Task: attack_reconstruction (flaws_cloudtrail)
Prompt: An IAM actor appears to validate their access, survey IAM identities and credentials, and then establish a new credentialed identity with permissions. Identify the responsible principal, the applicable MITRE ATT&CK technique, the supporting CloudTrail record_ids for each phase of the chain, and the impacted AWS assets they touched or created. Return a JSON object matching the AttackReconstructionAnswer schema. Use principal.arn for primary_actor, the MITRE ATT&CK ID (e.g. T1530) for technique, and group the supporting CloudTrail record_ids by attack phase. List the AWS asset identifiers (bucket names, role/user names, trail names, ARNs) the attack acted on as impacted_assets.
Answer schema: attack_reconstruction_answer

CloudTrail records:
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d19433-87ab-41b6-b512-cbae77d8c814", "record_id": "flaws_cloudtrail:0000000:d19433-87ab-41b6-b512-cbae77d8c814", "row_index": 0, "timestamp": "2018-04-17T05:34:58Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 1269, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d19433-87ab-41b6-b512-cbae77d8c814", "eventTime": "2018-04-17T05:34:58Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-8c971d21", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e463abec-e82d-4d35-8097-69ce35db230b", "record_id": "flaws_cloudtrail:0000001:e463abec-e82d-4d35-8097-69ce35db230b", "row_index": 1, "timestamp": "2018-04-17T05:34:59Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 1928, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e463abec-e82d-4d35-8097-69ce35db230b", "eventTime": "2018-04-17T05:34:59Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: msaqiI0Ndfu-dojXmTfMbi0eN3W4MAA4mNG32mWDR12tVYbfAWvfVF0lbGzb2UiSSrL1dlgzQyhpvgKgkG7b1hQmiev0cakZzN79TVCJGI8vveD4p0G289UHxje6g7yJQVg3VcpSnwQVEFlnTowc1v1hxjhFUv5I1SUnX1QJ0pxUhO-csBrCH1aR2NQIAGwzuX4lgE8AXc48o9e18zREmLjXiDPP4ps3j6p-CZ5SvAvdip68xXirUk9vyAfudbvYG_-w4KZch51Sd1IozrFgAsAA-BICvBzcLGfNXTYmwmLH-1U7qujknuLlfEba9lc_9iNbFlVfyiJeOLDFU0-hRYKFNEOgX8z2Bxqmmidf7tRO7g_DD1n936496Fkbckcxa8ycp7CHwjf8fLmKgJVoY_16KK7fcyM5g75xTRDYuC5HRw20Zp7hJ5ZFoM_2nBnZmgQ-yCttI3GIoBZ0XOKDrMlT2PaQ9XL7PJu5Z1wYnmjtqfQe2BpfU_GEV2QmwY7yDrlFgBMnbpyfRLxgJLQvsF6qOhNqm0aPe-CULSSWTeSut5tM8TU2hWRt2Msk5osKB_NzgqMCpdfGe6RwuszVeURr9XMhjDOPKxx067WKbbcRwSH0x7EGqzMDAcpBGA6tV9-wyKpOhX-NijAhR4CBWZT-JJYG_72XvT8", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-8c971d21", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "59ea7a7a-f842-43f2-95c1-60e0d2450d4b", "record_id": "flaws_cloudtrail:0000002:59ea7a7a-f842-43f2-95c1-60e0d2450d4b", "row_index": 2, "timestamp": "2018-04-17T05:35:00Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 775, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "59ea7a7a-f842-43f2-95c1-60e0d2450d4b", "eventTime": "2018-04-17T05:35:00Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ac5f47f8-9d6d-487b-97c0-c06082e190", "record_id": "flaws_cloudtrail:0000003:ac5f47f8-9d6d-487b-97c0-c06082e190", "row_index": 3, "timestamp": "2018-04-17T05:46:37Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "config.amazonaws.com", "user_agent": "config.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/service-role/config-role-us-west-2"], "raw_record_size_bytes": 1934, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ac5f47f8-9d6d-487b-97c0-c06082e190", "eventTime": "2018-04-17T05:46:37Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "config.amazonaws.com", "userAgent": "config.