAo/i9Zb0oPTEVVRE="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a2fb0051-55f2-407e-b9e6-c9b153853ae30", "record_id": "flaws_cloudtrail:0000287:a2fb0051-55f2-407e-b9e6-c9b153853ae30", "row_index": 287, "timestamp": "2019-08-16T07:40:54Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "25.231.254.207", "user_agent": "[aws-cli/1.16.219 Python/3.6.0 Windows/10 botocore/1.12.209]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 810, "raw_record_depth": 3, "raw_record_top_level_keys": ["additionalEventData", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a2fb0051-55f2-407e-b9e6-c9b153853ae30", "eventTime": "2019-08-16T07:40:54Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "25.231.254.207", "userAgent": "[aws-cli/1.16.219 Python/3.6.0 Windows/10 botocore/1.12.209]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"host": ["s3.us-west-2.amazonaws.com"]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a2fb0051-55f2-407e-b9e6-c9b153853ae30", "record_id": "flaws_cloudtrail:0000288:a2fb0051-55f2-407e-b9e6-c9b153853ae30", "row_index": 288, "timestamp": "2019-08-16T07:40:54Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "25.231.254.207", "user_agent": "[aws-cli/1.16.219 Python/3.6.0 Windows/10 botocore/1.12.209]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 810, "raw_record_depth": 3, "raw_record_top_level_keys": ["additionalEventData", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a2fb0051-55f2-407e-b9e6-c9b153853ae30", "eventTime": "2019-08-16T07:40:54Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "25.231.254.207", "userAgent": "[aws-cli/1.16.219 Python/3.6.0 Windows/10 botocore/1.12.209]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"host": ["s3.us-west-2.amazonaws.com"]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4f2b220b-a8e7-41e1-8a46-981146a2b91b1", "record_id": "flaws_cloudtrail:0000289:4f2b220b-a8e7-41e1-8a46-981146a2b91b1", "row_index": 289, "timestamp": "2019-08-16T07:57:23Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1883, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4f2b220b-a8e7-41e1-8a46-981146a2b91b1", "eventTime": "2019-08-16T07:57:23Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIACK6XAG1OPJTURJVT", "expiration": "Aug 16, 2019 2:11:52 PM", "sessionToken": "AgoJb3JpZ2luX2VjEKj//////////wEaCXVzLXdlc3QtMiJIMEYCIQCcQd11cbLIlQPlgYb97xV4OYgbGciDH7hrcvdtPUdySQIhAJcaefX4+F0XpVZg3gM2AkalnLx1LFCxd3B1PsXTgxEkKtoDCEEQABoMOTc1NDI2MjYyMDI5Igx/SbcvB1QeIKno6ygqtwNaiMxmTlk7rVKNcnMhgRzctKgKo50geTynPOlvss/KuAx4nFkUcdxjBq7udb6dsk4l1HZ/lBelphb48iqpFpraDW1PF+X+2yyL2Jd8EtAjRL3jJ2l9BzNtHvhtMW2bbOEykrzwYnQEwCZwSfyv8I8SCBXx7M7ayRDk+ZsAxAO6vb9X25fO8XNJsik8RbeNDh0THwPsioWCgnIFZQsKGgzNuJ0MApPdq+NDe3lEZMqsSWWyluYivpYpZvy5+3euegiqm3aIamX+wLacnyhby+wOM4N1vXN/hLciJ/Kyph1bbI0nKIWcwqBlXVX7wyX/CRTGoqL6z1yocz4D3mFFQaAWGBdAuwIafoPwrN3kHEQ9d4LPsbsG7Fyfco3ve6XghMbFFfT9ESz4rjLK68wnQRkzO0jQHdLhjDrABf3x2o2VLStbUcjQZlFeB46za4Zs6X6GLEVOnzwZ6CQCEA6RmMM14RkkxDxCWAq+F+CgRFwi/PPY+GaYw34TL+Mgkl5SIuin/N9VvAy/F8PNCGRIl1c87EG6z9ktVWCSi86bLAs891hppbs3f+43R7OjAEJAapf1ZTVgTIEjMOPD2eoFOrMBCuCCrJ4R4b6ItW7MdF5/3x6HtncL1+6TaXMcpLo74I63mlzMSe1EJyGJIAJkbmDW69QbxVBuzZH+RFwdXc/T71gkQ7r8tgTe2nPrZNA6uEEkrwnMlCEzp5jXqJrfkdBxbjHntjDx/zKd7HQFhtXCoPShOsRnVKeZpZnJbIHlNGxtDwPjcRV3NsBN5hE2siiP8ITWFGSLuRbC/UBXF+19A1E8f1RzbYoMoeeF8uFj8gqD81k="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4f2b220b-a8e7-41e1-8a46-981146a2b91b1", "record_id": "flaws_cloudtrail:0000290:4f2b220b-a8e7-41e1-8a46-981146a2b91b1", "row_index": 290, "timestamp": "2019-08-16T07:57:23Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1883, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4f2b220b-a8e7-41e1-8a46-981146a2b91b1", "eventTime": "2019-08-16T07:57:23Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIACK6XAG1OPJTURJVT", "expiration": "Aug 16, 2019 2:11:52 PM", "sessionToken": "AgoJb3JpZ2luX2VjEKj//////////wEaCXVzLXdlc3QtMiJIMEYCIQCcQd11cbLIlQPlgYb97xV4OYgbGciDH7hrcvdtPUdySQIhAJcaefX4+F0XpVZg3gM2AkalnLx1LFCxd3B1PsXTgxEkKtoDCEEQABoMOTc1NDI2MjYyMDI5Igx/SbcvB1QeIKno6ygqtwNaiMxmTlk7rVKNcnMhgRzctKgKo50geTynPOlvss/KuAx4nFkUcdxjBq7udb6dsk4l1HZ/lBelphb48iqpFpraDW1PF+X+2yyL2Jd8EtAjRL3jJ2l9BzNtHvhtMW2bbOEykrzwYnQEwCZwSfyv8I8SCBXx7M7ayRDk+ZsAxAO6vb9X25fO8XNJsik8RbeNDh0THwPsioWCgnIFZQsKGgzNuJ0MApPdq+NDe3lEZMqsSWWyluYivpYpZvy5+3euegiqm3aIamX+wLacnyhby+wOM4N1vXN/hLciJ/Kyph1bbI0nKIWcwqBlXVX7wyX/CRTGoqL6z1yocz4D3mFFQaAWGBdAuwIafoPwrN3kHEQ9d4LPsbsG7Fyfco3ve6XghMbFFfT9ESz4rjLK68wnQRkzO0jQHdLhjDrABf3x2o2VLStbUcjQZlFeB46za4Zs6X6GLEVOnzwZ6CQCEA6RmMM14RkkxDxCWAq+F+CgRFwi/PPY+GaYw34TL+Mgkl5SIuin/N9VvAy/F8PNCGRIl1c87EG6z9ktVWCSi86bLAs891hppbs3f+43R7OjAEJAapf1ZTVgTIEjMOPD2eoFOrMBCuCCrJ4R4b6ItW7MdF5/3x6HtncL1+6TaXMcpLo74I63mlzMSe1EJyGJIAJkbmDW69QbxVBuzZH+RFwdXc/T71gkQ7r8tgTe2nPrZNA6uEEkrwnMlCEzp5jXqJrfkdBxbjHntjDx/zKd7HQFhtXCoPShOsRnVKeZpZnJbIHlNGxtDwPjcRV3NsBN5hE2siiP8ITWFGSLuRbC/UBXF+19A1E8f1RzbYoMoeeF8uFj8gqD81k="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4cd21bce-33d0-4063-8118-f9a7e988f040", "record_id": "flaws_cloudtrail:0000291:4cd21bce-33d0-4063-8118-f9a7e988f040", "row_index": 291, "timestamp": "2019-08-16T08:46:40Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 775, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4cd21bce-33d0-4063-8118-f9a7e988f040", "eventTime": "2019-08-16T08:46:40Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4cd21bce-33d0-4063-8118-f9a7e988f040", "record_id": "flaws_cloudtrail:0000292:4cd21bce-33d0-4063-8118-f9a7e988f040", "row_index": 292, "timestamp": "2019-08-16T08:46:40Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 775, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4cd21bce-33d0-4063-8118-f9a7e988f040", "eventTime": "2019-08-16T08:46:40Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "39c87618-db42-4872-855e-dab8934c3a05", "record_id": "flaws_cloudtrail:0000293:39c87618-db42-4872-855e-dab8934c3a05", "row_index": 293, "timestamp": "2019-08-16T08:46:46Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 772, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "39c87618-db42-4872-855e-dab8934c3a05", "eventTime": "2019-08-16T08:46:46Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6ebd42e9-71c8-43db-9108-5f3513c35a7b", "record_id": "flaws_cloudtrail:0000294:6ebd42e9-71c8-43db-9108-5f3513c35a7b", "row_index": 294, "timestamp": "2019-08-16T08:46:46Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 774, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6ebd42e9-71c8-43db-9108-5f3513c35a7b", "eventTime": "2019-08-16T08:46:46Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "39c87618-db42-4872-855e-dab8934c3a05", "record_id": "flaws_cloudtrail:0000295:39c87618-db42-4872-855e-dab8934c3a05", "row_index": 295, "timestamp": "2019-08-16T08:46:46Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 772, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "39c87618-db42-4872-855e-dab8934c3a05", "eventTime": "2019-08-16T08:46:46Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6ebd42e9-71c8-43db-9108-5f3513c35a7b", "record_id": "flaws_cloudtrail:0000296:6ebd42e9-71c8-43db-9108-5f3513c35a7b", "row_index": 296, "timestamp": "2019-08-16T08:46:46Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 774, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6ebd42e9-71c8-43db-9108-5f3513c35a7b", "eventTime": "2019-08-16T08:46:46Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "73075a-8a1d-4fff-99ea-816f947ff5a5", "record_id": "flaws_cloudtrail:0000297:73075a-8a1d-4fff-99ea-816f947ff5a5", "row_index": 297, "timestamp": "2019-08-16T08:46:47Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 772, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "73075a-8a1d-4fff-99ea-816f947ff5a5", "eventTime": "2019-08-16T08:46:47Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "73075a-8a1d-4fff-99ea-816f947ff5a5", "record_id": "flaws_cloudtrail:0000298:73075a-8a1d-4fff-99ea-816f947ff5a5", "row_index": 298, "timestamp": "2019-08-16T08:46:47Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 772, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "73075a-8a1d-4fff-99ea-816f947ff5a5", "eventTime": "2019-08-16T08:46:47Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bcf1487d-fdb0-48b6-ae4d-b2405999656e", "record_id": "flaws_cloudtrail:0000299:bcf1487d-fdb0-48b6-ae4d-b2405999656e", "row_index": 299, "timestamp": "2019-08-16T08:47:03Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 774, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bcf1487d-fdb0-48b6-ae4d-b2405999656e", "eventTime": "2019-08-16T08:47:03Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bcf1487d-fdb0-48b6-ae4d-b2405999656e", "record_id": "flaws_cloudtrail:0000300:bcf1487d-fdb0-48b6-ae4d-b2405999656e", "row_index": 300, "timestamp": "2019-08-16T08:47:03Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 774, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bcf1487d-fdb0-48b6-ae4d-b2405999656e", "eventTime": "2019-08-16T08:47:03Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "309c2ebf-a893-4ae6-b1d2-286d4f7c73d5", "record_id": "flaws_cloudtrail:0000301:309c2ebf-a893-4ae6-b1d2-286d4f7c73d5", "row_index": 301, "timestamp": "2019-08-16T08:47:04Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 774, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "309c2ebf-a893-4ae6-b1d2-286d4f7c73d5", "eventTime": "2019-08-16T08:47:04Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ac68ac7a-4104-47ae-9056-60e1d43327a9", "record_id": "flaws_cloudtrail:0000302:ac68ac7a-4104-47ae-9056-60e1d43327a9", "row_index": 302, "timestamp": "2019-08-16T08:47:04Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 774, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ac68ac7a-4104-47ae-9056-60e1d43327a9", "eventTime": "2019-08-16T08:47:04Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "309c2ebf-a893-4ae6-b1d2-286d4f7c73d5", "record_id": "flaws_cloudtrail:0000303:309c2ebf-a893-4ae6-b1d2-286d4f7c73d5", "row_index": 303, "timestamp": "2019-08-16T08:47:04Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 774, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "309c2ebf-a893-4ae6-b1d2-286d4f7c73d5", "eventTime": "2019-08-16T08:47:04Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ac68ac7a-4104-47ae-9056-60e1d43327a9", "record_id": "flaws_cloudtrail:0000304:ac68ac7a-4104-47ae-9056-60e1d43327a9", "row_index": 304, "timestamp": "2019-08-16T08:47:04Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 774, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ac68ac7a-4104-47ae-9056-60e1d43327a9", "eventTime": "2019-08-16T08:47:04Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f845b16a-ba37-49a1-8ee4-39700bed1b", "record_id": "flaws_cloudtrail:0000305:f845b16a-ba37-49a1-8ee4-39700bed1b", "row_index": 305, "timestamp": "2019-08-16T08:47:05Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 770, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f845b16a-ba37-49a1-8ee4-39700bed1b", "eventTime": "2019-08-16T08:47:05Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f845b16a-ba37-49a1-8ee4-39700bed1b", "record_id": "flaws_cloudtrail:0000306:f845b16a-ba37-49a1-8ee4-39700bed1b", "row_index": 306, "timestamp": "2019-08-16T08:47:05Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 770, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f845b16a-ba37-49a1-8ee4-39700bed1b", "eventTime": "2019-08-16T08:47:05Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f26221c7-ec5e-4663-af60-6ece40cfbadf", "record_id": "flaws_cloudtrail:0000307:f26221c7-ec5e-4663-af60-6ece40cfbadf", "row_index": 307, "timestamp": "2019-08-16T08:47:11Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 774, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f26221c7-ec5e-4663-af60-6ece40cfbadf", "eventTime": "2019-08-16T08:47:11Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "17c355d7-46be-41c8-8fa3-005f3c22a959", "record_id": "flaws_cloudtrail:0000308:17c355d7-46be-41c8-8fa3-005f3c22a959", "row_index": 308, "timestamp": "2019-08-16T08:47:11Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 774, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "17c355d7-46be-41c8-8fa3-005f3c22a959", "eventTime": "2019-08-16T08:47:11Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f26221c7-ec5e-4663-af60-6ece40cfbadf", "record_id": "flaws_cloudtrail:0000309:f26221c7-ec5e-4663-af60-6ece40cfbadf", "row_index": 309, "timestamp": "2019-08-16T08:47:11Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 774, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f26221c7-ec5e-4663-af60-6ece40cfbadf", "eventTime": "2019-08-16T08:47:11Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "17c355d7-46be-41c8-8fa3-005f3c22a959", "record_id": "flaws_cloudtrail:0000310:17c355d7-46be-41c8-8fa3-005f3c22a959", "row_index": 310, "timestamp": "2019-08-16T08:47:11Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 774, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "17c355d7-46be-41c8-8fa3-005f3c22a959", "eventTime": "2019-08-16T08:47:11Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d2ff1f0f-218b-4f87-9d61-869147eed86f", "record_id": "flaws_cloudtrail:0000311:d2ff1f0f-218b-4f87-9d61-869147eed86f", "row_index": 311, "timestamp": "2019-08-16T08:47:12Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 774, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d2ff1f0f-218b-4f87-9d61-869147eed86f", "eventTime": "2019-08-16T08:47:12Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a64a13a0-67ca-455f-899a-d6b8caaeec51", "record_id": "flaws_cloudtrail:0000312:a64a13a0-67ca-455f-899a-d6b8caaeec51", "row_index": 312, "timestamp": "2019-08-16T08:47:12Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 774, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a64a13a0-67ca-455f-899a-d6b8caaeec51", "eventTime": "2019-08-16T08:47:12Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d2ff1f0f-218b-4f87-9d61-869147eed86f", "record_id": "flaws_cloudtrail:0000313:d2ff1f0f-218b-4f87-9d61-869147eed86f", "row_index": 313, "timestamp": "2019-08-16T08:47:12Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 774, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d2ff1f0f-218b-4f87-9d61-869147eed86f", "eventTime": "2019-08-16T08:47:12Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a64a13a0-67ca-455f-899a-d6b8caaeec51", "record_id": "flaws_cloudtrail:0000314:a64a13a0-67ca-455f-899a-d6b8caaeec51", "row_index": 314, "timestamp": "2019-08-16T08:47:12Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 774, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a64a13a0-67ca-455f-899a-d6b8caaeec51", "eventTime": "2019-08-16T08:47:12Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "eb400ff8-7b36-4ea3-8b28-ca976cdd89e2", "record_id": "flaws_cloudtrail:0000315:eb400ff8-7b36-4ea3-8b28-ca976cdd89e2", "row_index": 315, "timestamp": "2019-08-16T08:47:28Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 769, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "eb400ff8-7b36-4ea3-8b28-ca976cdd89e2", "eventTime": "2019-08-16T08:47:28Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "eb400ff8-7b36-4ea3-8b28-ca976cdd89e2", "record_id": "flaws_cloudtrail:0000316:eb400ff8-7b36-4ea3-8b28-ca976cdd89e2", "row_index": 316, "timestamp": "2019-08-16T08:47:28Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 769, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "eb400ff8-7b36-4ea3-8b28-ca976cdd89e2", "eventTime": "2019-08-16T08:47:28Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1e822494e-0d0a-4de2-87de-88637eb5ecba", "record_id": "flaws_cloudtrail:0000317:1e822494e-0d0a-4de2-87de-88637eb5ecba", "row_index": 317, "timestamp": "2019-08-16T08:47:29Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 775, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1e822494e-0d0a-4de2-87de-88637eb5ecba", "eventTime": "2019-08-16T08:47:29Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1e822494e-0d0a-4de2-87de-88637eb5ecba", "record_id": "flaws_cloudtrail:0000318:1e822494e-0d0a-4de2-87de-88637eb5ecba", "row_index": 318, "timestamp": "2019-08-16T08:47:29Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 775, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1e822494e-0d0a-4de2-87de-88637eb5ecba", "eventTime": "2019-08-16T08:47:29Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "61fc702d-2c56-46f0-b5f9-b752f9a888f1", "record_id": "flaws_cloudtrail:0000319:61fc702d-2c56-46f0-b5f9-b752f9a888f1", "row_index": 319, "timestamp": "2019-08-16T08:47:37Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 774, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "61fc702d-2c56-46f0-b5f9-b752f9a888f1", "eventTime": "2019-08-16T08:47:37Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "786892ee8-d34a-44ec-b7d6-98b0ea72d311", "record_id": "flaws_cloudtrail:0000320:786892ee8-d34a-44ec-b7d6-98b0ea72d311", "row_index": 320, "timestamp": "2019-08-16T08:47:37Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 775, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "786892ee8-d34a-44ec-b7d6-98b0ea72d311", "eventTime": "2019-08-16T08:47:37Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "61fc702d-2c56-46f0-b5f9-b752f9a888f1", "record_id": "flaws_cloudtrail:0000321:61fc702d-2c56-46f0-b5f9-b752f9a888f1", "row_index": 321, "timestamp": "2019-08-16T08:47:37Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 774, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "61fc702d-2c56-46f0-b5f9-b752f9a888f1", "eventTime": "2019-08-16T08:47:37Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "786892ee8-d34a-44ec-b7d6-98b0ea72d311", "record_id": "flaws_cloudtrail:0000322:786892ee8-d34a-44ec-b7d6-98b0ea72d311", "row_index": 322, "timestamp": "2019-08-16T08:47:37Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 775, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "786892ee8-d34a-44ec-b7d6-98b0ea72d311", "eventTime": "2019-08-16T08:47:37Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f7b4cedc-356a-4bb8-9140-9c8a299f8ac3", "record_id": "flaws_cloudtrail:0000323:f7b4cedc-356a-4bb8-9140-9c8a299f8ac3", "row_index": 323, "timestamp": "2019-08-16T08:47:43Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 774, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f7b4cedc-356a-4bb8-9140-9c8a299f8ac3", "eventTime": "2019-08-16T08:47:43Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "609987e-ab2d-4094-bf1d-6f31b99bca5d", "record_id": "flaws_cloudtrail:0000324:609987e-ab2d-4094-bf1d-6f31b99bca5d", "row_index": 324, "timestamp": "2019-08-16T08:47:43Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 774, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "609987e-ab2d-4094-bf1d-6f31b99bca5d", "eventTime": "2019-08-16T08:47:43Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f7b4cedc-356a-4bb8-9140-9c8a299f8ac3", "record_id": "flaws_cloudtrail:0000325:f7b4cedc-356a-4bb8-9140-9c8a299f8ac3", "row_index": 325, "timestamp": "2019-08-16T08:47:43Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 774, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f7b4cedc-356a-4bb8-9140-9c8a299f8ac3", "eventTime": "2019-08-16T08:47:43Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "609987e-ab2d-4094-bf1d-6f31b99bca5d", "record_id": "flaws_cloudtrail:0000326:609987e-ab2d-4094-bf1d-6f31b99bca5d", "row_index": 326, "timestamp": "2019-08-16T08:47:43Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 774, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "609987e-ab2d-4094-bf1d-6f31b99bca5d", "eventTime": "2019-08-16T08:47:43Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cfff6133-a99a-44ce-9407-fd5b9f40a17a", "record_id": "flaws_cloudtrail:0000327:cfff6133-a99a-44ce-9407-fd5b9f40a17a", "row_index": 327, "timestamp": "2019-08-16T08:47:49Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 774, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cfff6133-a99a-44ce-9407-fd5b9f40a17a", "eventTime": "2019-08-16T08:47:49Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "af31cf61-0ca7-4533-b7a7-b63d258a044c", "record_id": "flaws_cloudtrail:0000328:af31cf61-0ca7-4533-b7a7-b63d258a044c", "row_index": 328, "timestamp": "2019-08-16T08:47:49Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 771, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "af31cf61-0ca7-4533-b7a7-b63d258a044c", "eventTime": "2019-08-16T08:47:49Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cfff6133-a99a-44ce-9407-fd5b9f40a17a", "record_id": "flaws_cloudtrail:0000329:cfff6133-a99a-44ce-9407-fd5b9f40a17a", "row_index": 329, "timestamp": "2019-08-16T08:47:49Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 774, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cfff6133-a99a-44ce-9407-fd5b9f40a17a", "eventTime": "2019-08-16T08:47:49Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "af31cf61-0ca7-4533-b7a7-b63d258a044c", "record_id": "flaws_cloudtrail:0000330:af31cf61-0ca7-4533-b7a7-b63d258a044c", "row_index": 330, "timestamp": "2019-08-16T08:47:49Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 771, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "af31cf61-0ca7-4533-b7a7-b63d258a044c", "eventTime": "2019-08-16T08:47:49Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bfa3e5d2-b573-43a0-b133-0dc2985a909f", "record_id": "flaws_cloudtrail:0000331:bfa3e5d2-b573-43a0-b133-0dc2985a909f", "row_index": 331, "timestamp": "2019-08-16T08:47:50Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 774, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bfa3e5d2-b573-43a0-b133-0dc2985a909f", "eventTime": "2019-08-16T08:47:50Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bfa3e5d2-b573-43a0-b133-0dc2985a909f", "record_id": "flaws_cloudtrail:0000332:bfa3e5d2-b573-43a0-b133-0dc2985a909f", "row_index": 332, "timestamp": "2019-08-16T08:47:50Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 774, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bfa3e5d2-b573-43a0-b133-0dc2985a909f", "eventTime": "2019-08-16T08:47:50Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "61de8e7a-a449-4f3c-af6f-42bfb7151c0b", "record_id": "flaws_cloudtrail:0000333:61de8e7a-a449-4f3c-af6f-42bfb7151c0b", "row_index": 333, "timestamp": "2019-08-16T08:47:51Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 774, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "61de8e7a-a449-4f3c-af6f-42bfb7151c0b", "eventTime": "2019-08-16T08:47:51Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cad4dd32-887b-46cb-9080-bfbbfd27b858", "record_id": "flaws_cloudtrail:0000334:cad4dd32-887b-46cb-9080-bfbbfd27b858", "row_index": 334, "timestamp": "2019-08-16T08:47:51Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 774, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cad4dd32-887b-46cb-9080-bfbbfd27b858", "eventTime": "2019-08-16T08:47:51Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "61de8e7a-a449-4f3c-af6f-42bfb7151c0b", "record_id": "flaws_cloudtrail:0000335:61de8e7a-a449-4f3c-af6f-42bfb7151c0b", "row_index": 335, "timestamp": "2019-08-16T08:47:51Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 774, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "61de8e7a-a449-4f3c-af6f-42bfb7151c0b", "eventTime": "2019-08-16T08:47:51Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cad4dd32-887b-46cb-9080-bfbbfd27b858", "record_id": "flaws_cloudtrail:0000336:cad4dd32-887b-46cb-9080-bfbbfd27b858", "row_index": 336, "timestamp": "2019-08-16T08:47:51Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 774, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cad4dd32-887b-46cb-9080-bfbbfd27b858", "eventTime": "2019-08-16T08:47:51Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bf378e9e-34dc-44b7-961d-2e20cc62ba5b", "record_id": "flaws_cloudtrail:0000337:bf378e9e-34dc-44b7-961d-2e20cc62ba5b", "row_index": 337, "timestamp": "2019-08-16T08:47:52Z", "event_type": "GetAccountPasswordPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 842, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bf378e9e-34dc-44b7-961d-2e20cc62ba5b", "eventTime": "2019-08-16T08:47:52Z", "eventName": "GetAccountPasswordPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: iam:GetAccountPasswordPolicy on resource: *", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "aeb08522-96cb-477e-b3b3-dc638ccca1ec", "record_id": "flaws_cloudtrail:0000338:aeb08522-96cb-477e-b3b3-dc638ccca1ec", "row_index": 338, "timestamp": "2019-08-16T08:47:52Z", "event_type": "ListRoles", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 842, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "aeb08522-96cb-477e-b3b3-dc638ccca1ec", "eventTime": "2019-08-16T08:47:52Z", "eventName": "ListRoles", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: iam:ListRoles on resource: arn:aws:iam::811596193553:role/", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5c0e89cb-ca52-4f61-92bc-46092c080a4e", "record_id": "flaws_cloudtrail:0000339:5c0e89cb-ca52-4f61-92bc-46092c080a4e", "row_index": 339, "timestamp": "2019-08-16T08:47:52Z", "event_type": "ListGroups", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 845, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5c0e89cb-ca52-4f61-92bc-46092c080a4e", "eventTime": "2019-08-16T08:47:52Z", "eventName": "ListGroups", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: iam:ListGroups on resource: arn:aws:iam::811596193553:group/", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bf378e9e-34dc-44b7-961d-2e20cc62ba5b", "record_id": "flaws_cloudtrail:0000340:bf378e9e-34dc-44b7-961d-2e20cc62ba5b", "row_index": 340, "timestamp": "2019-08-16T08:47:52Z", "event_type": "GetAccountPasswordPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 842, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bf378e9e-34dc-44b7-961d-2e20cc62ba5b", "eventTime": "2019-08-16T08:47:52Z", "eventName": "GetAccountPasswordPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: iam:GetAccountPasswordPolicy on resource: *", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "aeb08522-96cb-477e-b3b3-dc638ccca1ec", "record_id": "flaws_cloudtrail:0000341:aeb08522-96cb-477e-b3b3-dc638ccca1ec", "row_index": 341, "timestamp": "2019-08-16T08:47:52Z", "event_type": "ListRoles", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 842, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "aeb08522-96cb-477e-b3b3-dc638ccca1ec", "eventTime": "2019-08-16T08:47:52Z", "eventName": "ListRoles", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: iam:ListRoles on resource: arn:aws:iam::811596193553:role/", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5c0e89cb-ca52-4f61-92bc-46092c080a4e", "record_id": "flaws_cloudtrail:0000342:5c0e89cb-ca52-4f61-92bc-46092c080a4e", "row_index": 342, "timestamp": "2019-08-16T08:47:52Z", "event_type": "ListGroups", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 845, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5c0e89cb-ca52-4f61-92bc-46092c080a4e", "eventTime": "2019-08-16T08:47:52Z", "eventName": "ListGroups", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: iam:ListGroups on resource: arn:aws:iam::811596193553:group/", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "71acc558-1f2d-48a8-bb5f-5a3975840c01", "record_id": "flaws_cloudtrail:0000343:71acc558-1f2d-48a8-bb5f-5a3975840c01", "row_index": 343, "timestamp": "2019-08-16T08:47:53Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 833, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "71acc558-1f2d-48a8-bb5f-5a3975840c01", "eventTime": "2019-08-16T08:47:53Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-south-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: lambda:ListFunctions on resource: *", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "71acc558-1f2d-48a8-bb5f-5a3975840c01", "record_id": "flaws_cloudtrail:0000344:71acc558-1f2d-48a8-bb5f-5a3975840c01", "row_index": 344, "timestamp": "2019-08-16T08:47:53Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 833, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "71acc558-1f2d-48a8-bb5f-5a3975840c01", "eventTime": "2019-08-16T08:47:53Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-south-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: lambda:ListFunctions on resource: *", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f5c7705d-c637-4e19-87f4-5b93eb985d6b", "record_id": "flaws_cloudtrail:0000345:f5c7705d-c637-4e19-87f4-5b93eb985d6b", "row_index": 345, "timestamp": "2019-08-16T08:47:54Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 837, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f5c7705d-c637-4e19-87f4-5b93eb985d6b", "eventTime": "2019-08-16T08:47:54Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-northeast-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: lambda:ListFunctions on resource: *", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "38f11d1d-fe95-46db-8e19-92d55d0c6c36", "record_id": "flaws_cloudtrail:0000346:38f11d1d-fe95-46db-8e19-92d55d0c6c36", "row_index": 346, "timestamp": "2019-08-16T08:47:54Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 833, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "38f11d1d-fe95-46db-8e19-92d55d0c6c36", "eventTime": "2019-08-16T08:47:54Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-southeast-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: lambda:ListFunctions on resource: *", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "170417-bb0c-4d71-bc37-bebefa97c383", "record_id": "flaws_cloudtrail:0000347:170417-bb0c-4d71-bc37-bebefa97c383", "row_index": 347, "timestamp": "2019-08-16T08:47:54Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 833, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "170417-bb0c-4d71-bc37-bebefa97c383", "eventTime": "2019-08-16T08:47:54Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ca-central-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: lambda:ListFunctions on resource: *", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "772d0d0a-e4e7-45c3-821d-79df12a293b1", "record_id": "flaws_cloudtrail:0000348:772d0d0a-e4e7-45c3-821d-79df12a293b1", "row_index": 348, "timestamp": "2019-08-16T08:47:54Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 835, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "772d0d0a-e4e7-45c3-821d-79df12a293b1", "eventTime": "2019-08-16T08:47:54Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-central-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: lambda:ListFunctions on resource: *", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "47fbc1f2-01ef-4629-bbd7-70b38fd88cfa", "record_id": "flaws_cloudtrail:0000349:47fbc1f2-01ef-4629-bbd7-70b38fd88cfa", "row_index": 349, "timestamp": "2019-08-16T08:47:54Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-north-1"}, "resource_arns": [], "raw_record_size_bytes": 833, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "47fbc1f2-01ef-4629-bbd7-70b38fd88cfa", "eventTime": "2019-08-16T08:47:54Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-north-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: lambda:ListFunctions on resource: *", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "506bed92-310d-452e-b02a-42865042f9a2", "record_id": "flaws_cloudtrail:0000350:506bed92-310d-452e-b02a-42865042f9a2", "row_index": 350, "timestamp": "2019-08-16T08:47:54Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 832, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "506bed92-310d-452e-b02a-42865042f9a2", "eventTime": "2019-08-16T08:47:54Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-west-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: lambda:ListFunctions on resource: *", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f5c7705d-c637-4e19-87f4-5b93eb985d6b", "record_id": "flaws_cloudtrail:0000351:f5c7705d-c637-4e19-87f4-5b93eb985d6b", "row_index": 351, "timestamp": "2019-08-16T08:47:54Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 837, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f5c7705d-c637-4e19-87f4-5b93eb985d6b", "eventTime": "2019-08-16T08:47:54Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-northeast-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: lambda:ListFunctions on resource: *", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "38f11d1d-fe95-46db-8e19-92d55d0c6c36", "record_id": "flaws_cloudtrail:0000352:38f11d1d-fe95-46db-8e19-92d55d0c6c36", "row_index": 352, "timestamp": "2019-08-16T08:47:54Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 833, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "38f11d1d-fe95-46db-8e19-92d55d0c6c36", "eventTime": "2019-08-16T08:47:54Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-southeast-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: lambda:ListFunctions on resource: *", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "170417-bb0c-4d71-bc37-bebefa97c383", "record_id": "flaws_cloudtrail:0000353:170417-bb0c-4d71-bc37-bebefa97c383", "row_index": 353, "timestamp": "2019-08-16T08:47:54Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 833, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "170417-bb0c-4d71-bc37-bebefa97c383", "eventTime": "2019-08-16T08:47:54Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ca-central-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: lambda:ListFunctions on resource: *", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "772d0d0a-e4e7-45c3-821d-79df12a293b1", "record_id": "flaws_cloudtrail:0000354:772d0d0a-e4e7-45c3-821d-79df12a293b1", "row_index": 354, "timestamp": "2019-08-16T08:47:54Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 835, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "772d0d0a-e4e7-45c3-821d-79df12a293b1", "eventTime": "2019-08-16T08:47:54Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-central-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: lambda:ListFunctions on resource: *", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "47fbc1f2-01ef-4629-bbd7-70b38fd88cfa", "record_id": "flaws_cloudtrail:0000355:47fbc1f2-01ef-4629-bbd7-70b38fd88cfa", "row_index": 355, "timestamp": "2019-08-16T08:47:54Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-north-1"}, "resource_arns": [], "raw_record_size_bytes": 833, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "47fbc1f2-01ef-4629-bbd7-70b38fd88cfa", "eventTime": "2019-08-16T08:47:54Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-north-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: lambda:ListFunctions on resource: *", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "506bed92-310d-452e-b02a-42865042f9a2", "record_id": "flaws_cloudtrail:0000356:506bed92-310d-452e-b02a-42865042f9a2", "row_index": 356, "timestamp": "2019-08-16T08:47:54Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 832, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "506bed92-310d-452e-b02a-42865042f9a2", "eventTime": "2019-08-16T08:47:54Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-west-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: lambda:ListFunctions on resource: *", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "90fdb619-a267-47a8-8962-1ef34ee1757f", "record_id": "flaws_cloudtrail:0000357:90fdb619-a267-47a8-8962-1ef34ee1757f", "row_index": 357, "timestamp": "2019-08-16T08:47:55Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 837, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "90fdb619-a267-47a8-8962-1ef34ee1757f", "eventTime": "2019-08-16T08:47:55Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-northeast-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: lambda:ListFunctions on resource: *", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ef9f8194-d3ab-48dc-88cb-bc4338aa3030", "record_id": "flaws_cloudtrail:0000358:ef9f8194-d3ab-48dc-88cb-bc4338aa3030", "row_index": 358, "timestamp": "2019-08-16T08:47:55Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 837, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ef9f8194-d3ab-48dc-88cb-bc4338aa3030", "eventTime": "2019-08-16T08:47:55Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-southeast-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: lambda:ListFunctions on resource: *", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "22b32a58-c43b-4052-b88b-575053cfef44", "record_id": "flaws_cloudtrail:0000359:22b32a58-c43b-4052-b88b-575053cfef44", "row_index": 359, "timestamp": "2019-08-16T08:47:55Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 832, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "22b32a58-c43b-4052-b88b-575053cfef44", "eventTime": "2019-08-16T08:47:55Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: lambda:ListFunctions on resource: *", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "90fdb619-a267-47a8-8962-1ef34ee1757f", "record_id": "flaws_cloudtrail:0000360:90fdb619-a267-47a8-8962-1ef34ee1757f", "row_index": 360, "timestamp": "2019-08-16T08:47:55Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 837, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "90fdb619-a267-47a8-8962-1ef34ee1757f", "eventTime": "2019-08-16T08:47:55Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-northeast-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: lambda:ListFunctions on resource: *", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ef9f8194-d3ab-48dc-88cb-bc4338aa3030", "record_id": "flaws_cloudtrail:0000361:ef9f8194-d3ab-48dc-88cb-bc4338aa3030", "row_index": 361, "timestamp": "2019-08-16T08:47:55Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 837, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ef9f8194-d3ab-48dc-88cb-bc4338aa3030", "eventTime": "2019-08-16T08:47:55Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-southeast-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: lambda:ListFunctions on resource: *", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "22b32a58-c43b-4052-b88b-575053cfef44", "record_id": "flaws_cloudtrail:0000362:22b32a58-c43b-4052-b88b-575053cfef44", "row_index": 362, "timestamp": "2019-08-16T08:47:55Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 832, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "22b32a58-c43b-4052-b88b-575053cfef44", "eventTime": "2019-08-16T08:47:55Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: lambda:ListFunctions on resource: *", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ebf93d7d-2fcd-463e-9ddf-7206e0f29503", "record_id": "flaws_cloudtrail:0000363:ebf93d7d-2fcd-463e-9ddf-7206e0f29503", "row_index": 363, "timestamp": "2019-08-16T08:47:56Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 832, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ebf93d7d-2fcd-463e-9ddf-7206e0f29503", "eventTime": "2019-08-16T08:47:56Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "sa-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: lambda:ListFunctions on resource: *", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ebf93d7d-2fcd-463e-9ddf-7206e0f29503", "record_id": "flaws_cloudtrail:0000364:ebf93d7d-2fcd-463e-9ddf-7206e0f29503", "row_index": 364, "timestamp": "2019-08-16T08:47:56Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 832, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ebf93d7d-2fcd-463e-9ddf-7206e0f29503", "eventTime": "2019-08-16T08:47:56Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "sa-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: lambda:ListFunctions on resource: *", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "765c4f61-7971-4f97-8913-23fb48580fec", "record_id": "flaws_cloudtrail:0000365:765c4f61-7971-4f97-8913-23fb48580fec", "row_index": 365, "timestamp": "2019-08-16T08:47:58Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "[Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209]", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 814, "raw_record_depth": 3, "raw_record_top_level_keys": ["additionalEventData", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "765c4f61-7971-4f97-8913-23fb48580fec", "eventTime": "2019-08-16T08:47:58Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "[Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209]", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"host": ["s3.eu-west-1.amazonaws.com"]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "04f2692b-c76b-4f04-8a41-45e03794e55", "record_id": "flaws_cloudtrail:0000366:04f2692b-c76b-4f04-8a41-45e03794e55", "row_index": 366, "timestamp": "2019-08-16T08:47:58Z", "event_type": "ListUsers", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 841, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "04f2692b-c76b-4f04-8a41-45e03794e55", "eventTime": "2019-08-16T08:47:58Z", "eventName": "ListUsers", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: iam:ListUsers on resource: arn:aws:iam::811596193553:user/", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0457a47e-cdab-4fc5-860d-e0514da908d2", "record_id": "flaws_cloudtrail:0000367:0457a47e-cdab-4fc5-860d-e0514da908d2", "row_index": 367, "timestamp": "2019-08-16T08:47:58Z", "event_type": "GenerateCredentialReport", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 842, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0457a47e-cdab-4fc5-860d-e0514da908d2", "eventTime": "2019-08-16T08:47:58Z", "eventName": "GenerateCredentialReport", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: iam:GenerateCredentialReport on resource: *", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9eb46cd2-2554-4b0e-a0f2-2a60778ce036", "record_id": "flaws_cloudtrail:0000368:9eb46cd2-2554-4b0e-a0f2-2a60778ce036", "row_index": 368, "timestamp": "2019-08-16T08:47:58Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 832, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9eb46cd2-2554-4b0e-a0f2-2a60778ce036", "eventTime": "2019-08-16T08:47:58Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-west-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: lambda:ListFunctions on resource: *", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "765c4f61-7971-4f97-8913-23fb48580fec", "record_id": "flaws_cloudtrail:0000369:765c4f61-7971-4f97-8913-23fb48580fec", "row_index": 369, "timestamp": "2019-08-16T08:47:58Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "[Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209]", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 814, "raw_record_depth": 3, "raw_record_top_level_keys": ["additionalEventData", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "765c4f61-7971-4f97-8913-23fb48580fec", "eventTime": "2019-08-16T08:47:58Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "[Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209]", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"host": ["s3.eu-west-1.amazonaws.com"]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "04f2692b-c76b-4f04-8a41-45e03794e55", "record_id": "flaws_cloudtrail:0000370:04f2692b-c76b-4f04-8a41-45e03794e55", "row_index": 370, "timestamp": "2019-08-16T08:47:58Z", "event_type": "ListUsers", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 841, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "04f2692b-c76b-4f04-8a41-45e03794e55", "eventTime": "2019-08-16T08:47:58Z", "eventName": "ListUsers", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: iam:ListUsers on resource: arn:aws:iam::811596193553:user/", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0457a47e-cdab-4fc5-860d-e0514da908d2", "record_id": "flaws_cloudtrail:0000371:0457a47e-cdab-4fc5-860d-e0514da908d2", "row_index": 371, "timestamp": "2019-08-16T08:47:58Z", "event_type": "GenerateCredentialReport", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 842, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0457a47e-cdab-4fc5-860d-e0514da908d2", "eventTime": "2019-08-16T08:47:58Z", "eventName": "GenerateCredentialReport", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: iam:GenerateCredentialReport on resource: *", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9eb46cd2-2554-4b0e-a0f2-2a60778ce036", "record_id": "flaws_cloudtrail:0000372:9eb46cd2-2554-4b0e-a0f2-2a60778ce036", "row_index": 372, "timestamp": "2019-08-16T08:47:58Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 832, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9eb46cd2-2554-4b0e-a0f2-2a60778ce036", "eventTime": "2019-08-16T08:47:58Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-west-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: lambda:ListFunctions on resource: *", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "aef35d19-bc61-44e5-8d80-77b5f07cb29b", "record_id": "flaws_cloudtrail:0000373:aef35d19-bc61-44e5-8d80-77b5f07cb29b", "row_index": 373, "timestamp": "2019-08-16T08:47:59Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 827, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "aef35d19-bc61-44e5-8d80-77b5f07cb29b", "eventTime": "2019-08-16T08:47:59Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: lambda:ListFunctions on resource: *", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "aef35d19-bc61-44e5-8d80-77b5f07cb29b", "record_id": "flaws_cloudtrail:0000374:aef35d19-bc61-44e5-8d80-77b5f07cb29b", "row_index": 374, "timestamp": "2019-08-16T08:47:59Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 827, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "aef35d19-bc61-44e5-8d80-77b5f07cb29b", "eventTime": "2019-08-16T08:47:59Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: lambda:ListFunctions on resource: *", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "49ec5fe2-550d-49c8-805b-af0ee0eb9fdd", "record_id": "flaws_cloudtrail:0000375:49ec5fe2-550d-49c8-805b-af0ee0eb9fdd", "row_index": 375, "timestamp": "2019-08-16T08:48:01Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 842, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "49ec5fe2-550d-49c8-805b-af0ee0eb9fdd", "eventTime": "2019-08-16T08:48:01Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-northeast-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudtrail:DescribeTrails", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0db9967a-bef2-453d-971e-a9709cae1a44", "record_id": "flaws_cloudtrail:0000376:0db9967a-bef2-453d-971e-a9709cae1a44", "row_index": 376, "timestamp": "2019-08-16T08:48:01Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 842, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0db9967a-bef2-453d-971e-a9709cae1a44", "eventTime": "2019-08-16T08:48:01Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-northeast-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudtrail:DescribeTrails", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8f47d6f2-1e46-41d1-bc37-d00e979b8478", "record_id": "flaws_cloudtrail:0000377:8f47d6f2-1e46-41d1-bc37-d00e979b8478", "row_index": 377, "timestamp": "2019-08-16T08:48:01Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 842, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8f47d6f2-1e46-41d1-bc37-d00e979b8478", "eventTime": "2019-08-16T08:48:01Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-southeast-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudtrail:DescribeTrails", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "574215-bb78-4bb3-b3a5-92d614edef49", "record_id": "flaws_cloudtrail:0000378:574215-bb78-4bb3-b3a5-92d614edef49", "row_index": 378, "timestamp": "2019-08-16T08:48:01Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-north-1"}, "resource_arns": [], "raw_record_size_bytes": 836, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "574215-bb78-4bb3-b3a5-92d614edef49", "eventTime": "2019-08-16T08:48:01Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-north-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudtrail:DescribeTrails", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "793328-7700-4e99-8020-d3b64af611556", "record_id": "flaws_cloudtrail:0000379:793328-7700-4e99-8020-d3b64af611556", "row_index": 379, "timestamp": "2019-08-16T08:48:01Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 836, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "793328-7700-4e99-8020-d3b64af611556", "eventTime": "2019-08-16T08:48:01Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-west-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudtrail:DescribeTrails", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "328f3d31-0440-48ab-9823-57071f0cb", "record_id": "flaws_cloudtrail:0000380:328f3d31-0440-48ab-9823-57071f0cb", "row_index": 380, "timestamp": "2019-08-16T08:48:01Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 828, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "328f3d31-0440-48ab-9823-57071f0cb", "eventTime": "2019-08-16T08:48:01Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-west-3", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: lambda:ListFunctions on resource: *", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5febfd7f-37c5-42f9-8ba4-6407c00af457", "record_id": "flaws_cloudtrail:0000381:5febfd7f-37c5-42f9-8ba4-6407c00af457", "row_index": 381, "timestamp": "2019-08-16T08:48:01Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 832, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5febfd7f-37c5-42f9-8ba4-6407c00af457", "eventTime": "2019-08-16T08:48:01Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: lambda:ListFunctions on resource: *", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "49ec5fe2-550d-49c8-805b-af0ee0eb9fdd", "record_id": "flaws_cloudtrail:0000382:49ec5fe2-550d-49c8-805b-af0ee0eb9fdd", "row_index": 382, "timestamp": "2019-08-16T08:48:01Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 842, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "49ec5fe2-550d-49c8-805b-af0ee0eb9fdd", "eventTime": "2019-08-16T08:48:01Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-northeast-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudtrail:DescribeTrails", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0db9967a-bef2-453d-971e-a9709cae1a44", "record_id": "flaws_cloudtrail:0000383:0db9967a-bef2-453d-971e-a9709cae1a44", "row_index": 383, "timestamp": "2019-08-16T08:48:01Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 842, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0db9967a-bef2-453d-971e-a9709cae1a44", "eventTime": "2019-08-16T08:48:01Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-northeast-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudtrail:DescribeTrails", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8f47d6f2-1e46-41d1-bc37-d00e979b8478", "record_id": "flaws_cloudtrail:0000384:8f47d6f2-1e46-41d1-bc37-d00e979b8478", "row_index": 384, "timestamp": "2019-08-16T08:48:01Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 842, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8f47d6f2-1e46-41d1-bc37-d00e979b8478", "eventTime": "2019-08-16T08:48:01Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-southeast-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudtrail:DescribeTrails", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "574215-bb78-4bb3-b3a5-92d614edef49", "record_id": "flaws_cloudtrail:0000385:574215-bb78-4bb3-b3a5-92d614edef49", "row_index": 385, "timestamp": "2019-08-16T08:48:01Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-north-1"}, "resource_arns": [], "raw_record_size_bytes": 836, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "574215-bb78-4bb3-b3a5-92d614edef49", "eventTime": "2019-08-16T08:48:01Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-north-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudtrail:DescribeTrails", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "793328-7700-4e99-8020-d3b64af611556", "record_id": "flaws_cloudtrail:0000386:793328-7700-4e99-8020-d3b64af611556", "row_index": 386, "timestamp": "2019-08-16T08:48:01Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 836, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "793328-7700-4e99-8020-d3b64af611556", "eventTime": "2019-08-16T08:48:01Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-west-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudtrail:DescribeTrails", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "328f3d31-0440-48ab-9823-57071f0cb", "record_id": "flaws_cloudtrail:0000387:328f3d31-0440-48ab-9823-57071f0cb", "row_index": 387, "timestamp": "2019-08-16T08:48:01Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 828, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "328f3d31-0440-48ab-9823-57071f0cb", "eventTime": "2019-08-16T08:48:01Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-west-3", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: lambda:ListFunctions on resource: *", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5febfd7f-37c5-42f9-8ba4-6407c00af457", "record_id": "flaws_cloudtrail:0000388:5febfd7f-37c5-42f9-8ba4-6407c00af457", "row_index": 388, "timestamp": "2019-08-16T08:48:01Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 832, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5febfd7f-37c5-42f9-8ba4-6407c00af457", "eventTime": "2019-08-16T08:48:01Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: lambda:ListFunctions on resource: *", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "19c3f6da-fb0f-4028-bba5-3b2a055d08cb", "record_id": "flaws_cloudtrail:0000389:19c3f6da-fb0f-4028-bba5-3b2a055d08cb", "row_index": 389, "timestamp": "2019-08-16T08:48:02Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 836, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "19c3f6da-fb0f-4028-bba5-3b2a055d08cb", "eventTime": "2019-08-16T08:48:02Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudtrail:DescribeTrails", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "130efd97-ea40-4149-93bf-b3337b067dc5", "record_id": "flaws_cloudtrail:0000390:130efd97-ea40-4149-93bf-b3337b067dc5", "row_index": 390, "timestamp": "2019-08-16T08:48:02Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 837, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "130efd97-ea40-4149-93bf-b3337b067dc5", "eventTime": "2019-08-16T08:48:02Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-west-3", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudtrail:DescribeTrails", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "19c3f6da-fb0f-4028-bba5-3b2a055d08cb", "record_id": "flaws_cloudtrail:0000391:19c3f6da-fb0f-4028-bba5-3b2a055d08cb", "row_index": 391, "timestamp": "2019-08-16T08:48:02Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 836, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "19c3f6da-fb0f-4028-bba5-3b2a055d08cb", "eventTime": "2019-08-16T08:48:02Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudtrail:DescribeTrails", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "130efd97-ea40-4149-93bf-b3337b067dc5", "record_id": "flaws_cloudtrail:0000392:130efd97-ea40-4149-93bf-b3337b067dc5", "row_index": 392, "timestamp": "2019-08-16T08:48:02Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 837, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "130efd97-ea40-4149-93bf-b3337b067dc5", "eventTime": "2019-08-16T08:48:02Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-west-3", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudtrail:DescribeTrails", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "20087a6c-7c96-4a72-8632-e062aa5229d4", "record_id": "flaws_cloudtrail:0000393:20087a6c-7c96-4a72-8632-e062aa5229d4", "row_index": 393, "timestamp": "2019-08-16T08:48:04Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 838, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "20087a6c-7c96-4a72-8632-e062aa5229d4", "eventTime": "2019-08-16T08:48:04Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-south-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudtrail:DescribeTrails", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8c391a6f-4b68-4c88-87d9-cc81e7e16e87", "record_id": "flaws_cloudtrail:0000394:8c391a6f-4b68-4c88-87d9-cc81e7e16e87", "row_index": 394, "timestamp": "2019-08-16T08:48:04Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 837, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8c391a6f-4b68-4c88-87d9-cc81e7e16e87", "eventTime": "2019-08-16T08:48:04Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "sa-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudtrail:DescribeTrails", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b9a3886d-c14a-473c-b113-d1b8b5463d06", "record_id": "flaws_cloudtrail:0000395:b9a3886d-c14a-473c-b113-d1b8b5463d06", "row_index": 395, "timestamp": "2019-08-16T08:48:04Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 832, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b9a3886d-c14a-473c-b113-d1b8b5463d06", "eventTime": "2019-08-16T08:48:04Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: lambda:ListFunctions on resource: *", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "89f30c99-7a43-4e3d-8870-32a649cc08c9", "record_id": "flaws_cloudtrail:0000396:89f30c99-7a43-4e3d-8870-32a649cc08c9", "row_index": 396, "timestamp": "2019-08-16T08:48:04Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 838, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "89f30c99-7a43-4e3d-8870-32a649cc08c9", "eventTime": "2019-08-16T08:48:04Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudtrail:DescribeTrails", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e1e7504c-b3c4-4e28-aade-3db5b923c03e", "record_id": "flaws_cloudtrail:0000397:e1e7504c-b3c4-4e28-aade-3db5b923c03e", "row_index": 397, "timestamp": "2019-08-16T08:48:04Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 837, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e1e7504c-b3c4-4e28-aade-3db5b923c03e", "eventTime": "2019-08-16T08:48:04Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-west-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudtrail:DescribeTrails", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "20087a6c-7c96-4a72-8632-e062aa5229d4", "record_id": "flaws_cloudtrail:0000398:20087a6c-7c96-4a72-8632-e062aa5229d4", "row_index": 398, "timestamp": "2019-08-16T08:48:04Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 838, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "20087a6c-7c96-4a72-8632-e062aa5229d4", "eventTime": "2019-08-16T08:48:04Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-south-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudtrail:DescribeTrails", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8c391a6f-4b68-4c88-87d9-cc81e7e16e87", "record_id": "flaws_cloudtrail:0000399:8c391a6f-4b68-4c88-87d9-cc81e7e16e87", "row_index": 399, "timestamp": "2019-08-16T08:48:04Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 837, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8c391a6f-4b68-4c88-87d9-cc81e7e16e87", "eventTime": "2019-08-16T08:48:04Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "sa-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudtrail:DescribeTrails", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b9a3886d-c14a-473c-b113-d1b8b5463d06", "record_id": "flaws_cloudtrail:0000400:b9a3886d-c14a-473c-b113-d1b8b5463d06", "row_index": 400, "timestamp": "2019-08-16T08:48:04Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 832, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b9a3886d-c14a-473c-b113-d1b8b5463d06", "eventTime": "2019-08-16T08:48:04Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: lambda:ListFunctions on resource: *", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "89f30c99-7a43-4e3d-8870-32a649cc08c9", "record_id": "flaws_cloudtrail:0000401:89f30c99-7a43-4e3d-8870-32a649cc08c9", "row_index": 401, "timestamp": "2019-08-16T08:48:04Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 838, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "89f30c99-7a43-4e3d-8870-32a649cc08c9", "eventTime": "2019-08-16T08:48:04Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudtrail:DescribeTrails", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e1e7504c-b3c4-4e28-aade-3db5b923c03e", "record_id": "flaws_cloudtrail:0000402:e1e7504c-b3c4-4e28-aade-3db5b923c03e", "row_index": 402, "timestamp": "2019-08-16T08:48:04Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 837, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e1e7504c-b3c4-4e28-aade-3db5b923c03e", "eventTime": "2019-08-16T08:48:04Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-west-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudtrail:DescribeTrails", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "67f797760-51b7-429c-b2d7-f1441bfc0dbc", "record_id": "flaws_cloudtrail:0000403:67f797760-51b7-429c-b2d7-f1441bfc0dbc", "row_index": 403, "timestamp": "2019-08-16T08:48:05Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 843, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "67f797760-51b7-429c-b2d7-f1441bfc0dbc", "eventTime": "2019-08-16T08:48:05Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-southeast-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudtrail:DescribeTrails", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ca43cdc0-0df0-4770-aecb-01b5cc5d140e", "record_id": "flaws_cloudtrail:0000404:ca43cdc0-0df0-4770-aecb-01b5cc5d140e", "row_index": 404, "timestamp": "2019-08-16T08:48:05Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 837, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ca43cdc0-0df0-4770-aecb-01b5cc5d140e", "eventTime": "2019-08-16T08:48:05Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudtrail:DescribeTrails", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "412a5097-f82d-4d24-839c-8153b3494bdf", "record_id": "flaws_cloudtrail:0000405:412a5097-f82d-4d24-839c-8153b3494bdf", "row_index": 405, "timestamp": "2019-08-16T08:48:05Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 837, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "412a5097-f82d-4d24-839c-8153b3494bdf", "eventTime": "2019-08-16T08:48:05Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudtrail:DescribeTrails", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "67f797760-51b7-429c-b2d7-f1441bfc0dbc", "record_id": "flaws_cloudtrail:0000406:67f797760-51b7-429c-b2d7-f1441bfc0dbc", "row_index": 406, "timestamp": "2019-08-16T08:48:05Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 843, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "67f797760-51b7-429c-b2d7-f1441bfc0dbc", "eventTime": "2019-08-16T08:48:05Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-southeast-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudtrail:DescribeTrails", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ca43cdc0-0df0-4770-aecb-01b5cc5d140e", "record_id": "flaws_cloudtrail:0000407:ca43cdc0-0df0-4770-aecb-01b5cc5d140e", "row_index": 407, "timestamp": "2019-08-16T08:48:05Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 837, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ca43cdc0-0df0-4770-aecb-01b5cc5d140e", "eventTime": "2019-08-16T08:48:05Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudtrail:DescribeTrails", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "412a5097-f82d-4d24-839c-8153b3494bdf", "record_id": "flaws_cloudtrail:0000408:412a5097-f82d-4d24-839c-8153b3494bdf", "row_index": 408, "timestamp": "2019-08-16T08:48:05Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 837, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "412a5097-f82d-4d24-839c-8153b3494bdf", "eventTime": "2019-08-16T08:48:05Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudtrail:DescribeTrails", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dc78106-5677-4f00-89a8-21892f47d4e1", "record_id": "flaws_cloudtrail:0000409:dc78106-5677-4f00-89a8-21892f47d4e1", "row_index": 409, "timestamp": "2019-08-16T08:48:06Z", "event_type": "ListStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 825, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dc78106-5677-4f00-89a8-21892f47d4e1", "eventTime": "2019-08-16T08:48:06Z", "eventName": "ListStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-northeast-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudformation:ListStacks", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "99d587e5-67db-45f2-9d20-c14d6e910afa", "record_id": "flaws_cloudtrail:0000410:99d587e5-67db-45f2-9d20-c14d6e910afa", "row_index": 410, "timestamp": "2019-08-16T08:48:06Z", "event_type": "ListStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 826, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "99d587e5-67db-45f2-9d20-c14d6e910afa", "eventTime": "2019-08-16T08:48:06Z", "eventName": "ListStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-southeast-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudformation:ListStacks", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dc78106-5677-4f00-89a8-21892f47d4e1", "record_id": "flaws_cloudtrail:0000411:dc78106-5677-4f00-89a8-21892f47d4e1", "row_index": 411, "timestamp": "2019-08-16T08:48:06Z", "event_type": "ListStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 825, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dc78106-5677-4f00-89a8-21892f47d4e1", "eventTime": "2019-08-16T08:48:06Z", "eventName": "ListStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-northeast-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudformation:ListStacks", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "99d587e5-67db-45f2-9d20-c14d6e910afa", "record_id": "flaws_cloudtrail:0000412:99d587e5-67db-45f2-9d20-c14d6e910afa", "row_index": 412, "timestamp": "2019-08-16T08:48:06Z", "event_type": "ListStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 826, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "99d587e5-67db-45f2-9d20-c14d6e910afa", "eventTime": "2019-08-16T08:48:06Z", "eventName": "ListStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-southeast-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudformation:ListStacks", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "571110ae-cd4f-4f94-9dd6-fa86ea2fa4dd", "record_id": "flaws_cloudtrail:0000413:571110ae-cd4f-4f94-9dd6-fa86ea2fa4dd", "row_index": 413, "timestamp": "2019-08-16T08:48:07Z", "event_type": "ListStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 826, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "571110ae-cd4f-4f94-9dd6-fa86ea2fa4dd", "eventTime": "2019-08-16T08:48:07Z", "eventName": "ListStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-southeast-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudformation:ListStacks", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6c33fbe3-62c0-4e6d-91c6-f247190", "record_id": "flaws_cloudtrail:0000414:6c33fbe3-62c0-4e6d-91c6-f247190", "row_index": 414, "timestamp": "2019-08-16T08:48:07Z", "event_type": "ListStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 820, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6c33fbe3-62c0-4e6d-91c6-f247190", "eventTime": "2019-08-16T08:48:07Z", "eventName": "ListStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ca-central-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudformation:ListStacks", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "138d9b49-501b-4b53-af6b-aaa28246a1c5", "record_id": "flaws_cloudtrail:0000415:138d9b49-501b-4b53-af6b-aaa28246a1c5", "row_index": 415, "timestamp": "2019-08-16T08:48:07Z", "event_type": "ListStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-north-1"}, "resource_arns": [], "raw_record_size_bytes": 823, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "138d9b49-501b-4b53-af6b-aaa28246a1c5", "eventTime": "2019-08-16T08:48:07Z", "eventName": "ListStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-north-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudformation:ListStacks", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1fae2fb7-6fea-4b73-9e83-cb5ed29a3c63", "record_id": "flaws_cloudtrail:0000416:1fae2fb7-6fea-4b73-9e83-cb5ed29a3c63", "row_index": 416, "timestamp": "2019-08-16T08:48:07Z", "event_type": "ListStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 821, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1fae2fb7-6fea-4b73-9e83-cb5ed29a3c63", "eventTime": "2019-08-16T08:48:07Z", "eventName": "ListStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-west-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudformation:ListStacks", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "571110ae-cd4f-4f94-9dd6-fa86ea2fa4dd", "record_id": "flaws_cloudtrail:0000417:571110ae-cd4f-4f94-9dd6-fa86ea2fa4dd", "row_index": 417, "timestamp": "2019-08-16T08:48:07Z", "event_type": "ListStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 826, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "571110ae-cd4f-4f94-9dd6-fa86ea2fa4dd", "eventTime": "2019-08-16T08:48:07Z", "eventName": "ListStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-southeast-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudformation:ListStacks", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6c33fbe3-62c0-4e6d-91c6-f247190", "record_id": "flaws_cloudtrail:0000418:6c33fbe3-62c0-4e6d-91c6-f247190", "row_index": 418, "timestamp": "2019-08-16T08:48:07Z", "event_type": "ListStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 820, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6c33fbe3-62c0-4e6d-91c6-f247190", "eventTime": "2019-08-16T08:48:07Z", "eventName": "ListStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ca-central-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudformation:ListStacks", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "138d9b49-501b-4b53-af6b-aaa28246a1c5", "record_id": "flaws_cloudtrail:0000419:138d9b49-501b-4b53-af6b-aaa28246a1c5", "row_index": 419, "timestamp": "2019-08-16T08:48:07Z", "event_type": "ListStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-north-1"}, "resource_arns": [], "raw_record_size_bytes": 823, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "138d9b49-501b-4b53-af6b-aaa28246a1c5", "eventTime": "2019-08-16T08:48:07Z", "eventName": "ListStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-north-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudformation:ListStacks", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1fae2fb7-6fea-4b73-9e83-cb5ed29a3c63", "record_id": "flaws_cloudtrail:0000420:1fae2fb7-6fea-4b73-9e83-cb5ed29a3c63", "row_index": 420, "timestamp": "2019-08-16T08:48:07Z", "event_type": "ListStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 821, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1fae2fb7-6fea-4b73-9e83-cb5ed29a3c63", "eventTime": "2019-08-16T08:48:07Z", "eventName": "ListStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-west-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudformation:ListStacks", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "26c1919e-c051-4836-a64b-cd231c36a9be", "record_id": "flaws_cloudtrail:0000421:26c1919e-c051-4836-a64b-cd231c36a9be", "row_index": 421, "timestamp": "2019-08-16T08:48:10Z", "event_type": "ListStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 821, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "26c1919e-c051-4836-a64b-cd231c36a9be", "eventTime": "2019-08-16T08:48:10Z", "eventName": "ListStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "sa-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudformation:ListStacks", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "26c1919e-c051-4836-a64b-cd231c36a9be", "record_id": "flaws_cloudtrail:0000422:26c1919e-c051-4836-a64b-cd231c36a9be", "row_index": 422, "timestamp": "2019-08-16T08:48:10Z", "event_type": "ListStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 821, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "26c1919e-c051-4836-a64b-cd231c36a9be", "eventTime": "2019-08-16T08:48:10Z", "eventName": "ListStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "sa-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudformation:ListStacks", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8a9abc96-180d-40ca-b168-9a213c493adc", "record_id": "flaws_cloudtrail:0000423:8a9abc96-180d-40ca-b168-9a213c493adc", "row_index": 423, "timestamp": "2019-08-16T08:48:11Z", "event_type": "ListStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 826, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8a9abc96-180d-40ca-b168-9a213c493adc", "eventTime": "2019-08-16T08:48:11Z", "eventName": "ListStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-northeast-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudformation:ListStacks", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9cb27533-c044-4886-85c9-9fea862731f", "record_id": "flaws_cloudtrail:0000424:9cb27533-c044-4886-85c9-9fea862731f", "row_index": 424, "timestamp": "2019-08-16T08:48:11Z", "event_type": "ListStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 820, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9cb27533-c044-4886-85c9-9fea862731f", "eventTime": "2019-08-16T08:48:11Z", "eventName": "ListStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-west-3", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudformation:ListStacks", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7f6f73c7-b773-4348-a275-b0662acf5833", "record_id": "flaws_cloudtrail:0000425:7f6f73c7-b773-4348-a275-b0662acf5833", "row_index": 425, "timestamp": "2019-08-16T08:48:11Z", "event_type": "ListStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 821, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7f6f73c7-b773-4348-a275-b0662acf5833", "eventTime": "2019-08-16T08:48:11Z", "eventName": "ListStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudformation:ListStacks", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8a9abc96-180d-40ca-b168-9a213c493adc", "record_id": "flaws_cloudtrail:0000426:8a9abc96-180d-40ca-b168-9a213c493adc", "row_index": 426, "timestamp": "2019-08-16T08:48:11Z", "event_type": "ListStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 826, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8a9abc96-180d-40ca-b168-9a213c493adc", "eventTime": "2019-08-16T08:48:11Z", "eventName": "ListStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-northeast-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudformation:ListStacks", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9cb27533-c044-4886-85c9-9fea862731f", "record_id": "flaws_cloudtrail:0000427:9cb27533-c044-4886-85c9-9fea862731f", "row_index": 427, "timestamp": "2019-08-16T08:48:11Z", "event_type": "ListStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 820, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9cb27533-c044-4886-85c9-9fea862731f", "eventTime": "2019-08-16T08:48:11Z", "eventName": "ListStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-west-3", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudformation:ListStacks", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7f6f73c7-b773-4348-a275-b0662acf5833", "record_id": "flaws_cloudtrail:0000428:7f6f73c7-b773-4348-a275-b0662acf5833", "row_index": 428, "timestamp": "2019-08-16T08:48:11Z", "event_type": "ListStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 821, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7f6f73c7-b773-4348-a275-b0662acf5833", "eventTime": "2019-08-16T08:48:11Z", "eventName": "ListStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudformation:ListStacks", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "55755e2-0235-4a25-a96c-f9c2da09b594", "record_id": "flaws_cloudtrail:0000429:55755e2-0235-4a25-a96c-f9c2da09b594", "row_index": 429, "timestamp": "2019-08-16T08:48:12Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 839, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "55755e2-0235-4a25-a96c-f9c2da09b594", "eventTime": "2019-08-16T08:48:12Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-central-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudtrail:DescribeTrails", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5f3c82f3-aba7-47a8-8642-413bffccc135", "record_id": "flaws_cloudtrail:0000430:5f3c82f3-aba7-47a8-8642-413bffccc135", "row_index": 430, "timestamp": "2019-08-16T08:48:12Z", "event_type": "ListStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 821, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5f3c82f3-aba7-47a8-8642-413bffccc135", "eventTime": "2019-08-16T08:48:12Z", "eventName": "ListStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-west-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudformation:ListStacks", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "55755e2-0235-4a25-a96c-f9c2da09b594", "record_id": "flaws_cloudtrail:0000431:55755e2-0235-4a25-a96c-f9c2da09b594", "row_index": 431, "timestamp": "2019-08-16T08:48:12Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 839, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "55755e2-0235-4a25-a96c-f9c2da09b594", "eventTime": "2019-08-16T08:48:12Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-central-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudtrail:DescribeTrails", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5f3c82f3-aba7-47a8-8642-413bffccc135", "record_id": "flaws_cloudtrail:0000432:5f3c82f3-aba7-47a8-8642-413bffccc135", "row_index": 432, "timestamp": "2019-08-16T08:48:12Z", "event_type": "ListStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 821, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5f3c82f3-aba7-47a8-8642-413bffccc135", "eventTime": "2019-08-16T08:48:12Z", "eventName": "ListStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-west-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudformation:ListStacks", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cce62ca8-ea7e-4ba7-a7a9-2cfc6cc716fc", "record_id": "flaws_cloudtrail:0000433:cce62ca8-ea7e-4ba7-a7a9-2cfc6cc716fc", "row_index": 433, "timestamp": "2019-08-16T08:48:13Z", "event_type": "ListStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 821, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cce62ca8-ea7e-4ba7-a7a9-2cfc6cc716fc", "eventTime": "2019-08-16T08:48:13Z", "eventName": "ListStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudformation:ListStacks", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cce62ca8-ea7e-4ba7-a7a9-2cfc6cc716fc", "record_id": "flaws_cloudtrail:0000434:cce62ca8-ea7e-4ba7-a7a9-2cfc6cc716fc", "row_index": 434, "timestamp": "2019-08-16T08:48:13Z", "event_type": "ListStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 821, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cce62ca8-ea7e-4ba7-a7a9-2cfc6cc716fc", "eventTime": "2019-08-16T08:48:13Z", "eventName": "ListStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudformation:ListStacks", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "33f8dea8-a3cb-43c0-8732-f7f1cb21229d", "record_id": "flaws_cloudtrail:0000435:33f8dea8-a3cb-43c0-8732-f7f1cb21229d", "row_index": 435, "timestamp": "2019-08-16T08:48:14Z", "event_type": "DescribeConfigurationRecorders", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 851, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "33f8dea8-a3cb-43c0-8732-f7f1cb21229d", "eventTime": "2019-08-16T08:48:14Z", "eventName": "DescribeConfigurationRecorders", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-northeast-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigurationRecorders", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "33f8dea8-a3cb-43c0-8732-f7f1cb21229d", "record_id": "flaws_cloudtrail:0000436:33f8dea8-a3cb-43c0-8732-f7f1cb21229d", "row_index": 436, "timestamp": "2019-08-16T08:48:14Z", "event_type": "DescribeConfigurationRecorders", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 851, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "33f8dea8-a3cb-43c0-8732-f7f1cb21229d", "eventTime": "2019-08-16T08:48:14Z", "eventName": "DescribeConfigurationRecorders", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-northeast-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigurationRecorders", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b913ebc5-000c-402d-a5d7-ddc450c8c230", "record_id": "flaws_cloudtrail:0000437:b913ebc5-000c-402d-a5d7-ddc450c8c230", "row_index": 437, "timestamp": "2019-08-16T08:48:15Z", "event_type": "DescribeConfigRules", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 828, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b913ebc5-000c-402d-a5d7-ddc450c8c230", "eventTime": "2019-08-16T08:48:15Z", "eventName": "DescribeConfigRules", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-northeast-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigRules", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b913ebc5-000c-402d-a5d7-ddc450c8c230", "record_id": "flaws_cloudtrail:0000438:b913ebc5-000c-402d-a5d7-ddc450c8c230", "row_index": 438, "timestamp": "2019-08-16T08:48:15Z", "event_type": "DescribeConfigRules", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 828, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b913ebc5-000c-402d-a5d7-ddc450c8c230", "eventTime": "2019-08-16T08:48:15Z", "eventName": "DescribeConfigRules", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-northeast-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigRules", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8a2f8062-0346-4e8d-92b1-a8b433e8dc12", "record_id": "flaws_cloudtrail:0000439:8a2f8062-0346-4e8d-92b1-a8b433e8dc12", "row_index": 439, "timestamp": "2019-08-16T08:48:16Z", "event_type": "DescribeConfigRules", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 829, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8a2f8062-0346-4e8d-92b1-a8b433e8dc12", "eventTime": "2019-08-16T08:48:16Z", "eventName": "DescribeConfigRules", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-northeast-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigRules", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8c842aa6-eb25-4bbb-8648-eb6da8cea9a8", "record_id": "flaws_cloudtrail:0000440:8c842aa6-eb25-4bbb-8648-eb6da8cea9a8", "row_index": 440, "timestamp": "2019-08-16T08:48:16Z", "event_type": "DescribeConfigRules", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 824, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8c842aa6-eb25-4bbb-8648-eb6da8cea9a8", "eventTime": "2019-08-16T08:48:16Z", "eventName": "DescribeConfigRules", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-south-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigRules", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8cc2a75a-b05f-4c41-8d29-8c5634c631a9", "record_id": "flaws_cloudtrail:0000441:8cc2a75a-b05f-4c41-8d29-8c5634c631a9", "row_index": 441, "timestamp": "2019-08-16T08:48:16Z", "event_type": "ListStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 822, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8cc2a75a-b05f-4c41-8d29-8c5634c631a9", "eventTime": "2019-08-16T08:48:16Z", "eventName": "ListStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-south-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudformation:ListStacks", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "11620c-b251-460e-9341-f8e0a0bfe604", "record_id": "flaws_cloudtrail:0000442:11620c-b251-460e-9341-f8e0a0bfe604", "row_index": 442, "timestamp": "2019-08-16T08:48:16Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 838, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "11620c-b251-460e-9341-f8e0a0bfe604", "eventTime": "2019-08-16T08:48:16Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ca-central-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudtrail:DescribeTrails", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "effb8742-dfb2-43d3-97ea-8c1fddb7e34f", "record_id": "flaws_cloudtrail:0000443:effb8742-dfb2-43d3-97ea-8c1fddb7e34f", "row_index": 443, "timestamp": "2019-08-16T08:48:16Z", "event_type": "ListStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 819, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "effb8742-dfb2-43d3-97ea-8c1fddb7e34f", "eventTime": "2019-08-16T08:48:16Z", "eventName": "ListStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudformation:ListStacks", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8a2f8062-0346-4e8d-92b1-a8b433e8dc12", "record_id": "flaws_cloudtrail:0000444:8a2f8062-0346-4e8d-92b1-a8b433e8dc12", "row_index": 444, "timestamp": "2019-08-16T08:48:16Z", "event_type": "DescribeConfigRules", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 829, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8a2f8062-0346-4e8d-92b1-a8b433e8dc12", "eventTime": "2019-08-16T08:48:16Z", "eventName": "DescribeConfigRules", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-northeast-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigRules", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8c842aa6-eb25-4bbb-8648-eb6da8cea9a8", "record_id": "flaws_cloudtrail:0000445:8c842aa6-eb25-4bbb-8648-eb6da8cea9a8", "row_index": 445, "timestamp": "2019-08-16T08:48:16Z", "event_type": "DescribeConfigRules", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 824, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8c842aa6-eb25-4bbb-8648-eb6da8cea9a8", "eventTime": "2019-08-16T08:48:16Z", "eventName": "DescribeConfigRules", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-south-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigRules", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8cc2a75a-b05f-4c41-8d29-8c5634c631a9", "record_id": "flaws_cloudtrail:0000446:8cc2a75a-b05f-4c41-8d29-8c5634c631a9", "row_index": 446, "timestamp": "2019-08-16T08:48:16Z", "event_type": "ListStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 822, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8cc2a75a-b05f-4c41-8d29-8c5634c631a9", "eventTime": "2019-08-16T08:48:16Z", "eventName": "ListStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-south-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudformation:ListStacks", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "11620c-b251-460e-9341-f8e0a0bfe604", "record_id": "flaws_cloudtrail:0000447:11620c-b251-460e-9341-f8e0a0bfe604", "row_index": 447, "timestamp": "2019-08-16T08:48:16Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 838, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "11620c-b251-460e-9341-f8e0a0bfe604", "eventTime": "2019-08-16T08:48:16Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ca-central-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudtrail:DescribeTrails", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "effb8742-dfb2-43d3-97ea-8c1fddb7e34f", "record_id": "flaws_cloudtrail:0000448:effb8742-dfb2-43d3-97ea-8c1fddb7e34f", "row_index": 448, "timestamp": "2019-08-16T08:48:16Z", "event_type": "ListStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 819, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "effb8742-dfb2-43d3-97ea-8c1fddb7e34f", "eventTime": "2019-08-16T08:48:16Z", "eventName": "ListStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudformation:ListStacks", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f1c09c79-d41c-483b-9ce1-95a88050c76d", "record_id": "flaws_cloudtrail:0000449:f1c09c79-d41c-483b-9ce1-95a88050c76d", "row_index": 449, "timestamp": "2019-08-16T08:48:17Z", "event_type": "DescribeConfigurationRecorders", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 847, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f1c09c79-d41c-483b-9ce1-95a88050c76d", "eventTime": "2019-08-16T08:48:17Z", "eventName": "DescribeConfigurationRecorders", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-south-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigurationRecorders", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5ec3b3f3-3a1e-4d27-85f7-1c7337bfc2f0", "record_id": "flaws_cloudtrail:0000450:5ec3b3f3-3a1e-4d27-85f7-1c7337bfc2f0", "row_index": 450, "timestamp": "2019-08-16T08:48:17Z", "event_type": "DescribeConfigRules", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 828, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5ec3b3f3-3a1e-4d27-85f7-1c7337bfc2f0", "eventTime": "2019-08-16T08:48:17Z", "eventName": "DescribeConfigRules", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-southeast-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigRules", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1d05f8e7-247f-44bc-aadc-b426295188e0", "record_id": "flaws_cloudtrail:0000451:1d05f8e7-247f-44bc-aadc-b426295188e0", "row_index": 451, "timestamp": "2019-08-16T08:48:17Z", "event_type": "DescribeConfigurationRecorders", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 850, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1d05f8e7-247f-44bc-aadc-b426295188e0", "eventTime": "2019-08-16T08:48:17Z", "eventName": "DescribeConfigurationRecorders", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-southeast-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigurationRecorders", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f1c09c79-d41c-483b-9ce1-95a88050c76d", "record_id": "flaws_cloudtrail:0000452:f1c09c79-d41c-483b-9ce1-95a88050c76d", "row_index": 452, "timestamp": "2019-08-16T08:48:17Z", "event_type": "DescribeConfigurationRecorders", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 847, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f1c09c79-d41c-483b-9ce1-95a88050c76d", "eventTime": "2019-08-16T08:48:17Z", "eventName": "DescribeConfigurationRecorders", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-south-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigurationRecorders", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5ec3b3f3-3a1e-4d27-85f7-1c7337bfc2f0", "record_id": "flaws_cloudtrail:0000453:5ec3b3f3-3a1e-4d27-85f7-1c7337bfc2f0", "row_index": 453, "timestamp": "2019-08-16T08:48:17Z", "event_type": "DescribeConfigRules", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 828, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5ec3b3f3-3a1e-4d27-85f7-1c7337bfc2f0", "eventTime": "2019-08-16T08:48:17Z", "eventName": "DescribeConfigRules", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-southeast-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigRules", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1d05f8e7-247f-44bc-aadc-b426295188e0", "record_id": "flaws_cloudtrail:0000454:1d05f8e7-247f-44bc-aadc-b426295188e0", "row_index": 454, "timestamp": "2019-08-16T08:48:17Z", "event_type": "DescribeConfigurationRecorders", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 850, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1d05f8e7-247f-44bc-aadc-b426295188e0", "eventTime": "2019-08-16T08:48:17Z", "eventName": "DescribeConfigurationRecorders", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-southeast-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigurationRecorders", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c9e3b921-12c6-49ce-8314-521865bb0c12d", "record_id": "flaws_cloudtrail:0000455:c9e3b921-12c6-49ce-8314-521865bb0c12d", "row_index": 455, "timestamp": "2019-08-16T08:48:18Z", "event_type": "DescribeConfigRules", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 830, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c9e3b921-12c6-49ce-8314-521865bb0c12d", "eventTime": "2019-08-16T08:48:18Z", "eventName": "DescribeConfigRules", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-southeast-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigRules", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "97e3b69e-9928-46b7-965b-e1416d3ca211", "record_id": "flaws_cloudtrail:0000456:97e3b69e-9928-46b7-965b-e1416d3ca211", "row_index": 456, "timestamp": "2019-08-16T08:48:18Z", "event_type": "DescribeConfigurationRecorders", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 850, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "97e3b69e-9928-46b7-965b-e1416d3ca211", "eventTime": "2019-08-16T08:48:18Z", "eventName": "DescribeConfigurationRecorders", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-southeast-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigurationRecorders", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d06f198a-1909-48d3-8cec-92a610929f0c", "record_id": "flaws_cloudtrail:0000457:d06f198a-1909-48d3-8cec-92a610929f0c", "row_index": 457, "timestamp": "2019-08-16T08:48:18Z", "event_type": "DescribeConfigurationRecorders", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 848, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d06f198a-1909-48d3-8cec-92a610929f0c", "eventTime": "2019-08-16T08:48:18Z", "eventName": "DescribeConfigurationRecorders", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ca-central-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigurationRecorders", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9dcb503d-0401-4ead-9e66-959d0f556057", "record_id": "flaws_cloudtrail:0000458:9dcb503d-0401-4ead-9e66-959d0f556057", "row_index": 458, "timestamp": "2019-08-16T08:48:18Z", "event_type": "DescribeConfigRules", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 826, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9dcb503d-0401-4ead-9e66-959d0f556057", "eventTime": "2019-08-16T08:48:18Z", "eventName": "DescribeConfigRules", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-central-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigRules", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6590ac3f-6ae6-49b9-b434-a4f718522e41d", "record_id": "flaws_cloudtrail:0000459:6590ac3f-6ae6-49b9-b434-a4f718522e41d", "row_index": 459, "timestamp": "2019-08-16T08:48:18Z", "event_type": "DescribeConfigurationRecorders", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 850, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6590ac3f-6ae6-49b9-b434-a4f718522e41d", "eventTime": "2019-08-16T08:48:18Z", "eventName": "DescribeConfigurationRecorders", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-central-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigurationRecorders", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dca69b6a-5ee8-468f-a2e9-8df88d5ff99a", "record_id": "flaws_cloudtrail:0000460:dca69b6a-5ee8-468f-a2e9-8df88d5ff99a", "row_index": 460, "timestamp": "2019-08-16T08:48:18Z", "event_type": "DescribeConfigRules", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-north-1"}, "resource_arns": [], "raw_record_size_bytes": 824, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dca69b6a-5ee8-468f-a2e9-8df88d5ff99a", "eventTime": "2019-08-16T08:48:18Z", "eventName": "DescribeConfigRules", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-north-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigRules", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "be7342dc-537a-4a89-a73c-bf7df329493b", "record_id": "flaws_cloudtrail:0000461:be7342dc-537a-4a89-a73c-bf7df329493b", "row_index": 461, "timestamp": "2019-08-16T08:48:18Z", "event_type": "DescribeConfigurationRecorders", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-north-1"}, "resource_arns": [], "raw_record_size_bytes": 847, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "be7342dc-537a-4a89-a73c-bf7df329493b", "eventTime": "2019-08-16T08:48:18Z", "eventName": "DescribeConfigurationRecorders", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-north-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigurationRecorders", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "31bad740-f485-4235-b526-c8e57eca5c20", "record_id": "flaws_cloudtrail:0000462:31bad740-f485-4235-b526-c8e57eca5c20", "row_index": 462, "timestamp": "2019-08-16T08:48:18Z", "event_type": "DescribeConfigRules", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 824, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "31bad740-f485-4235-b526-c8e57eca5c20", "eventTime": "2019-08-16T08:48:18Z", "eventName": "DescribeConfigRules", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-west-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigRules", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "56b72b2a-4e41-4092-8e92-fa07154c33b5", "record_id": "flaws_cloudtrail:0000463:56b72b2a-4e41-4092-8e92-fa07154c33b5", "row_index": 463, "timestamp": "2019-08-16T08:48:18Z", "event_type": "DescribeConfigRules", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 823, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "56b72b2a-4e41-4092-8e92-fa07154c33b5", "eventTime": "2019-08-16T08:48:18Z", "eventName": "DescribeConfigRules", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigRules", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1a276f2e-fbd7-4e01-acce-65f94829f5d7", "record_id": "flaws_cloudtrail:0000464:1a276f2e-fbd7-4e01-acce-65f94829f5d7", "row_index": 464, "timestamp": "2019-08-16T08:48:18Z", "event_type": "ListStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 821, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1a276f2e-fbd7-4e01-acce-65f94829f5d7", "eventTime": "2019-08-16T08:48:18Z", "eventName": "ListStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudformation:ListStacks", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c9e3b921-12c6-49ce-8314-521865bb0c12d", "record_id": "flaws_cloudtrail:0000465:c9e3b921-12c6-49ce-8314-521865bb0c12d", "row_index": 465, "timestamp": "2019-08-16T08:48:18Z", "event_type": "DescribeConfigRules", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 830, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c9e3b921-12c6-49ce-8314-521865bb0c12d", "eventTime": "2019-08-16T08:48:18Z", "eventName": "DescribeConfigRules", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-southeast-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigRules", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "97e3b69e-9928-46b7-965b-e1416d3ca211", "record_id": "flaws_cloudtrail:0000466:97e3b69e-9928-46b7-965b-e1416d3ca211", "row_index": 466, "timestamp": "2019-08-16T08:48:18Z", "event_type": "DescribeConfigurationRecorders", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 850, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "97e3b69e-9928-46b7-965b-e1416d3ca211", "eventTime": "2019-08-16T08:48:18Z", "eventName": "DescribeConfigurationRecorders", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-southeast-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigurationRecorders", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d06f198a-1909-48d3-8cec-92a610929f0c", "record_id": "flaws_cloudtrail:0000467:d06f198a-1909-48d3-8cec-92a610929f0c", "row_index": 467, "timestamp": "2019-08-16T08:48:18Z", "event_type": "DescribeConfigurationRecorders", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 848, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d06f198a-1909-48d3-8cec-92a610929f0c", "eventTime": "2019-08-16T08:48:18Z", "eventName": "DescribeConfigurationRecorders", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ca-central-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigurationRecorders", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9dcb503d-0401-4ead-9e66-959d0f556057", "record_id": "flaws_cloudtrail:0000468:9dcb503d-0401-4ead-9e66-959d0f556057", "row_index": 468, "timestamp": "2019-08-16T08:48:18Z", "event_type": "DescribeConfigRules", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 826, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9dcb503d-0401-4ead-9e66-959d0f556057", "eventTime": "2019-08-16T08:48:18Z", "eventName": "DescribeConfigRules", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-central-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigRules", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6590ac3f-6ae6-49b9-b434-a4f718522e41d", "record_id": "flaws_cloudtrail:0000469:6590ac3f-6ae6-49b9-b434-a4f718522e41d", "row_index": 469, "timestamp": "2019-08-16T08:48:18Z", "event_type": "DescribeConfigurationRecorders", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 850, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6590ac3f-6ae6-49b9-b434-a4f718522e41d", "eventTime": "2019-08-16T08:48:18Z", "eventName": "DescribeConfigurationRecorders", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-central-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigurationRecorders", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dca69b6a-5ee8-468f-a2e9-8df88d5ff99a", "record_id": "flaws_cloudtrail:0000470:dca69b6a-5ee8-468f-a2e9-8df88d5ff99a", "row_index": 470, "timestamp": "2019-08-16T08:48:18Z", "event_type": "DescribeConfigRules", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-north-1"}, "resource_arns": [], "raw_record_size_bytes": 824, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dca69b6a-5ee8-468f-a2e9-8df88d5ff99a", "eventTime": "2019-08-16T08:48:18Z", "eventName": "DescribeConfigRules", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-north-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigRules", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "be7342dc-537a-4a89-a73c-bf7df329493b", "record_id": "flaws_cloudtrail:0000471:be7342dc-537a-4a89-a73c-bf7df329493b", "row_index": 471, "timestamp": "2019-08-16T08:48:18Z", "event_type": "DescribeConfigurationRecorders", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-north-1"}, "resource_arns": [], "raw_record_size_bytes": 847, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "be7342dc-537a-4a89-a73c-bf7df329493b", "eventTime": "2019-08-16T08:48:18Z", "eventName": "DescribeConfigurationRecorders", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-north-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigurationRecorders", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "31bad740-f485-4235-b526-c8e57eca5c20", "record_id": "flaws_cloudtrail:0000472:31bad740-f485-4235-b526-c8e57eca5c20", "row_index": 472, "timestamp": "2019-08-16T08:48:18Z", "event_type": "DescribeConfigRules", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 824, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "31bad740-f485-4235-b526-c8e57eca5c20", "eventTime": "2019-08-16T08:48:18Z", "eventName": "DescribeConfigRules", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-west-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigRules", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "56b72b2a-4e41-4092-8e92-fa07154c33b5", "record_id": "flaws_cloudtrail:0000473:56b72b2a-4e41-4092-8e92-fa07154c33b5", "row_index": 473, "timestamp": "2019-08-16T08:48:18Z", "event_type": "DescribeConfigRules", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 823, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "56b72b2a-4e41-4092-8e92-fa07154c33b5", "eventTime": "2019-08-16T08:48:18Z", "eventName": "DescribeConfigRules", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigRules", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1a276f2e-fbd7-4e01-acce-65f94829f5d7", "record_id": "flaws_cloudtrail:0000474:1a276f2e-fbd7-4e01-acce-65f94829f5d7", "row_index": 474, "timestamp": "2019-08-16T08:48:18Z", "event_type": "ListStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 821, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1a276f2e-fbd7-4e01-acce-65f94829f5d7", "eventTime": "2019-08-16T08:48:18Z", "eventName": "ListStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudformation:ListStacks", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3d77f0a9-9bb6-4123-85a1-3a92e2e6e4a5", "record_id": "flaws_cloudtrail:0000475:3d77f0a9-9bb6-4123-85a1-3a92e2e6e4a5", "row_index": 475, "timestamp": "2019-08-16T08:48:19Z", "event_type": "DescribeConfigurationRecorders", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 844, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3d77f0a9-9bb6-4123-85a1-3a92e2e6e4a5", "eventTime": "2019-08-16T08:48:19Z", "eventName": "DescribeConfigurationRecorders", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigurationRecorders", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "641286f-4104-4b0f-bdd9-331111c940120", "record_id": "flaws_cloudtrail:0000476:641286f-4104-4b0f-bdd9-331111c940120", "row_index": 476, "timestamp": "2019-08-16T08:48:19Z", "event_type": "DescribeConfigurationRecorders", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 843, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "641286f-4104-4b0f-bdd9-331111c940120", "eventTime": "2019-08-16T08:48:19Z", "eventName": "DescribeConfigurationRecorders", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-west-3", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigurationRecorders", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ec8e4c72-fd22-407d-9f18-a9dc2bd0c0b0", "record_id": "flaws_cloudtrail:0000477:ec8e4c72-fd22-407d-9f18-a9dc2bd0c0b0", "row_index": 477, "timestamp": "2019-08-16T08:48:19Z", "event_type": "DescribeConfigRules", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 823, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ec8e4c72-fd22-407d-9f18-a9dc2bd0c0b0", "eventTime": "2019-08-16T08:48:19Z", "eventName": "DescribeConfigRules", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-west-3", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigRules", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3d77f0a9-9bb6-4123-85a1-3a92e2e6e4a5", "record_id": "flaws_cloudtrail:0000478:3d77f0a9-9bb6-4123-85a1-3a92e2e6e4a5", "row_index": 478, "timestamp": "2019-08-16T08:48:19Z", "event_type": "DescribeConfigurationRecorders", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 844, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3d77f0a9-9bb6-4123-85a1-3a92e2e6e4a5", "eventTime": "2019-08-16T08:48:19Z", "eventName": "DescribeConfigurationRecorders", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigurationRecorders", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "641286f-4104-4b0f-bdd9-331111c940120", "record_id": "flaws_cloudtrail:0000479:641286f-4104-4b0f-bdd9-331111c940120", "row_index": 479, "timestamp": "2019-08-16T08:48:19Z", "event_type": "DescribeConfigurationRecorders", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 843, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "641286f-4104-4b0f-bdd9-331111c940120", "eventTime": "2019-08-16T08:48:19Z", "eventName": "DescribeConfigurationRecorders", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-west-3", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigurationRecorders", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ec8e4c72-fd22-407d-9f18-a9dc2bd0c0b0", "record_id": "flaws_cloudtrail:0000480:ec8e4c72-fd22-407d-9f18-a9dc2bd0c0b0", "row_index": 480, "timestamp": "2019-08-16T08:48:19Z", "event_type": "DescribeConfigRules", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 823, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ec8e4c72-fd22-407d-9f18-a9dc2bd0c0b0", "eventTime": "2019-08-16T08:48:19Z", "eventName": "DescribeConfigRules", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-west-3", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigRules", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "baa01ef2-ddc1-4c41-ada0-4cb036e1e042", "record_id": "flaws_cloudtrail:0000481:baa01ef2-ddc1-4c41-ada0-4cb036e1e042", "row_index": 481, "timestamp": "2019-08-16T08:48:20Z", "event_type": "DescribeConfigRules", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 823, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "baa01ef2-ddc1-4c41-ada0-4cb036e1e042", "eventTime": "2019-08-16T08:48:20Z", "eventName": "DescribeConfigRules", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "sa-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigRules", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a1ea1f05-b208-47d5-a00c-b2fac125c84e", "record_id": "flaws_cloudtrail:0000482:a1ea1f05-b208-47d5-a00c-b2fac125c84e", "row_index": 482, "timestamp": "2019-08-16T08:48:20Z", "event_type": "DescribeConfigurationRecorders", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 846, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a1ea1f05-b208-47d5-a00c-b2fac125c84e", "eventTime": "2019-08-16T08:48:20Z", "eventName": "DescribeConfigurationRecorders", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "sa-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigurationRecorders", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "062875-db6e-4d90-adf0-9ba5126a7465", "record_id": "flaws_cloudtrail:0000483:062875-db6e-4d90-adf0-9ba5126a7465", "row_index": 483, "timestamp": "2019-08-16T08:48:20Z", "event_type": "DescribeConfigurationRecorders", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 843, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "062875-db6e-4d90-adf0-9ba5126a7465", "eventTime": "2019-08-16T08:48:20Z", "eventName": "DescribeConfigurationRecorders", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigurationRecorders", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8e46b16f-9f98-4b92-86aa-a06a5b735eb9", "record_id": "flaws_cloudtrail:0000484:8e46b16f-9f98-4b92-86aa-a06a5b735eb9", "row_index": 484, "timestamp": "2019-08-16T08:48:20Z", "event_type": "DescribeConfigRules", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 823, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8e46b16f-9f98-4b92-86aa-a06a5b735eb9", "eventTime": "2019-08-16T08:48:20Z", "eventName": "DescribeConfigRules", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigRules", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ae102b7c-0fc5-4cbb-b058-d761a45a692f", "record_id": "flaws_cloudtrail:0000485:ae102b7c-0fc5-4cbb-b058-d761a45a692f", "row_index": 485, "timestamp": "2019-08-16T08:48:20Z", "event_type": "DescribeConfigurationRecorders", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 845, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ae102b7c-0fc5-4cbb-b058-d761a45a692f", "eventTime": "2019-08-16T08:48:20Z", "eventName": "DescribeConfigurationRecorders", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigurationRecorders", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4efeeb1f-c232-4640-935a-9e0b85441916", "record_id": "flaws_cloudtrail:0000486:4efeeb1f-c232-4640-935a-9e0b85441916", "row_index": 486, "timestamp": "2019-08-16T08:48:20Z", "event_type": "DescribeConfigRules", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 823, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4efeeb1f-c232-4640-935a-9e0b85441916", "eventTime": "2019-08-16T08:48:20Z", "eventName": "DescribeConfigRules", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigRules", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "baa01ef2-ddc1-4c41-ada0-4cb036e1e042", "record_id": "flaws_cloudtrail:0000487:baa01ef2-ddc1-4c41-ada0-4cb036e1e042", "row_index": 487, "timestamp": "2019-08-16T08:48:20Z", "event_type": "DescribeConfigRules", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 823, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "baa01ef2-ddc1-4c41-ada0-4cb036e1e042", "eventTime": "2019-08-16T08:48:20Z", "eventName": "DescribeConfigRules", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "sa-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigRules", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a1ea1f05-b208-47d5-a00c-b2fac125c84e", "record_id": "flaws_cloudtrail:0000488:a1ea1f05-b208-47d5-a00c-b2fac125c84e", "row_index": 488, "timestamp": "2019-08-16T08:48:20Z", "event_type": "DescribeConfigurationRecorders", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 846, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a1ea1f05-b208-47d5-a00c-b2fac125c84e", "eventTime": "2019-08-16T08:48:20Z", "eventName": "DescribeConfigurationRecorders", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "sa-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigurationRecorders", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "062875-db6e-4d90-adf0-9ba5126a7465", "record_id": "flaws_cloudtrail:0000489:062875-db6e-4d90-adf0-9ba5126a7465", "row_index": 489, "timestamp": "2019-08-16T08:48:20Z", "event_type": "DescribeConfigurationRecorders", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 843, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "062875-db6e-4d90-adf0-9ba5126a7465", "eventTime": "2019-08-16T08:48:20Z", "eventName": "DescribeConfigurationRecorders", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigurationRecorders", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8e46b16f-9f98-4b92-86aa-a06a5b735eb9", "record_id": "flaws_cloudtrail:0000490:8e46b16f-9f98-4b92-86aa-a06a5b735eb9", "row_index": 490, "timestamp": "2019-08-16T08:48:20Z", "event_type": "DescribeConfigRules", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 823, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8e46b16f-9f98-4b92-86aa-a06a5b735eb9", "eventTime": "2019-08-16T08:48:20Z", "eventName": "DescribeConfigRules", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigRules", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ae102b7c-0fc5-4cbb-b058-d761a45a692f", "record_id": "flaws_cloudtrail:0000491:ae102b7c-0fc5-4cbb-b058-d761a45a692f", "row_index": 491, "timestamp": "2019-08-16T08:48:20Z", "event_type": "DescribeConfigurationRecorders", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 845, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ae102b7c-0fc5-4cbb-b058-d761a45a692f", "eventTime": "2019-08-16T08:48:20Z", "eventName": "DescribeConfigurationRecorders", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigurationRecorders", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4efeeb1f-c232-4640-935a-9e0b85441916", "record_id": "flaws_cloudtrail:0000492:4efeeb1f-c232-4640-935a-9e0b85441916", "row_index": 