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "config.amazonaws.com"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/service-role/config-role-us-west-2", "roleSessionName": "AWSConfig"}, "responseElements": {"credentials": {"accessKeyId": "ASIA7FHMZK1W416YGLAA", "expiration": "Apr 17, 2018 6:46:37 AM", "sessionToken": "AgoGb3JpZ2luEGoaCXVzLXdlc3QtMiKAAgik2reOpYviCEbzfdB4JWlNNVvFWZjDXxNPnGt+wlFwlrtP0Wq7OmpX//djYJ4TwgGVafQLqClE6vYuFX6996BXFL6Wus+i6AWBMWJI2aOjhTIPZWpgpQ44JyD37ECEE6NHB/vlXoJP93MhJTYkoFqVR4tM+4lUeWw+Qnvkqz1ZB4mOa6H3xEAgT3KLvOo5ZFQPuFYYDli/ZLfCc9+JB0FbNgHSt9wbn2abkbGKMtz/NPajluEo7awuabbvwieK9NBCGVbZEaplDusywDMHfm5NLqqbddYobJwo6Sv6m6Yi0hS1MholGxzjhGSBTJ1jRvARhPEf9AAm1fKmwKF8cYwq8QIIn///////////ARAAGgw5NzU0MjYyNjIwMjkiDPOEQyTMLpoot0Jd3CrFAhowXm45R3Zbn0cc5I9Kcna2B/h/WgLx0mocsUX/TY6wIJ1M1ejPDU58lCGBs+I5vkMi59AXHKTwQyuadPyPr420b9bCeEfV+JTGh8iJJADPXxYTp/gemEY4cFFdWe//tyfzbYBaR+n72hKiLHlRK5yVB77Hj0ylc5iLwjZ3ev93988wGZtdVfIZ+vhwzVorYBsIEmQ1GAguZZnKr/L1GANBEAKpPhR9o+zTPwNCcDLWSM0mOh5KIj+TXqiu/CJbZ+HDtewZXNhr1MHgyw3esIAux6/lbJH+7mS8AgPQXPsBl89vXoYxgRuTxexqFtweSlNe9mc6hlmW7+Ka1MINvaM8wLn4ranvA0p1TwlOWmdF1Bpqc9FWPVC5KbNG4EDM2/EjHbY4kiMcJqnql0V7PC+GTx4jNPGn3V5qifkYhnMD3aE1v6UwvZTW1gU="}, "assumedRoleUser": {"assumedRoleId": "AROASM3HWKK95VDO4HH81:AWSConfig", "arn": "arn:aws:sts::811596193553:assumed-role/config-role-us-west-2/AWSConfig"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/service-role/config-role-us-west-2", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "957df79f-191c-4b9f-99fc-9a9c52b449f1", "record_id": "flaws_cloudtrail:0000004:957df79f-191c-4b9f-99fc-9a9c52b449f1", "row_index": 4, "timestamp": "2018-04-17T05:49:07Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1491, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "957df79f-191c-4b9f-99fc-9a9c52b449f1", "eventTime": "2018-04-17T05:49:07Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIAU7TC039BV94LU1KW", "expiration": "Apr 17, 2018 12:10:03 PM", "sessionToken": "FQoDYXdzEJ///////////wEaDIUKxA/hiBYVnUL1ZiK3A1porn7Uj8/knA9CC2d0gLrRprhLaQqNoXgBg1sUfyWY4RySe1o03pFEO+f32NrUdMmAsICKihC1ip/8j7CBtYW0dvK/nuConf7AaVPxsPCiBoqEzv5WuQBiK6UHXttSeWFi+JSbZz9t+YMK6GqEy5zxeaiRC6ko8yxiVMcoe7bVu80msOpqCWHys8AtUdzV8DHI3tw5707E7D5KPLacFSHA8HTA0+tUmKYTa9AdLrgb2nLBois4LLNvDVIctbMajLcH0egvMwhVMy2TNZGy3VR8q8uzX4l7Lepe2zqb12KqVJ9qiYk26ujlILmffm4G8LItD9HpfJPrDxP7HB5Hd0LraxfuViCuDt/e9P4rtbe/n7KV46VecfYHXWXhZG7H0Jxhoa8aml6YmGnyhyWOwew6y2XmAH+k80eV02PnEIvsrwnSXaKIDFznm9GNZEmImHansH26l9rwVfakkx+WaCK+XYZOH2aZzeyi+hGLKkYdbqNJGft6QKD6/Zxr8YtAJouBGoS6WscWk5lGTn/9HoFruDm6UjcEAFE5Ky0injslEQ2T/kcIq8KkvcLi6qDvjr4VN4iWIUoo05XW1gU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c8fba71c-cb2f-4c9d-9952-0b8c967d81d4", "record_id": "flaws_cloudtrail:0000005:c8fba71c-cb2f-4c9d-9952-0b8c967d81d4", "row_index": 5, "timestamp": "2018-04-17T06:15:51Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 874, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c8fba71c-cb2f-4c9d-9952-0b8c967d81d4", "eventTime": "2018-04-17T06:15:51Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b430e625-e9a2-4de1-91b8-3bee0bfe0654", "record_id": "flaws_cloudtrail:0000006:b430e625-e9a2-4de1-91b8-3bee0bfe0654", "row_index": 6, "timestamp": "2018-04-17T06:15:55Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b430e625-e9a2-4de1-91b8-3bee0bfe0654", "eventTime": "2018-04-17T06:15:55Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "870d6091-fdea-46e1-82b3-59807d3b64d", "record_id": "flaws_cloudtrail:0000007:870d6091-fdea-46e1-82b3-59807d3b64d", "row_index": 7, "timestamp": "2018-04-17T06:15:56Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 912, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "870d6091-fdea-46e1-82b3-59807d3b64d", "eventTime": "2018-04-17T06:15:56Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "16ffbc28-7581-4037-8411-bcf80bb2cfc2", "record_id": "flaws_cloudtrail:0000008:16ffbc28-7581-4037-8411-bcf80bb2cfc2", "row_index": 8, "timestamp": "2018-04-17T06:15:57Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 913, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "16ffbc28-7581-4037-8411-bcf80bb2cfc2", "eventTime": "2018-04-17T06:15:57Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4a460905-884f-4c08-b774-1d16f2f344c5", "record_id": "flaws_cloudtrail:0000009:4a460905-884f-4c08-b774-1d16f2f344c5", "row_index": 9, "timestamp": "2018-04-17T06:15:57Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 908, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4a460905-884f-4c08-b774-1d16f2f344c5", "eventTime": "2018-04-17T06:15:57Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "99b697a6-6507-4d43-9a52-13865bd2bf37", "record_id": "flaws_cloudtrail:0000010:99b697a6-6507-4d43-9a52-13865bd2bf37", "row_index": 10, "timestamp": "2018-04-17T06:15:57Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 908, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "99b697a6-6507-4d43-9a52-13865bd2bf37", "eventTime": "2018-04-17T06:15:57Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3bb9024b-612a-4ab2-8cb4-419045ef", "record_id": "flaws_cloudtrail:0000011:3bb9024b-612a-4ab2-8cb4-419045ef", "row_index": 11, "timestamp": "2018-04-17T06:15:59Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 904, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3bb9024b-612a-4ab2-8cb4-419045ef", "eventTime": "2018-04-17T06:15:59Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "73e7ae3e-cdd4-4050-9ea1-d736c3de453a", "record_id": "flaws_cloudtrail:0000012:73e7ae3e-cdd4-4050-9ea1-d736c3de453a", "row_index": 12, "timestamp": "2018-04-17T06:16:01Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "73e7ae3e-cdd4-4050-9ea1-d736c3de453a", "eventTime": "2018-04-17T06:16:01Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a32f2b24-4e65-4cae-8f71-88100c88b953", "record_id": "flaws_cloudtrail:0000013:a32f2b24-4e65-4cae-8f71-88100c88b953", "row_index": 13, "timestamp": "2018-04-17T06:16:01Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a32f2b24-4e65-4cae-8f71-88100c88b953", "eventTime": "2018-04-17T06:16:01Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fc08f91a-0d99-4b96-8a03-adf4a2d4b548", "record_id": "flaws_cloudtrail:0000014:fc08f91a-0d99-4b96-8a03-adf4a2d4b548", "row_index": 14, "timestamp": "2018-04-17T06:16:02Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fc08f91a-0d99-4b96-8a03-adf4a2d4b548", "eventTime": "2018-04-17T06:16:02Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "26125-3025-408d-aaad-727a83ebc2e0", "record_id": "flaws_cloudtrail:0000015:26125-3025-408d-aaad-727a83ebc2e0", "row_index": 15, "timestamp": "2018-04-17T06:16:02Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 805, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "26125-3025-408d-aaad-727a83ebc2e0", "eventTime": "2018-04-17T06:16:02Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0a97129-1372-427e-a3fe-6b02a5199955", "record_id": "flaws_cloudtrail:0000016:0a97129-1372-427e-a3fe-6b02a5199955", "row_index": 16, "timestamp": "2018-04-17T06:16:02Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 802, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0a97129-1372-427e-a3fe-6b02a5199955", "eventTime": "2018-04-17T06:16:02Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2c535b06-06f3-455e-9878-d7119e6467ad", "record_id": "flaws_cloudtrail:0000017:2c535b06-06f3-455e-9878-d7119e6467ad", "row_index": 17, "timestamp": "2018-04-17T06:16:02Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 802, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2c535b06-06f3-455e-9878-d7119e6467ad", "eventTime": "2018-04-17T06:16:02Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a54782-ad3e-4367-ac4e-147a214b1143", "record_id": "flaws_cloudtrail:0000018:a54782-ad3e-4367-ac4e-147a214b1143", "row_index": 18, "timestamp": "2018-04-17T06:16:03Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 806, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a54782-ad3e-4367-ac4e-147a214b1143", "eventTime": "2018-04-17T06:16:03Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7ab465c6-da93-415c-8150-bb177b03e2a0", "record_id": "flaws_cloudtrail:0000019:7ab465c6-da93-415c-8150-bb177b03e2a0", "row_index": 19, "timestamp": "2018-04-17T06:16:04Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1381, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7ab465c6-da93-415c-8150-bb177b03e2a0", "eventTime": "2018-04-17T06:16:04Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-14f2b3cc", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "080ac7c0-04e5-4b1e-aab4-9afab9a1b004", "record_id": "flaws_cloudtrail:0000020:080ac7c0-04e5-4b1e-aab4-9afab9a1b004", "row_index": 20, "timestamp": "2018-04-17T06:16:04Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 804, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "080ac7c0-04e5-4b1e-aab4-9afab9a1b004", "eventTime": "2018-04-17T06:16:04Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "31560d-79db-4aa8-947e-94a1d54e5a95", "record_id": "flaws_cloudtrail:0000021:31560d-79db-4aa8-947e-94a1d54e5a95", "row_index": 21, "timestamp": "2018-04-17T06:16:04Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 801, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "31560d-79db-4aa8-947e-94a1d54e5a95", "eventTime": "2018-04-17T06:16:04Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7ad2efe3-184f-4ff5-98b8-de418590caf32", "record_id": "flaws_cloudtrail:0000022:7ad2efe3-184f-4ff5-98b8-de418590caf32", "row_index": 22, "timestamp": "2018-04-17T06:16:05Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1382, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7ad2efe3-184f-4ff5-98b8-de418590caf32", "eventTime": "2018-04-17T06:16:05Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-14f2b3cc", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "517532d-4dc8-4c8b-bdfa-8fedcf04d746", "record_id": "flaws_cloudtrail:0000023:517532d-4dc8-4c8b-bdfa-8fedcf04d746", "row_index": 23, "timestamp": "2018-04-17T06:16:06Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 807, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "517532d-4dc8-4c8b-bdfa-8fedcf04d746", "eventTime": "2018-04-17T06:16:06Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8a57527d-e73a-4180-8aa3-efd5ee69d365", "record_id": "flaws_cloudtrail:0000024:8a57527d-e73a-4180-8aa3-efd5ee69d365", "row_index": 24, "timestamp": "2018-04-17T06:16:06Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1275, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8a57527d-e73a-4180-8aa3-efd5ee69d365", "eventTime": "2018-04-17T06:16:06Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-14f2b3cc", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e38e0de1-e02e-4b51-8ced-f8e2f43a258f", "record_id": "flaws_cloudtrail:0000025:e38e0de1-e02e-4b51-8ced-f8e2f43a258f", "row_index": 25, "timestamp": "2018-04-17T06:16:06Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e38e0de1-e02e-4b51-8ced-f8e2f43a258f", "eventTime": "2018-04-17T06:16:06Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0362b502-ce8f-4c4c-84dd-3d103c7ede9c", "record_id": "flaws_cloudtrail:0000026:0362b502-ce8f-4c4c-84dd-3d103c7ede9c", "row_index": 26, "timestamp": "2018-04-17T06:16:06Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0362b502-ce8f-4c4c-84dd-3d103c7ede9c", "eventTime": "2018-04-17T06:16:06Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "aeae2d8d-5b69-4386-ab33-ad9dc37d8461", "record_id": "flaws_cloudtrail:0000027:aeae2d8d-5b69-4386-ab33-ad9dc37d8461", "row_index": 27, "timestamp": "2018-04-17T06:16:06Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "aeae2d8d-5b69-4386-ab33-ad9dc37d8461", "eventTime": "2018-04-17T06:16:06Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "934a9253-5642-4548-ba54-8776eff29a91", "record_id": "flaws_cloudtrail:0000028:934a9253-5642-4548-ba54-8776eff29a91", "row_index": 28, "timestamp": "2018-04-17T06:16:07Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1937, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "934a9253-5642-4548-ba54-8776eff29a91", "eventTime": "2018-04-17T06:16:07Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: cQR0Vk6wdFZiFsWIxVqP_0UCEdlYjkICjWV8IN0J0Ntsp4RQrIR9wiW3E8rcUxLsQGsoM_n7Ccuegwytvb_r_J2z9hIAq1LPlKA1hAjOd1f8hHsEXpGGtZa7jkKtgVJn-B1ro2x6UxNgwnHpa_wpnd-Y62aEziNISfqfQYZJ0vz1JXlsD4cq2IQJSxJE7L8guky57NDs8HBBtw8lPwRAo-xDAKHoMnmFaOUFqrNVv_tiNPMPkZVGoU9X1cta-BHJwz82IPUiTh1235TtZeLDcA0TpIBHpTEI2O5mVIloKYHdp4ucqHzfiSEVL1iHAKS3ANRXpK7E1sgqs3ZckAevrim5xTwIDYRkxwQCL34zrU7CnqOSeoe48PpaG3xjRhaPbE9RiJtVqIghFDiKjPOPB_YBINLBXSDEBfzoF3-pTUf8ckya_8VugSP9Oja_S_pxEiUUR7KwbfFagbzVi1f1zbdRRLXa0UIQULGudU2gQ8vH9FZCCSkD7NOvnyzgV5-sZhm0Gm-GEODX7KAJgSjrUchfxHom9LwOljexlIhFV1UTcXYJXDybNMceiWdWQl6gwRfYVV7i-QSwyRIPn8--9gzzswxgZ73C2F2jUOYCXUmMgJglwJ-Iw-ZZHv_ZdmxbavxJsSQiJYSjlLegW1K38PesSaNFsJT2LKlSi_7k", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-14f2b3cc", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "83e735c5-57fd-4c5b-88c4-9bd0567f9416", "record_id": "flaws_cloudtrail:0000029:83e735c5-57fd-4c5b-88c4-9bd0567f9416", "row_index": 