492, "timestamp": "2019-08-16T08:48:20Z", "event_type": "DescribeConfigRules", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 823, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4efeeb1f-c232-4640-935a-9e0b85441916", "eventTime": "2019-08-16T08:48:20Z", "eventName": "DescribeConfigRules", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigRules", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "86a04fe0-0801-4622-b625-be0f58d101961", "record_id": "flaws_cloudtrail:0000493:86a04fe0-0801-4622-b625-be0f58d101961", "row_index": 493, "timestamp": "2019-08-16T08:48:21Z", "event_type": "DescribeConfigurationRecorders", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 846, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "86a04fe0-0801-4622-b625-be0f58d101961", "eventTime": "2019-08-16T08:48:21Z", "eventName": "DescribeConfigurationRecorders", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-west-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigurationRecorders", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1b06a264-cc64-4360-b986-7ad90034dc7e", "record_id": "flaws_cloudtrail:0000494:1b06a264-cc64-4360-b986-7ad90034dc7e", "row_index": 494, "timestamp": "2019-08-16T08:48:21Z", "event_type": "DescribeConfigRules", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 823, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1b06a264-cc64-4360-b986-7ad90034dc7e", "eventTime": "2019-08-16T08:48:21Z", "eventName": "DescribeConfigRules", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigRules", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b45905-6bb2-4dff-8771-a6a68cce0278", "record_id": "flaws_cloudtrail:0000495:b45905-6bb2-4dff-8771-a6a68cce0278", "row_index": 495, "timestamp": "2019-08-16T08:48:21Z", "event_type": "DescribeConfigurationRecorders", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 843, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b45905-6bb2-4dff-8771-a6a68cce0278", "eventTime": "2019-08-16T08:48:21Z", "eventName": "DescribeConfigurationRecorders", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigurationRecorders", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "86a04fe0-0801-4622-b625-be0f58d101961", "record_id": "flaws_cloudtrail:0000496:86a04fe0-0801-4622-b625-be0f58d101961", "row_index": 496, "timestamp": "2019-08-16T08:48:21Z", "event_type": "DescribeConfigurationRecorders", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 846, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "86a04fe0-0801-4622-b625-be0f58d101961", "eventTime": "2019-08-16T08:48:21Z", "eventName": "DescribeConfigurationRecorders", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-west-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigurationRecorders", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1b06a264-cc64-4360-b986-7ad90034dc7e", "record_id": "flaws_cloudtrail:0000497:1b06a264-cc64-4360-b986-7ad90034dc7e", "row_index": 497, "timestamp": "2019-08-16T08:48:21Z", "event_type": "DescribeConfigRules", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 823, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1b06a264-cc64-4360-b986-7ad90034dc7e", "eventTime": "2019-08-16T08:48:21Z", "eventName": "DescribeConfigRules", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigRules", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b45905-6bb2-4dff-8771-a6a68cce0278", "record_id": "flaws_cloudtrail:0000498:b45905-6bb2-4dff-8771-a6a68cce0278", "row_index": 498, "timestamp": "2019-08-16T08:48:21Z", "event_type": "DescribeConfigurationRecorders", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 843, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b45905-6bb2-4dff-8771-a6a68cce0278", "eventTime": "2019-08-16T08:48:21Z", "eventName": "DescribeConfigurationRecorders", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigurationRecorders", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fe308b73-5cf5-4976-a404-a15e1a7918ee", "record_id": "flaws_cloudtrail:0000499:fe308b73-5cf5-4976-a404-a15e1a7918ee", "row_index": 499, "timestamp": "2019-08-16T08:48:23Z", "event_type": "DescribeConfigRules", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 827, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fe308b73-5cf5-4976-a404-a15e1a7918ee", "eventTime": "2019-08-16T08:48:23Z", "eventName": "DescribeConfigRules", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ca-central-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigRules", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fe308b73-5cf5-4976-a404-a15e1a7918ee", "record_id": "flaws_cloudtrail:0000500:fe308b73-5cf5-4976-a404-a15e1a7918ee", "row_index": 500, "timestamp": "2019-08-16T08:48:23Z", "event_type": "DescribeConfigRules", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 827, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fe308b73-5cf5-4976-a404-a15e1a7918ee", "eventTime": "2019-08-16T08:48:23Z", "eventName": "DescribeConfigRules", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ca-central-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigRules", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0e12c4f0-7bb2-4c9e-918e-09dfdecf663c", "record_id": "flaws_cloudtrail:0000501:0e12c4f0-7bb2-4c9e-918e-09dfdecf663c", "row_index": 501, "timestamp": "2019-08-16T08:48:24Z", "event_type": "DescribeConfigurationRecorders", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 845, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0e12c4f0-7bb2-4c9e-918e-09dfdecf663c", "eventTime": "2019-08-16T08:48:24Z", "eventName": "DescribeConfigurationRecorders", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-west-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigurationRecorders", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0e12c4f0-7bb2-4c9e-918e-09dfdecf663c", "record_id": "flaws_cloudtrail:0000502:0e12c4f0-7bb2-4c9e-918e-09dfdecf663c", "row_index": 502, "timestamp": "2019-08-16T08:48:24Z", "event_type": "DescribeConfigurationRecorders", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 845, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0e12c4f0-7bb2-4c9e-918e-09dfdecf663c", "eventTime": "2019-08-16T08:48:24Z", "eventName": "DescribeConfigurationRecorders", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-west-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigurationRecorders", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bbf26bc6-f341-4b5d-b93a-3d2af54b3275", "record_id": "flaws_cloudtrail:0000503:bbf26bc6-f341-4b5d-b93a-3d2af54b3275", "row_index": 503, "timestamp": "2019-08-16T08:48:26Z", "event_type": "DescribeConfigRules", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 823, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bbf26bc6-f341-4b5d-b93a-3d2af54b3275", "eventTime": "2019-08-16T08:48:26Z", "eventName": "DescribeConfigRules", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-west-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigRules", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bbf26bc6-f341-4b5d-b93a-3d2af54b3275", "record_id": "flaws_cloudtrail:0000504:bbf26bc6-f341-4b5d-b93a-3d2af54b3275", "row_index": 504, "timestamp": "2019-08-16T08:48:26Z", "event_type": "DescribeConfigRules", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 823, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bbf26bc6-f341-4b5d-b93a-3d2af54b3275", "eventTime": "2019-08-16T08:48:26Z", "eventName": "DescribeConfigRules", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-west-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigRules", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "601c2ca7-93ec-4749-9f2c-f596ec4e95bd", "record_id": "flaws_cloudtrail:0000505:601c2ca7-93ec-4749-9f2c-f596ec4e95bd", "row_index": 505, "timestamp": "2019-08-16T08:48:29Z", "event_type": "DescribeAlarms", "event_source": "monitoring.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 894, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "601c2ca7-93ec-4749-9f2c-f596ec4e95bd", "eventTime": "2019-08-16T08:48:29Z", "eventName": "DescribeAlarms", "eventSource": "monitoring.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-northeast-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudwatch:DescribeAlarms on resource: arn:aws:cloudwatch:ap-northeast-1:811596193553:alarm:*", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "855da03a-a774-4256-98d8-03c55378e361", "record_id": "flaws_cloudtrail:0000506:855da03a-a774-4256-98d8-03c55378e361", "row_index": 506, "timestamp": "2019-08-16T08:48:29Z", "event_type": "ListStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 824, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "855da03a-a774-4256-98d8-03c55378e361", "eventTime": "2019-08-16T08:48:29Z", "eventName": "ListStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-central-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudformation:ListStacks", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "601c2ca7-93ec-4749-9f2c-f596ec4e95bd", "record_id": "flaws_cloudtrail:0000507:601c2ca7-93ec-4749-9f2c-f596ec4e95bd", "row_index": 507, "timestamp": "2019-08-16T08:48:29Z", "event_type": "DescribeAlarms", "event_source": "monitoring.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 894, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "601c2ca7-93ec-4749-9f2c-f596ec4e95bd", "eventTime": "2019-08-16T08:48:29Z", "eventName": "DescribeAlarms", "eventSource": "monitoring.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-northeast-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudwatch:DescribeAlarms on resource: arn:aws:cloudwatch:ap-northeast-1:811596193553:alarm:*", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "855da03a-a774-4256-98d8-03c55378e361", "record_id": "flaws_cloudtrail:0000508:855da03a-a774-4256-98d8-03c55378e361", "row_index": 508, "timestamp": "2019-08-16T08:48:29Z", "event_type": "ListStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 824, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "855da03a-a774-4256-98d8-03c55378e361", "eventTime": "2019-08-16T08:48:29Z", "eventName": "ListStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-central-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudformation:ListStacks", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "60f0ef4f-c88b-4e40-b52b-52224156c1aa", "record_id": "flaws_cloudtrail:0000509:60f0ef4f-c88b-4e40-b52b-52224156c1aa", "row_index": 509, "timestamp": "2019-08-16T08:48:30Z", "event_type": "DescribeAlarms", "event_source": "monitoring.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 886, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "60f0ef4f-c88b-4e40-b52b-52224156c1aa", "eventTime": "2019-08-16T08:48:30Z", "eventName": "DescribeAlarms", "eventSource": "monitoring.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-south-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudwatch:DescribeAlarms on resource: arn:aws:cloudwatch:ap-south-1:811596193553:alarm:*", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "60f0ef4f-c88b-4e40-b52b-52224156c1aa", "record_id": "flaws_cloudtrail:0000510:60f0ef4f-c88b-4e40-b52b-52224156c1aa", "row_index": 510, "timestamp": "2019-08-16T08:48:30Z", "event_type": "DescribeAlarms", "event_source": "monitoring.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 886, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "60f0ef4f-c88b-4e40-b52b-52224156c1aa", "eventTime": "2019-08-16T08:48:30Z", "eventName": "DescribeAlarms", "eventSource": "monitoring.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-south-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudwatch:DescribeAlarms on resource: arn:aws:cloudwatch:ap-south-1:811596193553:alarm:*", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "60179-1f4a-4a75-b95f-3fce9a365f5a", "record_id": "flaws_cloudtrail:0000511:60179-1f4a-4a75-b95f-3fce9a365f5a", "row_index": 511, "timestamp": "2019-08-16T08:48:31Z", "event_type": "DescribeConfigurationRecorders", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 848, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "60179-1f4a-4a75-b95f-3fce9a365f5a", "eventTime": "2019-08-16T08:48:31Z", "eventName": "DescribeConfigurationRecorders", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-northeast-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigurationRecorders", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "61a5a30b-86cb-4967-937f-9438e8146c71", "record_id": "flaws_cloudtrail:0000512:61a5a30b-86cb-4967-937f-9438e8146c71", "row_index": 512, "timestamp": "2019-08-16T08:48:31Z", "event_type": "DescribeAlarms", "event_source": "monitoring.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 890, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "61a5a30b-86cb-4967-937f-9438e8146c71", "eventTime": "2019-08-16T08:48:31Z", "eventName": "DescribeAlarms", "eventSource": "monitoring.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ca-central-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudwatch:DescribeAlarms on resource: arn:aws:cloudwatch:ca-central-1:811596193553:alarm:*", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "60179-1f4a-4a75-b95f-3fce9a365f5a", "record_id": "flaws_cloudtrail:0000513:60179-1f4a-4a75-b95f-3fce9a365f5a", "row_index": 513, "timestamp": "2019-08-16T08:48:31Z", "event_type": "DescribeConfigurationRecorders", "event_source": "config.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 848, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "60179-1f4a-4a75-b95f-3fce9a365f5a", "eventTime": "2019-08-16T08:48:31Z", "eventName": "DescribeConfigurationRecorders", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-northeast-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: config:DescribeConfigurationRecorders", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "61a5a30b-86cb-4967-937f-9438e8146c71", "record_id": "flaws_cloudtrail:0000514:61a5a30b-86cb-4967-937f-9438e8146c71", "row_index": 514, "timestamp": "2019-08-16T08:48:31Z", "event_type": "DescribeAlarms", "event_source": "monitoring.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 890, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "61a5a30b-86cb-4967-937f-9438e8146c71", "eventTime": "2019-08-16T08:48:31Z", "eventName": "DescribeAlarms", "eventSource": "monitoring.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ca-central-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudwatch:DescribeAlarms on resource: arn:aws:cloudwatch:ca-central-1:811596193553:alarm:*", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "03b5cb48-32a3-4dbb-b365-2c97839cdb", "record_id": "flaws_cloudtrail:0000515:03b5cb48-32a3-4dbb-b365-2c97839cdb", "row_index": 515, "timestamp": "2019-08-16T08:48:33Z", "event_type": "DescribeAlarms", "event_source": "monitoring.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-north-1"}, "resource_arns": [], "raw_record_size_bytes": 884, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "03b5cb48-32a3-4dbb-b365-2c97839cdb", "eventTime": "2019-08-16T08:48:33Z", "eventName": "DescribeAlarms", "eventSource": "monitoring.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-north-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudwatch:DescribeAlarms on resource: arn:aws:cloudwatch:eu-north-1:811596193553:alarm:*", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4fec9bed-2e8c-4794-8342-234074e4ef62", "record_id": "flaws_cloudtrail:0000516:4fec9bed-2e8c-4794-8342-234074e4ef62", "row_index": 516, "timestamp": "2019-08-16T08:48:33Z", "event_type": "DescribeAlarms", "event_source": "monitoring.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 884, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4fec9bed-2e8c-4794-8342-234074e4ef62", "eventTime": "2019-08-16T08:48:33Z", "eventName": "DescribeAlarms", "eventSource": "monitoring.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-west-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudwatch:DescribeAlarms on resource: arn:aws:cloudwatch:eu-west-1:811596193553:alarm:*", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d030989ff-28ec-449f-a30a-f9303c3a0255", "record_id": "flaws_cloudtrail:0000517:d030989ff-28ec-449f-a30a-f9303c3a0255", "row_index": 517, "timestamp": "2019-08-16T08:48:33Z", "event_type": "DescribeAlarms", "event_source": "monitoring.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 885, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d030989ff-28ec-449f-a30a-f9303c3a0255", "eventTime": "2019-08-16T08:48:33Z", "eventName": "DescribeAlarms", "eventSource": "monitoring.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudwatch:DescribeAlarms on resource: arn:aws:cloudwatch:eu-west-2:811596193553:alarm:*", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6def53ce-d3f7-406c-8a61-9366b60c81dc", "record_id": "flaws_cloudtrail:0000518:6def53ce-d3f7-406c-8a61-9366b60c81dc", "row_index": 518, "timestamp": "2019-08-16T08:48:33Z", "event_type": "DescribeAlarms", "event_source": "monitoring.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 884, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6def53ce-d3f7-406c-8a61-9366b60c81dc", "eventTime": "2019-08-16T08:48:33Z", "eventName": "DescribeAlarms", "eventSource": "monitoring.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-west-3", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudwatch:DescribeAlarms on resource: arn:aws:cloudwatch:eu-west-3:811596193553:alarm:*", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "03b5cb48-32a3-4dbb-b365-2c97839cdb", "record_id": "flaws_cloudtrail:0000519:03b5cb48-32a3-4dbb-b365-2c97839cdb", "row_index": 519, "timestamp": "2019-08-16T08:48:33Z", "event_type": "DescribeAlarms", "event_source": "monitoring.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-north-1"}, "resource_arns": [], "raw_record_size_bytes": 884, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "03b5cb48-32a3-4dbb-b365-2c97839cdb", "eventTime": "2019-08-16T08:48:33Z", "eventName": "DescribeAlarms", "eventSource": "monitoring.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-north-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudwatch:DescribeAlarms on resource: arn:aws:cloudwatch:eu-north-1:811596193553:alarm:*", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4fec9bed-2e8c-4794-8342-234074e4ef62", "record_id": "flaws_cloudtrail:0000520:4fec9bed-2e8c-4794-8342-234074e4ef62", "row_index": 520, "timestamp": "2019-08-16T08:48:33Z", "event_type": "DescribeAlarms", "event_source": "monitoring.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 884, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4fec9bed-2e8c-4794-8342-234074e4ef62", "eventTime": "2019-08-16T08:48:33Z", "eventName": "DescribeAlarms", "eventSource": "monitoring.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-west-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudwatch:DescribeAlarms on resource: arn:aws:cloudwatch:eu-west-1:811596193553:alarm:*", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d030989ff-28ec-449f-a30a-f9303c3a0255", "record_id": "flaws_cloudtrail:0000521:d030989ff-28ec-449f-a30a-f9303c3a0255", "row_index": 521, "timestamp": "2019-08-16T08:48:33Z", "event_type": "DescribeAlarms", "event_source": "monitoring.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 885, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d030989ff-28ec-449f-a30a-f9303c3a0255", "eventTime": "2019-08-16T08:48:33Z", "eventName": "DescribeAlarms", "eventSource": "monitoring.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudwatch:DescribeAlarms on resource: arn:aws:cloudwatch:eu-west-2:811596193553:alarm:*", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6def53ce-d3f7-406c-8a61-9366b60c81dc", "record_id": "flaws_cloudtrail:0000522:6def53ce-d3f7-406c-8a61-9366b60c81dc", "row_index": 522, "timestamp": "2019-08-16T08:48:33Z", "event_type": "DescribeAlarms", "event_source": "monitoring.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 884, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6def53ce-d3f7-406c-8a61-9366b60c81dc", "eventTime": "2019-08-16T08:48:33Z", "eventName": "DescribeAlarms", "eventSource": "monitoring.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-west-3", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudwatch:DescribeAlarms on resource: arn:aws:cloudwatch:eu-west-3:811596193553:alarm:*", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ab17da70-e843-4344-a5a4-8820f56ade33", "record_id": "flaws_cloudtrail:0000523:ab17da70-e843-4344-a5a4-8820f56ade33", "row_index": 523, "timestamp": "2019-08-16T08:48:37Z", "event_type": "DescribeAlarms", "event_source": "monitoring.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 884, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ab17da70-e843-4344-a5a4-8820f56ade33", "eventTime": "2019-08-16T08:48:37Z", "eventName": "DescribeAlarms", "eventSource": "monitoring.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-west-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudwatch:DescribeAlarms on resource: arn:aws:cloudwatch:us-west-1:811596193553:alarm:*", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ab17da70-e843-4344-a5a4-8820f56ade33", "record_id": "flaws_cloudtrail:0000524:ab17da70-e843-4344-a5a4-8820f56ade33", "row_index": 524, "timestamp": "2019-08-16T08:48:37Z", "event_type": "DescribeAlarms", "event_source": "monitoring.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 884, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ab17da70-e843-4344-a5a4-8820f56ade33", "eventTime": "2019-08-16T08:48:37Z", "eventName": "DescribeAlarms", "eventSource": "monitoring.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-west-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudwatch:DescribeAlarms on resource: arn:aws:cloudwatch:us-west-1:811596193553:alarm:*", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "523675f-b061-4003-9e2f-3f93e89128d8", "record_id": "flaws_cloudtrail:0000525:523675f-b061-4003-9e2f-3f93e89128d8", "row_index": 525, "timestamp": "2019-08-16T08:48:38Z", "event_type": "DescribeAlarms", "event_source": "monitoring.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 883, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "523675f-b061-4003-9e2f-3f93e89128d8", "eventTime": "2019-08-16T08:48:38Z", "eventName": "DescribeAlarms", "eventSource": "monitoring.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudwatch:DescribeAlarms on resource: arn:aws:cloudwatch:us-west-2:811596193553:alarm:*", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "523675f-b061-4003-9e2f-3f93e89128d8", "record_id": "flaws_cloudtrail:0000526:523675f-b061-4003-9e2f-3f93e89128d8", "row_index": 526, "timestamp": "2019-08-16T08:48:38Z", "event_type": "DescribeAlarms", "event_source": "monitoring.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 883, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "523675f-b061-4003-9e2f-3f93e89128d8", "eventTime": "2019-08-16T08:48:38Z", "eventName": "DescribeAlarms", "eventSource": "monitoring.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudwatch:DescribeAlarms on resource: arn:aws:cloudwatch:us-west-2:811596193553:alarm:*", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b5f1f7ad-f257-4e68-8140-e904bd752ef0", "record_id": "flaws_cloudtrail:0000527:b5f1f7ad-f257-4e68-8140-e904bd752ef0", "row_index": 527, "timestamp": "2019-08-16T08:48:39Z", "event_type": "DescribeAlarms", "event_source": "monitoring.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 884, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b5f1f7ad-f257-4e68-8140-e904bd752ef0", "eventTime": "2019-08-16T08:48:39Z", "eventName": "DescribeAlarms", "eventSource": "monitoring.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "sa-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudwatch:DescribeAlarms on resource: arn:aws:cloudwatch:sa-east-1:811596193553:alarm:*", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b5f1f7ad-f257-4e68-8140-e904bd752ef0", "record_id": "flaws_cloudtrail:0000528:b5f1f7ad-f257-4e68-8140-e904bd752ef0", "row_index": 528, "timestamp": "2019-08-16T08:48:39Z", "event_type": "DescribeAlarms", "event_source": "monitoring.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 884, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b5f1f7ad-f257-4e68-8140-e904bd752ef0", "eventTime": "2019-08-16T08:48:39Z", "eventName": "DescribeAlarms", "eventSource": "monitoring.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "sa-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudwatch:DescribeAlarms on resource: arn:aws:cloudwatch:sa-east-1:811596193553:alarm:*", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a86e49ef-edcd-4a53-b1b5-8986fd34499a", "record_id": "flaws_cloudtrail:0000529:a86e49ef-edcd-4a53-b1b5-8986fd34499a", "row_index": 529, "timestamp": "2019-08-16T08:48:40Z", "event_type": "DescribeAlarms", "event_source": "monitoring.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 894, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a86e49ef-edcd-4a53-b1b5-8986fd34499a", "eventTime": "2019-08-16T08:48:40Z", "eventName": "DescribeAlarms", "eventSource": "monitoring.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-northeast-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudwatch:DescribeAlarms on resource: arn:aws:cloudwatch:ap-northeast-2:811596193553:alarm:*", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a86e49ef-edcd-4a53-b1b5-8986fd34499a", "record_id": "flaws_cloudtrail:0000530:a86e49ef-edcd-4a53-b1b5-8986fd34499a", "row_index": 530, "timestamp": "2019-08-16T08:48:40Z", "event_type": "DescribeAlarms", "event_source": "monitoring.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 894, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a86e49ef-edcd-4a53-b1b5-8986fd34499a", "eventTime": "2019-08-16T08:48:40Z", "eventName": "DescribeAlarms", "eventSource": "monitoring.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-northeast-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudwatch:DescribeAlarms on resource: arn:aws:cloudwatch:ap-northeast-2:811596193553:alarm:*", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "74e36fdb-85c6-4fdb-be48-4f1f3c1f9721", "record_id": "flaws_cloudtrail:0000531:74e36fdb-85c6-4fdb-be48-4f1f3c1f9721", "row_index": 531, "timestamp": "2019-08-16T08:48:41Z", "event_type": "DescribeVpcs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 695, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "74e36fdb-85c6-4fdb-be48-4f1f3c1f9721", "eventTime": "2019-08-16T08:48:41Z", "eventName": "DescribeVpcs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"vpcSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "74e36fdb-85c6-4fdb-be48-4f1f3c1f9721", "record_id": "flaws_cloudtrail:0000532:74e36fdb-85c6-4fdb-be48-4f1f3c1f9721", "row_index": 532, "timestamp": "2019-08-16T08:48:41Z", "event_type": "DescribeVpcs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 695, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "74e36fdb-85c6-4fdb-be48-4f1f3c1f9721", "eventTime": "2019-08-16T08:48:41Z", "eventName": "DescribeVpcs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"vpcSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fae375160-6e9b-48a6-bbec-19477e05d4ae", "record_id": "flaws_cloudtrail:0000533:fae375160-6e9b-48a6-bbec-19477e05d4ae", "row_index": 533, "timestamp": "2019-08-16T08:48:42Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fae375160-6e9b-48a6-bbec-19477e05d4ae", "eventTime": "2019-08-16T08:48:42Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ffd350ac-cd0e-4e36-ac75-f7d797757ba9b", "record_id": "flaws_cloudtrail:0000534:ffd350ac-cd0e-4e36-ac75-f7d797757ba9b", "row_index": 534, "timestamp": "2019-08-16T08:48:42Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 815, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ffd350ac-cd0e-4e36-ac75-f7d797757ba9b", "eventTime": "2019-08-16T08:48:42Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {}, "filterSet": {"items": [{"name": "owner-id", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fae375160-6e9b-48a6-bbec-19477e05d4ae", "record_id": "flaws_cloudtrail:0000535:fae375160-6e9b-48a6-bbec-19477e05d4ae", "row_index": 535, "timestamp": "2019-08-16T08:48:42Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fae375160-6e9b-48a6-bbec-19477e05d4ae", "eventTime": "2019-08-16T08:48:42Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ffd350ac-cd0e-4e36-ac75-f7d797757ba9b", "record_id": "flaws_cloudtrail:0000536:ffd350ac-cd0e-4e36-ac75-f7d797757ba9b", "row_index": 536, "timestamp": "2019-08-16T08:48:42Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 815, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ffd350ac-cd0e-4e36-ac75-f7d797757ba9b", "eventTime": "2019-08-16T08:48:42Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {}, "filterSet": {"items": [{"name": "owner-id", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5230c426-fe74-4c7c-b4c4-7d5c13480e85", "record_id": "flaws_cloudtrail:0000537:5230c426-fe74-4c7c-b4c4-7d5c13480e85", "row_index": 537, "timestamp": "2019-08-16T08:48:43Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 815, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5230c426-fe74-4c7c-b4c4-7d5c13480e85", "eventTime": "2019-08-16T08:48:43Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {}, "filterSet": {"items": [{"name": "owner-id", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8ab95719-fe06-4024-9d69-059424979704", "record_id": "flaws_cloudtrail:0000538:8ab95719-fe06-4024-9d69-059424979704", "row_index": 538, "timestamp": "2019-08-16T08:48:43Z", "event_type": "DescribeAlarms", "event_source": "monitoring.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 893, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8ab95719-fe06-4024-9d69-059424979704", "eventTime": "2019-08-16T08:48:43Z", "eventName": "DescribeAlarms", "eventSource": "monitoring.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-southeast-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudwatch:DescribeAlarms on resource: arn:aws:cloudwatch:ap-southeast-2:811596193553:alarm:*", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5230c426-fe74-4c7c-b4c4-7d5c13480e85", "record_id": "flaws_cloudtrail:0000539:5230c426-fe74-4c7c-b4c4-7d5c13480e85", "row_index": 539, "timestamp": "2019-08-16T08:48:43Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 815, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5230c426-fe74-4c7c-b4c4-7d5c13480e85", "eventTime": "2019-08-16T08:48:43Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {}, "filterSet": {"items": [{"name": "owner-id", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8ab95719-fe06-4024-9d69-059424979704", "record_id": "flaws_cloudtrail:0000540:8ab95719-fe06-4024-9d69-059424979704", "row_index": 540, "timestamp": "2019-08-16T08:48:43Z", "event_type": "DescribeAlarms", "event_source": "monitoring.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 893, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8ab95719-fe06-4024-9d69-059424979704", "eventTime": "2019-08-16T08:48:43Z", "eventName": "DescribeAlarms", "eventSource": "monitoring.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-southeast-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudwatch:DescribeAlarms on resource: arn:aws:cloudwatch:ap-southeast-2:811596193553:alarm:*", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "218c7136-6224-4e10-81b0-847dc821bab7", "record_id": "flaws_cloudtrail:0000541:218c7136-6224-4e10-81b0-847dc821bab7", "row_index": 541, "timestamp": "2019-08-16T08:48:44Z", "event_type": "DescribeVpcs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 695, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "218c7136-6224-4e10-81b0-847dc821bab7", "eventTime": "2019-08-16T08:48:44Z", "eventName": "DescribeVpcs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"vpcSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "874244f38-729a-4bb8-9678-2c60641eb925", "record_id": "flaws_cloudtrail:0000542:874244f38-729a-4bb8-9678-2c60641eb925", "row_index": 542, "timestamp": "2019-08-16T08:48:44Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "874244f38-729a-4bb8-9678-2c60641eb925", "eventTime": "2019-08-16T08:48:44Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d9a36994-f390-4a8c-9fd2-27119e6a9", "record_id": "flaws_cloudtrail:0000543:d9a36994-f390-4a8c-9fd2-27119e6a9", "row_index": 543, "timestamp": "2019-08-16T08:48:44Z", "event_type": "DescribeVpcs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 687, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d9a36994-f390-4a8c-9fd2-27119e6a9", "eventTime": "2019-08-16T08:48:44Z", "eventName": "DescribeVpcs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"vpcSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5ce2324f-ec66-4392-9f7b-8ba9d383ac24", "record_id": "flaws_cloudtrail:0000544:5ce2324f-ec66-4392-9f7b-8ba9d383ac24", "row_index": 544, "timestamp": "2019-08-16T08:48:44Z", "event_type": "DescribeAlarms", "event_source": "monitoring.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 884, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5ce2324f-ec66-4392-9f7b-8ba9d383ac24", "eventTime": "2019-08-16T08:48:44Z", "eventName": "DescribeAlarms", "eventSource": "monitoring.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudwatch:DescribeAlarms on resource: arn:aws:cloudwatch:us-east-1:811596193553:alarm:*", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "218c7136-6224-4e10-81b0-847dc821bab7", "record_id": "flaws_cloudtrail:0000545:218c7136-6224-4e10-81b0-847dc821bab7", "row_index": 545, "timestamp": "2019-08-16T08:48:44Z", "event_type": "DescribeVpcs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 695, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "218c7136-6224-4e10-81b0-847dc821bab7", "eventTime": "2019-08-16T08:48:44Z", "eventName": "DescribeVpcs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"vpcSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "874244f38-729a-4bb8-9678-2c60641eb925", "record_id": "flaws_cloudtrail:0000546:874244f38-729a-4bb8-9678-2c60641eb925", "row_index": 546, "timestamp": "2019-08-16T08:48:44Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "874244f38-729a-4bb8-9678-2c60641eb925", "eventTime": "2019-08-16T08:48:44Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d9a36994-f390-4a8c-9fd2-27119e6a9", "record_id": "flaws_cloudtrail:0000547:d9a36994-f390-4a8c-9fd2-27119e6a9", "row_index": 547, "timestamp": "2019-08-16T08:48:44Z", "event_type": "DescribeVpcs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 687, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d9a36994-f390-4a8c-9fd2-27119e6a9", "eventTime": "2019-08-16T08:48:44Z", "eventName": "DescribeVpcs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"vpcSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5ce2324f-ec66-4392-9f7b-8ba9d383ac24", "record_id": "flaws_cloudtrail:0000548:5ce2324f-ec66-4392-9f7b-8ba9d383ac24", "row_index": 548, "timestamp": "2019-08-16T08:48:44Z", "event_type": "DescribeAlarms", "event_source": "monitoring.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 884, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5ce2324f-ec66-4392-9f7b-8ba9d383ac24", "eventTime": "2019-08-16T08:48:44Z", "eventName": "DescribeAlarms", "eventSource": "monitoring.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudwatch:DescribeAlarms on resource: arn:aws:cloudwatch:us-east-1:811596193553:alarm:*", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f3084e03-2383-405f-a963-14b6ccf6059c", "record_id": "flaws_cloudtrail:0000549:f3084e03-2383-405f-a963-14b6ccf6059c", "row_index": 549, "timestamp": "2019-08-16T08:48:45Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 819, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f3084e03-2383-405f-a963-14b6ccf6059c", "eventTime": "2019-08-16T08:48:45Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {"items": [{"name": "owner-id", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7a34b8d0-7182-4b4a-87fd-cfb242d24ad1", "record_id": "flaws_cloudtrail:0000550:7a34b8d0-7182-4b4a-87fd-cfb242d24ad1", "row_index": 550, "timestamp": "2019-08-16T08:48:45Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 811, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7a34b8d0-7182-4b4a-87fd-cfb242d24ad1", "eventTime": "2019-08-16T08:48:45Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {}, "filterSet": {"items": [{"name": "owner-id", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "94dd629c-8d0c-4a8c-b451-313b5bf3fcb2", "record_id": "flaws_cloudtrail:0000551:94dd629c-8d0c-4a8c-b451-313b5bf3fcb2", "row_index": 551, "timestamp": "2019-08-16T08:48:45Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 699, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "94dd629c-8d0c-4a8c-b451-313b5bf3fcb2", "eventTime": "2019-08-16T08:48:45Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f3084e03-2383-405f-a963-14b6ccf6059c", "record_id": "flaws_cloudtrail:0000552:f3084e03-2383-405f-a963-14b6ccf6059c", "row_index": 552, "timestamp": "2019-08-16T08:48:45Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 819, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f3084e03-2383-405f-a963-14b6ccf6059c", "eventTime": "2019-08-16T08:48:45Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {"items": [{"name": "owner-id", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7a34b8d0-7182-4b4a-87fd-cfb242d24ad1", "record_id": "flaws_cloudtrail:0000553:7a34b8d0-7182-4b4a-87fd-cfb242d24ad1", "row_index": 553, "timestamp": "2019-08-16T08:48:45Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 811, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7a34b8d0-7182-4b4a-87fd-cfb242d24ad1", "eventTime": "2019-08-16T08:48:45Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {}, "filterSet": {"items": [{"name": "owner-id", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "94dd629c-8d0c-4a8c-b451-313b5bf3fcb2", "record_id": "flaws_cloudtrail:0000554:94dd629c-8d0c-4a8c-b451-313b5bf3fcb2", "row_index": 554, "timestamp": "2019-08-16T08:48:45Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 699, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "94dd629c-8d0c-4a8c-b451-313b5bf3fcb2", "eventTime": "2019-08-16T08:48:45Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6b64e527-2976-4a98-b4ba-5b23b8a5413d", "record_id": "flaws_cloudtrail:0000555:6b64e527-2976-4a98-b4ba-5b23b8a5413d", "row_index": 555, "timestamp": "2019-08-16T08:48:46Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 815, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6b64e527-2976-4a98-b4ba-5b23b8a5413d", "eventTime": "2019-08-16T08:48:46Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {"items": [{"name": "owner-id", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4ac1d48d-000a-4814-af52-954f04a9f57c", "record_id": "flaws_cloudtrail:0000556:4ac1d48d-000a-4814-af52-954f04a9f57c", "row_index": 556, "timestamp": "2019-08-16T08:48:46Z", "event_type": "DescribeVpcs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 697, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4ac1d48d-000a-4814-af52-954f04a9f57c", "eventTime": "2019-08-16T08:48:46Z", "eventName": "DescribeVpcs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"vpcSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6b64e527-2976-4a98-b4ba-5b23b8a5413d", "record_id": "flaws_cloudtrail:0000557:6b64e527-2976-4a98-b4ba-5b23b8a5413d", "row_index": 557, "timestamp": "2019-08-16T08:48:46Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 815, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6b64e527-2976-4a98-b4ba-5b23b8a5413d", "eventTime": "2019-08-16T08:48:46Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {"items": [{"name": "owner-id", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4ac1d48d-000a-4814-af52-954f04a9f57c", "record_id": "flaws_cloudtrail:0000558:4ac1d48d-000a-4814-af52-954f04a9f57c", "row_index": 558, "timestamp": "2019-08-16T08:48:46Z", "event_type": "DescribeVpcs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 697, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4ac1d48d-000a-4814-af52-954f04a9f57c", "eventTime": "2019-08-16T08:48:46Z", "eventName": "DescribeVpcs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"vpcSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "baadb4c2-2f51-4886-8cf1-e3dbbf0f52d5", "record_id": "flaws_cloudtrail:0000559:baadb4c2-2f51-4886-8cf1-e3dbbf0f52d5", "row_index": 559, "timestamp": "2019-08-16T08:48:47Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 819, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "baadb4c2-2f51-4886-8cf1-e3dbbf0f52d5", "eventTime": "2019-08-16T08:48:47Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {"items": [{"name": "owner-id", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ba8f0f12-2e13-407f-a2b0-20bc40fd9bb6", "record_id": "flaws_cloudtrail:0000560:ba8f0f12-2e13-407f-a2b0-20bc40fd9bb6", "row_index": 560, "timestamp": "2019-08-16T08:48:47Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 815, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ba8f0f12-2e13-407f-a2b0-20bc40fd9bb6", "eventTime": "2019-08-16T08:48:47Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {}, "filterSet": {"items": [{"name": "owner-id", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f067b6ea-396e-4d72-a30e-ff111d176ada", "record_id": "flaws_cloudtrail:0000561:f067b6ea-396e-4d72-a30e-ff111d176ada", "row_index": 561, "timestamp": "2019-08-16T08:48:47Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f067b6ea-396e-4d72-a30e-ff111d176ada", "eventTime": "2019-08-16T08:48:47Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c75e9745-768e-4d6a-9447-3a21659bef03", "record_id": "flaws_cloudtrail:0000562:c75e9745-768e-4d6a-9447-3a21659bef03", "row_index": 562, "timestamp": "2019-08-16T08:48:47Z", "event_type": "DescribeAlarms", "event_source": "monitoring.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 890, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c75e9745-768e-4d6a-9447-3a21659bef03", "eventTime": "2019-08-16T08:48:47Z", "eventName": "DescribeAlarms", "eventSource": "monitoring.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-central-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudwatch:DescribeAlarms on resource: arn:aws:cloudwatch:eu-central-1:811596193553:alarm:*", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "baadb4c2-2f51-4886-8cf1-e3dbbf0f52d5", "record_id": "flaws_cloudtrail:0000563:baadb4c2-2f51-4886-8cf1-e3dbbf0f52d5", "row_index": 563, "timestamp": "2019-08-16T08:48:47Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 819, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "baadb4c2-2f51-4886-8cf1-e3dbbf0f52d5", "eventTime": "2019-08-16T08:48:47Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {"items": [{"name": "owner-id", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ba8f0f12-2e13-407f-a2b0-20bc40fd9bb6", "record_id": "flaws_cloudtrail:0000564:ba8f0f12-2e13-407f-a2b0-20bc40fd9bb6", "row_index": 564, "timestamp": "2019-08-16T08:48:47Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 815, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ba8f0f12-2e13-407f-a2b0-20bc40fd9bb6", "eventTime": "2019-08-16T08:48:47Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {}, "filterSet": {"items": [{"name": "owner-id", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f067b6ea-396e-4d72-a30e-ff111d176ada", "record_id": "flaws_cloudtrail:0000565:f067b6ea-396e-4d72-a30e-ff111d176ada", "row_index": 565, "timestamp": "2019-08-16T08:48:47Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f067b6ea-396e-4d72-a30e-ff111d176ada", "eventTime": "2019-08-16T08:48:47Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c75e9745-768e-4d6a-9447-3a21659bef03", "record_id": "flaws_cloudtrail:0000566:c75e9745-768e-4d6a-9447-3a21659bef03", "row_index": 566, "timestamp": "2019-08-16T08:48:47Z", "event_type": "DescribeAlarms", "event_source": "monitoring.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 890, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c75e9745-768e-4d6a-9447-3a21659bef03", "eventTime": "2019-08-16T08:48:47Z", "eventName": "DescribeAlarms", "eventSource": "monitoring.