29, "timestamp": "2018-04-17T06:16:08Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 913, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "83e735c5-57fd-4c5b-88c4-9bd0567f9416", "eventTime": "2018-04-17T06:16:08Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2dd133ce-b409-4733-a323-3f3a75136", "record_id": "flaws_cloudtrail:0000030:2dd133ce-b409-4733-a323-3f3a75136", "row_index": 30, "timestamp": "2018-04-17T06:16:09Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1374, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2dd133ce-b409-4733-a323-3f3a75136", "eventTime": "2018-04-17T06:16:09Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-dc82b8b9", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1bdc494c-38b9-4f12-9858-5d218cb53b9b", "record_id": "flaws_cloudtrail:0000031:1bdc494c-38b9-4f12-9858-5d218cb53b9b", "row_index": 31, "timestamp": "2018-04-17T06:16:09Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1bdc494c-38b9-4f12-9858-5d218cb53b9b", "eventTime": "2018-04-17T06:16:09Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9e94b990-dc6e-466d-ac2a-e7620fbe2cbf", "record_id": "flaws_cloudtrail:0000032:9e94b990-dc6e-466d-ac2a-e7620fbe2cbf", "row_index": 32, "timestamp": "2018-04-17T06:16:10Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1380, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9e94b990-dc6e-466d-ac2a-e7620fbe2cbf", "eventTime": "2018-04-17T06:16:10Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ca57294", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0982a90e-8b9b-43f7-8ff0-dcd7dca75c36", "record_id": "flaws_cloudtrail:0000033:0982a90e-8b9b-43f7-8ff0-dcd7dca75c36", "row_index": 33, "timestamp": "2018-04-17T06:16:10Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1269, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0982a90e-8b9b-43f7-8ff0-dcd7dca75c36", "eventTime": "2018-04-17T06:16:10Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-f5710223", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6109e875-b9dd-4dae-b34f-bb7ceb751c4d", "record_id": "flaws_cloudtrail:0000034:6109e875-b9dd-4dae-b34f-bb7ceb751c4d", "row_index": 34, "timestamp": "2018-04-17T06:16:11Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 804, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6109e875-b9dd-4dae-b34f-bb7ceb751c4d", "eventTime": "2018-04-17T06:16:11Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0a8959bf-f677-4940-9865-d5207ca8d243", "record_id": "flaws_cloudtrail:0000035:0a8959bf-f677-4940-9865-d5207ca8d243", "row_index": 35, "timestamp": "2018-04-17T06:16:12Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1381, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0a8959bf-f677-4940-9865-d5207ca8d243", "eventTime": "2018-04-17T06:16:12Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ca57294", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7d708f82-0672-49f2-9508-40411db5ca34", "record_id": "flaws_cloudtrail:0000036:7d708f82-0672-49f2-9508-40411db5ca34", "row_index": 36, "timestamp": "2018-04-17T06:16:12Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7d708f82-0672-49f2-9508-40411db5ca34", "eventTime": "2018-04-17T06:16:12Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "995d1f52-d7a9-4494-965b-dd9609839d42", "record_id": "flaws_cloudtrail:0000037:995d1f52-d7a9-4494-965b-dd9609839d42", "row_index": 37, "timestamp": "2018-04-17T06:16:12Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1376, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "995d1f52-d7a9-4494-965b-dd9609839d42", "eventTime": "2018-04-17T06:16:12Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-dc82b8b9", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7d67dab9-c16e-4d13-8c65-f9b4bb6b8f17", "record_id": "flaws_cloudtrail:0000038:7d67dab9-c16e-4d13-8c65-f9b4bb6b8f17", "row_index": 38, "timestamp": "2018-04-17T06:16:12Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1376, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7d67dab9-c16e-4d13-8c65-f9b4bb6b8f17", "eventTime": "2018-04-17T06:16:12Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-f5710223", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c9688e5d-7ed6-4f7a-afe8-be02b63ecb52", "record_id": "flaws_cloudtrail:0000039:c9688e5d-7ed6-4f7a-afe8-be02b63ecb52", "row_index": 39, "timestamp": "2018-04-17T06:16:13Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1378, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c9688e5d-7ed6-4f7a-afe8-be02b63ecb52", "eventTime": "2018-04-17T06:16:13Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ca57294", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "31a9f461-85a6-4b86-8a22-e8a664fee9e5", "record_id": "flaws_cloudtrail:0000040:31a9f461-85a6-4b86-8a22-e8a664fee9e5", "row_index": 40, "timestamp": "2018-04-17T06:16:13Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "31a9f461-85a6-4b86-8a22-e8a664fee9e5", "eventTime": "2018-04-17T06:16:13Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "54a12796-e645-4ab3-a17e-00b10d453c2d", "record_id": "flaws_cloudtrail:0000041:54a12796-e645-4ab3-a17e-00b10d453c2d", "row_index": 41, "timestamp": "2018-04-17T06:16:13Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1376, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "54a12796-e645-4ab3-a17e-00b10d453c2d", "eventTime": "2018-04-17T06:16:13Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ef6f0d3", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "300da236-092a-4394-bafe-83142d713b11", "record_id": "flaws_cloudtrail:0000042:300da236-092a-4394-bafe-83142d713b11", "row_index": 42, "timestamp": "2018-04-17T06:16:14Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1271, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "300da236-092a-4394-bafe-83142d713b11", "eventTime": "2018-04-17T06:16:14Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-dc82b8b9", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2b684b3c-27fc-4063-831e-d111295a8a59", "record_id": "flaws_cloudtrail:0000043:2b684b3c-27fc-4063-831e-d111295a8a59", "row_index": 43, "timestamp": "2018-04-17T06:16:14Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1271, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2b684b3c-27fc-4063-831e-d111295a8a59", "eventTime": "2018-04-17T06:16:14Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-f5710223", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "72ebcff6-bba3-49a0-a952-964aac6675aa", "record_id": "flaws_cloudtrail:0000044:72ebcff6-bba3-49a0-a952-964aac6675aa", "row_index": 44, "timestamp": "2018-04-17T06:16:16Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1937, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "72ebcff6-bba3-49a0-a952-964aac6675aa", "eventTime": "2018-04-17T06:16:16Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: 9BiVm4JI_oYKkQE9dloFEMAK3Lt-TBjCZJm5e0_aj-YlItlfc6iQUQWAlHHcgpiyiRegxUffCzfhiY03w-xt-W-pRbZDT7OKmhQn1NVsz9CloZbCF6nWcyWz8DTavSNFo_J7ANAYssXbFQoxMd10vzIqAxh3JfQIoXVGPoNaBpKKfrSk6zip0fRIG70PZ11WOlqtpt1B7svAqc1FTMYafqlcYzbQtJ8JH5Um-73GHyoyI7_RlXkwsd-aBZPNRSaipK_LvNit2shZvFFP8h3DahohEHSqAtgcsUF9CKS3u6n9d8PXgnaBGwDvAcIl2yZmyMJt_MibbWkuCk0Q1ZVjHzA7mFpWiMF0JO5Avq7_gYYbesYM1JYfLH5S6n7e-KG6yGLztiMprmkUT0YtoBvrj-pugWi48BtV_gYF1kpmN2uFwtRQvl3yXugQeGQ4vseWQ64fJnVTc1e4NnR9rMvELAimY00DR_gsMGQrdNTtPVznb-KsP2yvaeHTh27zSF4FDMRLmnkyFlWCjJeCF8j8a5ADkGFSpqeE-JLN712ZMIB-S_AIzk458HIbQSIWTg5XI2Zl54FskDPqdxADNczvgTapqOpOgK7jin3jeeQfI9A4fdObHp4WIknbrj_kyGP35tbBx60zJyCRMjEsrgA5z0bDcTbUYc6us9ICZKyH", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ca57294", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "484125-f8a0-4aec-8850-e121f774eba6", "record_id": "flaws_cloudtrail:0000045:484125-f8a0-4aec-8850-e121f774eba6", "row_index": 45, "timestamp": "2018-04-17T06:16:16Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 806, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "484125-f8a0-4aec-8850-e121f774eba6", "eventTime": "2018-04-17T06:16:16Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b411dd2b-973a-4b30-b33e-946f365ac544", "record_id": "flaws_cloudtrail:0000046:b411dd2b-973a-4b30-b33e-946f365ac544", "row_index": 