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-central-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: cloudwatch:DescribeAlarms on resource: arn:aws:cloudwatch:eu-central-1:811596193553:alarm:*", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a9d0b797-0689-432d-ab3e-1b996c2118e2", "record_id": "flaws_cloudtrail:0000567:a9d0b797-0689-432d-ab3e-1b996c2118e2", "row_index": 567, "timestamp": "2019-08-16T08:48:48Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 819, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a9d0b797-0689-432d-ab3e-1b996c2118e2", "eventTime": "2019-08-16T08:48:48Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {"items": [{"name": "owner-id", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "032b5be3-7bdc-48b5-b200-08443b11d1c", "record_id": "flaws_cloudtrail:0000568:032b5be3-7bdc-48b5-b200-08443b11d1c", "row_index": 568, "timestamp": "2019-08-16T08:48:48Z", "event_type": "DescribeVpcs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 694, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "032b5be3-7bdc-48b5-b200-08443b11d1c", "eventTime": "2019-08-16T08:48:48Z", "eventName": "DescribeVpcs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"vpcSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a9d0b797-0689-432d-ab3e-1b996c2118e2", "record_id": "flaws_cloudtrail:0000569:a9d0b797-0689-432d-ab3e-1b996c2118e2", "row_index": 569, "timestamp": "2019-08-16T08:48:48Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 819, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a9d0b797-0689-432d-ab3e-1b996c2118e2", "eventTime": "2019-08-16T08:48:48Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {"items": [{"name": "owner-id", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "032b5be3-7bdc-48b5-b200-08443b11d1c", "record_id": "flaws_cloudtrail:0000570:032b5be3-7bdc-48b5-b200-08443b11d1c", "row_index": 570, "timestamp": "2019-08-16T08:48:48Z", "event_type": "DescribeVpcs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 694, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "032b5be3-7bdc-48b5-b200-08443b11d1c", "eventTime": "2019-08-16T08:48:48Z", "eventName": "DescribeVpcs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"vpcSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cfcb2f18-0c92-4f87-a450-304e84118", "record_id": "flaws_cloudtrail:0000571:cfcb2f18-0c92-4f87-a450-304e84118", "row_index": 571, "timestamp": "2019-08-16T08:48:49Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 812, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cfcb2f18-0c92-4f87-a450-304e84118", "eventTime": "2019-08-16T08:48:49Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {}, "filterSet": {"items": [{"name": "owner-id", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2c0cad64-7baf-4556-917c-5b9cb69d2a28", "record_id": "flaws_cloudtrail:0000572:2c0cad64-7baf-4556-917c-5b9cb69d2a28", "row_index": 572, "timestamp": "2019-08-16T08:48:49Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 817, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2c0cad64-7baf-4556-917c-5b9cb69d2a28", "eventTime": "2019-08-16T08:48:49Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {"items": [{"name": "owner-id", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cfcb2f18-0c92-4f87-a450-304e84118", "record_id": "flaws_cloudtrail:0000573:cfcb2f18-0c92-4f87-a450-304e84118", "row_index": 573, "timestamp": "2019-08-16T08:48:49Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 812, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cfcb2f18-0c92-4f87-a450-304e84118", "eventTime": "2019-08-16T08:48:49Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {}, "filterSet": {"items": [{"name": "owner-id", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2c0cad64-7baf-4556-917c-5b9cb69d2a28", "record_id": "flaws_cloudtrail:0000574:2c0cad64-7baf-4556-917c-5b9cb69d2a28", "row_index": 574, "timestamp": "2019-08-16T08:48:49Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 817, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2c0cad64-7baf-4556-917c-5b9cb69d2a28", "eventTime": "2019-08-16T08:48:49Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {"items": [{"name": "owner-id", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0c655ae8-693e-4e82-8da4-17a8da3ed566", "record_id": "flaws_cloudtrail:0000575:0c655ae8-693e-4e82-8da4-17a8da3ed566", "row_index": 575, "timestamp": "2019-08-16T08:48:50Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 819, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0c655ae8-693e-4e82-8da4-17a8da3ed566", "eventTime": "2019-08-16T08:48:50Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {"items": [{"name": "owner-id", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0c655ae8-693e-4e82-8da4-17a8da3ed566", "record_id": "flaws_cloudtrail:0000576:0c655ae8-693e-4e82-8da4-17a8da3ed566", "row_index": 576, "timestamp": "2019-08-16T08:48:50Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 819, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0c655ae8-693e-4e82-8da4-17a8da3ed566", "eventTime": "2019-08-16T08:48:50Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {"items": [{"name": "owner-id", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "99ea949e-fe37-4d67-958f-a9de71eec773", "record_id": "flaws_cloudtrail:0000577:99ea949e-fe37-4d67-958f-a9de71eec773", "row_index": 577, "timestamp": "2019-08-16T08:48:51Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 810, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "99ea949e-fe37-4d67-958f-a9de71eec773", "eventTime": "2019-08-16T08:48:51Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {}, "filterSet": {"items": [{"name": "owner-id", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "99ea949e-fe37-4d67-958f-a9de71eec773", "record_id": "flaws_cloudtrail:0000578:99ea949e-fe37-4d67-958f-a9de71eec773", "row_index": 578, "timestamp": "2019-08-16T08:48:51Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 810, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "99ea949e-fe37-4d67-958f-a9de71eec773", "eventTime": "2019-08-16T08:48:51Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {}, "filterSet": {"items": [{"name": "owner-id", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6e366574b-7ed5-4715-beb8-3062b0aef124", "record_id": "flaws_cloudtrail:0000579:6e366574b-7ed5-4715-beb8-3062b0aef124", "row_index": 579, "timestamp": "2019-08-16T08:48:52Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 703, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6e366574b-7ed5-4715-beb8-3062b0aef124", "eventTime": "2019-08-16T08:48:52Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dd2f6b77-a74c-47fc-b99e-8421d3bbb8b0", "record_id": "flaws_cloudtrail:0000580:dd2f6b77-a74c-47fc-b99e-8421d3bbb8b0", "row_index": 580, "timestamp": "2019-08-16T08:48:52Z", "event_type": "DescribeVpcs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-north-1"}, "resource_arns": [], "raw_record_size_bytes": 693, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dd2f6b77-a74c-47fc-b99e-8421d3bbb8b0", "eventTime": "2019-08-16T08:48:52Z", "eventName": "DescribeVpcs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-north-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"vpcSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0d966dea-e553-4bec-85be-fc0a28c05a14", "record_id": "flaws_cloudtrail:0000581:0d966dea-e553-4bec-85be-fc0a28c05a14", "row_index": 581, "timestamp": "2019-08-16T08:48:52Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-north-1"}, "resource_arns": [], "raw_record_size_bytes": 812, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0d966dea-e553-4bec-85be-fc0a28c05a14", "eventTime": "2019-08-16T08:48:52Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-north-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {}, "filterSet": {"items": [{"name": "owner-id", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6e366574b-7ed5-4715-beb8-3062b0aef124", "record_id": "flaws_cloudtrail:0000582:6e366574b-7ed5-4715-beb8-3062b0aef124", "row_index": 582, "timestamp": "2019-08-16T08:48:52Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 703, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6e366574b-7ed5-4715-beb8-3062b0aef124", "eventTime": "2019-08-16T08:48:52Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dd2f6b77-a74c-47fc-b99e-8421d3bbb8b0", "record_id": "flaws_cloudtrail:0000583:dd2f6b77-a74c-47fc-b99e-8421d3bbb8b0", "row_index": 583, "timestamp": "2019-08-16T08:48:52Z", "event_type": "DescribeVpcs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-north-1"}, "resource_arns": [], "raw_record_size_bytes": 693, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dd2f6b77-a74c-47fc-b99e-8421d3bbb8b0", "eventTime": "2019-08-16T08:48:52Z", "eventName": "DescribeVpcs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-north-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"vpcSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0d966dea-e553-4bec-85be-fc0a28c05a14", "record_id": "flaws_cloudtrail:0000584:0d966dea-e553-4bec-85be-fc0a28c05a14", "row_index": 584, "timestamp": "2019-08-16T08:48:52Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-north-1"}, "resource_arns": [], "raw_record_size_bytes": 812, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0d966dea-e553-4bec-85be-fc0a28c05a14", "eventTime": "2019-08-16T08:48:52Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-north-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {}, "filterSet": {"items": [{"name": "owner-id", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a56f02e1-0796-42ff-94c6-6f4a672ba2cc", "record_id": "flaws_cloudtrail:0000585:a56f02e1-0796-42ff-94c6-6f4a672ba2cc", "row_index": 585, "timestamp": "2019-08-16T08:48:53Z", "event_type": "DescribeVpcs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 695, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a56f02e1-0796-42ff-94c6-6f4a672ba2cc", "eventTime": "2019-08-16T08:48:53Z", "eventName": "DescribeVpcs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"vpcSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "46ad2d8b-66ae-40ba-9de1-ec8b163d75bd", "record_id": "flaws_cloudtrail:0000586:46ad2d8b-66ae-40ba-9de1-ec8b163d75bd", "row_index": 586, "timestamp": "2019-08-16T08:48:53Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-north-1"}, "resource_arns": [], "raw_record_size_bytes": 815, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "46ad2d8b-66ae-40ba-9de1-ec8b163d75bd", "eventTime": "2019-08-16T08:48:53Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-north-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {"items": [{"name": "owner-id", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "035b66cc-a683-425e-9f82-06eb243715ad3", "record_id": "flaws_cloudtrail:0000587:035b66cc-a683-425e-9f82-06eb243715ad3", "row_index": 587, "timestamp": "2019-08-16T08:48:53Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-north-1"}, "resource_arns": [], "raw_record_size_bytes": 700, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "035b66cc-a683-425e-9f82-06eb243715ad3", "eventTime": "2019-08-16T08:48:53Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-north-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8a2fe41b-b827-4b13-a338-051d6c06249", "record_id": "flaws_cloudtrail:0000588:8a2fe41b-b827-4b13-a338-051d6c06249", "row_index": 588, "timestamp": "2019-08-16T08:48:53Z", "event_type": "DescribeVpcs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 691, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8a2fe41b-b827-4b13-a338-051d6c06249", "eventTime": "2019-08-16T08:48:53Z", "eventName": "DescribeVpcs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"vpcSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a56f02e1-0796-42ff-94c6-6f4a672ba2cc", "record_id": "flaws_cloudtrail:0000589:a56f02e1-0796-42ff-94c6-6f4a672ba2cc", "row_index": 589, "timestamp": "2019-08-16T08:48:53Z", "event_type": "DescribeVpcs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 695, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a56f02e1-0796-42ff-94c6-6f4a672ba2cc", "eventTime": "2019-08-16T08:48:53Z", "eventName": "DescribeVpcs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"vpcSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "46ad2d8b-66ae-40ba-9de1-ec8b163d75bd", "record_id": "flaws_cloudtrail:0000590:46ad2d8b-66ae-40ba-9de1-ec8b163d75bd", "row_index": 590, "timestamp": "2019-08-16T08:48:53Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-north-1"}, "resource_arns": [], "raw_record_size_bytes": 815, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "46ad2d8b-66ae-40ba-9de1-ec8b163d75bd", "eventTime": "2019-08-16T08:48:53Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-north-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {"items": [{"name": "owner-id", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "035b66cc-a683-425e-9f82-06eb243715ad3", "record_id": "flaws_cloudtrail:0000591:035b66cc-a683-425e-9f82-06eb243715ad3", "row_index": 591, "timestamp": "2019-08-16T08:48:53Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-north-1"}, "resource_arns": [], "raw_record_size_bytes": 700, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "035b66cc-a683-425e-9f82-06eb243715ad3", "eventTime": "2019-08-16T08:48:53Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-north-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8a2fe41b-b827-4b13-a338-051d6c06249", "record_id": "flaws_cloudtrail:0000592:8a2fe41b-b827-4b13-a338-051d6c06249", "row_index": 592, "timestamp": "2019-08-16T08:48:53Z", "event_type": "DescribeVpcs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 691, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8a2fe41b-b827-4b13-a338-051d6c06249", "eventTime": "2019-08-16T08:48:53Z", "eventName": "DescribeVpcs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"vpcSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b02ab3a7-6a7b-486d-970f-9c825cd1b0d8", "record_id": "flaws_cloudtrail:0000593:b02ab3a7-6a7b-486d-970f-9c825cd1b0d8", "row_index": 593, "timestamp": "2019-08-16T08:48:54Z", "event_type": "DescribeVpcs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 695, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b02ab3a7-6a7b-486d-970f-9c825cd1b0d8", "eventTime": "2019-08-16T08:48:54Z", "eventName": "DescribeVpcs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"vpcSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6a0c44ce-ef73-4773-9346-ad3c0d4a207e", "record_id": "flaws_cloudtrail:0000594:6a0c44ce-ef73-4773-9346-ad3c0d4a207e", "row_index": 594, "timestamp": "2019-08-16T08:48:54Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 814, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6a0c44ce-ef73-4773-9346-ad3c0d4a207e", "eventTime": "2019-08-16T08:48:54Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {"items": [{"name": "owner-id", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "809c2704-ea01-44ed-94c4-278e6a3011da", "record_id": "flaws_cloudtrail:0000595:809c2704-ea01-44ed-94c4-278e6a3011da", "row_index": 595, "timestamp": "2019-08-16T08:48:54Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 810, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "809c2704-ea01-44ed-94c4-278e6a3011da", "eventTime": "2019-08-16T08:48:54Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {}, "filterSet": {"items": [{"name": "owner-id", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ff30e997-fc1d-4523-bc51-754e9063c96a", "record_id": "flaws_cloudtrail:0000596:ff30e997-fc1d-4523-bc51-754e9063c96a", "row_index": 596, "timestamp": "2019-08-16T08:48:54Z", "event_type": "DescribeVpcs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 692, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ff30e997-fc1d-4523-bc51-754e9063c96a", "eventTime": "2019-08-16T08:48:54Z", "eventName": "DescribeVpcs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"vpcSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "965255-0178-4e5e-9018-63b10da0fae6", "record_id": "flaws_cloudtrail:0000597:965255-0178-4e5e-9018-63b10da0fae6", "row_index": 597, "timestamp": "2019-08-16T08:48:54Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 827, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "965255-0178-4e5e-9018-63b10da0fae6", "eventTime": "2019-08-16T08:48:54Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: iam:ListPolicies on resource: policy path /", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b02ab3a7-6a7b-486d-970f-9c825cd1b0d8", "record_id": "flaws_cloudtrail:0000598:b02ab3a7-6a7b-486d-970f-9c825cd1b0d8", "row_index": 598, "timestamp": "2019-08-16T08:48:54Z", "event_type": "DescribeVpcs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 695, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b02ab3a7-6a7b-486d-970f-9c825cd1b0d8", "eventTime": "2019-08-16T08:48:54Z", "eventName": "DescribeVpcs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"vpcSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "809c2704-ea01-44ed-94c4-278e6a3011da", "record_id": "flaws_cloudtrail:0000599:809c2704-ea01-44ed-94c4-278e6a3011da", "row_index": 599, "timestamp": "2019-08-16T08:48:54Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 810, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "809c2704-ea01-44ed-94c4-278e6a3011da", "eventTime": "2019-08-16T08:48:54Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {}, "filterSet": {"items": [{"name": "owner-id", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6a0c44ce-ef73-4773-9346-ad3c0d4a207e", "record_id": "flaws_cloudtrail:0000600:6a0c44ce-ef73-4773-9346-ad3c0d4a207e", "row_index": 600, "timestamp": "2019-08-16T08:48:54Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 814, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6a0c44ce-ef73-4773-9346-ad3c0d4a207e", "eventTime": "2019-08-16T08:48:54Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {"items": [{"name": "owner-id", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ff30e997-fc1d-4523-bc51-754e9063c96a", "record_id": "flaws_cloudtrail:0000601:ff30e997-fc1d-4523-bc51-754e9063c96a", "row_index": 601, "timestamp": "2019-08-16T08:48:54Z", "event_type": "DescribeVpcs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 692, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ff30e997-fc1d-4523-bc51-754e9063c96a", "eventTime": "2019-08-16T08:48:54Z", "eventName": "DescribeVpcs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"vpcSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "965255-0178-4e5e-9018-63b10da0fae6", "record_id": "flaws_cloudtrail:0000602:965255-0178-4e5e-9018-63b10da0fae6", "row_index": 602, "timestamp": "2019-08-16T08:48:54Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 827, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "965255-0178-4e5e-9018-63b10da0fae6", "eventTime": "2019-08-16T08:48:54Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: iam:ListPolicies on resource: policy path /", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7a5d254e-6a5a-46c4-94ab-bfe6040b7e38", "record_id": "flaws_cloudtrail:0000603:7a5d254e-6a5a-46c4-94ab-bfe6040b7e38", "row_index": 603, "timestamp": "2019-08-16T08:48:55Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 813, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7a5d254e-6a5a-46c4-94ab-bfe6040b7e38", "eventTime": "2019-08-16T08:48:55Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {}, "filterSet": {"items": [{"name": "owner-id", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f41ff0ca-0367-4674-86b1-9a420749", "record_id": "flaws_cloudtrail:0000604:f41ff0ca-0367-4674-86b1-9a420749", "row_index": 604, "timestamp": "2019-08-16T08:48:55Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 694, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f41ff0ca-0367-4674-86b1-9a420749", "eventTime": "2019-08-16T08:48:55Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7a5d254e-6a5a-46c4-94ab-bfe6040b7e38", "record_id": "flaws_cloudtrail:0000605:7a5d254e-6a5a-46c4-94ab-bfe6040b7e38", "row_index": 605, "timestamp": "2019-08-16T08:48:55Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 813, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7a5d254e-6a5a-46c4-94ab-bfe6040b7e38", "eventTime": "2019-08-16T08:48:55Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {}, "filterSet": {"items": [{"name": "owner-id", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f41ff0ca-0367-4674-86b1-9a420749", "record_id": "flaws_cloudtrail:0000606:f41ff0ca-0367-4674-86b1-9a420749", "row_index": 606, "timestamp": "2019-08-16T08:48:55Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 694, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f41ff0ca-0367-4674-86b1-9a420749", "eventTime": "2019-08-16T08:48:55Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0a0c8c4f-cfb8-40d1-89c7-a344439", "record_id": "flaws_cloudtrail:0000607:0a0c8c4f-cfb8-40d1-89c7-a344439", "row_index": 607, "timestamp": "2019-08-16T08:48:56Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 698, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0a0c8c4f-cfb8-40d1-89c7-a344439", "eventTime": "2019-08-16T08:48:56Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1364e249-cfb8-471e-9521-760544f0d52", "record_id": "flaws_cloudtrail:0000608:1364e249-cfb8-471e-9521-760544f0d52", "row_index": 608, "timestamp": "2019-08-16T08:48:56Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 816, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1364e249-cfb8-471e-9521-760544f0d52", "eventTime": "2019-08-16T08:48:56Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {"items": [{"name": "owner-id", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a7f4f062-4198-4e69-b793-5fe5f066f5cf", "record_id": "flaws_cloudtrail:0000609:a7f4f062-4198-4e69-b793-5fe5f066f5cf", "row_index": 609, "timestamp": "2019-08-16T08:48:56Z", "event_type": "DescribeVpcs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 692, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a7f4f062-4198-4e69-b793-5fe5f066f5cf", "eventTime": "2019-08-16T08:48:56Z", "eventName": "DescribeVpcs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"vpcSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f1b595bc-6b26-4c41-a4eb-8aa3cc7ba700", "record_id": "flaws_cloudtrail:0000610:f1b595bc-6b26-4c41-a4eb-8aa3cc7ba700", "row_index": 610, "timestamp": "2019-08-16T08:48:56Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 814, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f1b595bc-6b26-4c41-a4eb-8aa3cc7ba700", "eventTime": "2019-08-16T08:48:56Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {"items": [{"name": "owner-id", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1afc7741-37d6-49d8-9b9e-99ad7cb11ae6", "record_id": "flaws_cloudtrail:0000611:1afc7741-37d6-49d8-9b9e-99ad7cb11ae6", "row_index": 611, "timestamp": "2019-08-16T08:48:56Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "129.5.8.15", "user_agent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 698, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1afc7741-37d6-49d8-9b9e-99ad7cb11ae6", "eventTime": "2019-08-16T08:48:56Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "129.5.8.15", "userAgent": "Boto3/1.9.209 Python/3.7.3 Linux/4.12.0-kali2-686 Botocore/1.12.209", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}