46, "timestamp": "2018-04-17T06:16:17Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1382, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b411dd2b-973a-4b30-b33e-946f365ac544", "eventTime": "2018-04-17T06:16:17Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-546ae567", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dfd8b603-0d41-4168-8041-69d3f34c0fb0", "record_id": "flaws_cloudtrail:0000047:dfd8b603-0d41-4168-8041-69d3f34c0fb0", "row_index": 47, "timestamp": "2018-04-17T06:16:17Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 911, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dfd8b603-0d41-4168-8041-69d3f34c0fb0", "eventTime": "2018-04-17T06:16:17Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "83b162d8-6039-4431-9402-57942abbdc", "record_id": "flaws_cloudtrail:0000048:83b162d8-6039-4431-9402-57942abbdc", "row_index": 48, "timestamp": "2018-04-17T06:16:18Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1374, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "83b162d8-6039-4431-9402-57942abbdc", "eventTime": "2018-04-17T06:16:18Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ef6f0d3", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "53762c59-1898-4774-8023-8db8827eb55c", "record_id": "flaws_cloudtrail:0000049:53762c59-1898-4774-8023-8db8827eb55c", "row_index": 49, "timestamp": "2018-04-17T06:16:19Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1381, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "53762c59-1898-4774-8023-8db8827eb55c", "eventTime": "2018-04-17T06:16:19Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-546ae567", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4149bfe8-f4c8-49a5-9173-657f1d101c99", "record_id": "flaws_cloudtrail:0000050:4149bfe8-f4c8-49a5-9173-657f1d101c99", "row_index": 50, "timestamp": "2018-04-17T06:16:20Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1275, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4149bfe8-f4c8-49a5-9173-657f1d101c99", "eventTime": "2018-04-17T06:16:20Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-546ae567", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a94f2538-151d-4829-abc4-600cdbe39fa4", "record_id": "flaws_cloudtrail:0000051:a94f2538-151d-4829-abc4-600cdbe39fa4", "row_index": 51, "timestamp": "2018-04-17T06:16:20Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1378, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a94f2538-151d-4829-abc4-600cdbe39fa4", "eventTime": "2018-04-17T06:16:20Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ef6f0d3", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "413d33e3-8950-40b6-89b8-468519a849c35", "record_id": "flaws_cloudtrail:0000052:413d33e3-8950-40b6-89b8-468519a849c35", "row_index": 52, "timestamp": "2018-04-17T06:16:20Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1924, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "413d33e3-8950-40b6-89b8-468519a849c35", "eventTime": "2018-04-17T06:16:20Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: aiAjswHxWpGA1Wyj4SRkOBgFXT-a9hlpMlZA_5tU5ajHE5nKpgzDTmaeEmodumi4DL4wcWjvRb35mj_JMyVV-yjBor0WwTKNg0gByihiWIeP0v5oEQG4rq6xVsljB_ysk2QSSBCYO2Rs_VaNjuiHtrCthPiiGcv43Pu367i70Bt0U95I1H2KQUPMNS8lotUEltybKV0hP7MwuI2qAx0iH1UR4HqMq5LgZot4129N9DL7pPF9iyhuaUKfhZ1O_2pbGwKnDIc-Y7JHry1O3niJLZnvmD9W9jUpMRL6Rv5fFg8SiGbQzFRFfeUBvfMYJUvUTwx6e9ODVFO-kN6J4gAMRnC1AMIql1j-6qnVVNVFY7g6hqGCB7_cEIS93KjuAduNkTrorNkSgbbnpOnGqff9euR9jEp5B2IUMiAHWTx7gT2b27KGziJ_gidxqH0ElF67onos3VTcq1PWHuNaqjXc3KrogSUhx2HGsIdBE_1AyJM46mJopkO9vLJ4vS__8LSXlSTNGSfLPSmR1cSe-tFPAf_nMxpBctvNML1ddpj3NM6psJMhcYbz5m9GAnlb7FA-dyAEGnAfebcHf60kh8Y1suEG8lPmSuIPnzdK0FTHyTX00PWH4TDzyPQ-yi3RCoFIXRNASbfZjk3N7GCxEF-YLtyTQNGSP5vG9w", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-f5710223", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "19133e-33ed-4c3e-960a-267d97e10720", "record_id": "flaws_cloudtrail:0000053:19133e-33ed-4c3e-960a-267d97e10720", "row_index": 53, "timestamp": "2018-04-17T06:16:21Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1934, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "19133e-33ed-4c3e-960a-267d97e10720", "eventTime": "2018-04-17T06:16:21Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: mUtq1r9R6PSejnCdYggFVKYqJplaflSZhy8qEMeTGj2CRlQtnmeKtXzk3kDScY0aJH_V32zvYAUQlyM1JodhErLrEP1Z5GS88RXgKUCn5OG5xIqaxHMZscxSpaKl6Q-WJXxyhUvzaMwroft542oNEM6BmV1P29jT5LKPTUnoE2zhcntagOrfZXtsNwdaYdTgKaRXnswZS93bvVRmyajdFcfsDepRLbnY8_1osKeUwXAIuGjDKq-NBt2WNuToaQMctT7FWedICnFUlZ7cJ3nemKbm08aaPw3EHd-2D26T4Bd0xaz3CKSoJOv6ofqNFEwNfc2bdgqqR_vhP6uacqgOwMris47ODVBtclOYcz10nl6G4w_arbsLmvH_UjYar6nS6biphtumAenBidgb0DeREl2lZ1SLx_3-5Au-zuJesnUKPDzLGyIXO-rapwE4m509Hp4MizZ6k4YzQ162Iqp8GfTlwTZ8COzPF44xJ6BsTDHvKRywAFVfrAMevUrQydHzc6UQGwand-J6L0inK7BMFrl_KpzTIaIyqhs-G0NgEj5KXWikYXoFUkUktzUY3c1IY7j3oGweSAQjZZ53WeACjQOSDx92pWc3G7tG_aH_TrOB5wS3E77qbeoXzTVn02ScbMHATfl47CyMQF4V6Bn9rBizHjXkwWpoCxsU5iU", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-546ae567", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "244c2227-f0ab-4a84-a80e-09d31d1f2862", "record_id": "flaws_cloudtrail:0000054:244c2227-f0ab-4a84-a80e-09d31d1f2862", "row_index": 54, "timestamp": "2018-04-17T06:16:21Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 806, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "244c2227-f0ab-4a84-a80e-09d31d1f2862", "eventTime": "2018-04-17T06:16:21Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b048740b9-be4a-41bf-b64e-4a8d063e5481", "record_id": "flaws_cloudtrail:0000055:b048740b9-be4a-41bf-b64e-4a8d063e5481", "row_index": 55, "timestamp": "2018-04-17T06:16:22Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 914, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b048740b9-be4a-41bf-b64e-4a8d063e5481", "eventTime": "2018-04-17T06:16:22Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7fdc6a96-136f-41c8-894d-150e075d0f8b", "record_id": "flaws_cloudtrail:0000056:7fdc6a96-136f-41c8-894d-150e075d0f8b", "row_index": 56, "timestamp": "2018-04-17T06:16:22Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 806, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7fdc6a96-136f-41c8-894d-150e075d0f8b", "eventTime": "2018-04-17T06:16:22Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bae195541-a6ee-4506-8d79-d7e625ec6913", "record_id": "flaws_cloudtrail:0000057:bae195541-a6ee-4506-8d79-d7e625ec6913", "row_index": 57, "timestamp": "2018-04-17T06:16:22Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bae195541-a6ee-4506-8d79-d7e625ec6913", "eventTime": "2018-04-17T06:16:22Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7f619fe4-fc3d-4232-b40a-f5286c02d37b", "record_id": "flaws_cloudtrail:0000058:7f619fe4-fc3d-4232-b40a-f5286c02d37b", "row_index": 58, "timestamp": "2018-04-17T06:16:23Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 806, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7f619fe4-fc3d-4232-b40a-f5286c02d37b", "eventTime": "2018-04-17T06:16:23Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "658e3022-9184-4b19-a9b6-419173b6595f8", "record_id": "flaws_cloudtrail:0000059:658e3022-9184-4b19-a9b6-419173b6595f8", "row_index": 59, "timestamp": "2018-04-17T06:16:24Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1380, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "658e3022-9184-4b19-a9b6-419173b6595f8", "eventTime": "2018-04-17T06:16:24Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-bbcb674a", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2fb02266-504f-4ac2-aeb4-d25b7e28bc82", "record_id": "flaws_cloudtrail:0000060:2fb02266-504f-4ac2-aeb4-d25b7e28bc82", "row_index": 60, "timestamp": "2018-04-17T06:16:24Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1926, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2fb02266-504f-4ac2-aeb4-d25b7e28bc82", "eventTime": "2018-04-17T06:16:24Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: 48JHOq0xqsbS0ZjY47fsT2q7MX2-D-dNK_0VTDNov-tfjFNCqWOU_NeO9wh7e6T5H8zFnRObR3eL2pTnhPZGkFsWLdlwni81erVdUVzZfv0zPP1gw_xwEdcv0QjDogpErmibELroPINFNE_fpTIktashTqVIhcONkxErfTKurin9hFZDViTyNuRpAuTy0FyML5lJpL_FDmz1AI7Ys2NmKXFkPuMZUGbhRzXeNFbn3ST_hCefiakGhiQ-_grJreWgpWxHHoWvoFGQJrtnRCAxVCeRyP5u5W9K5vFUFqZ5PNcKNfNEGeeniocsOpy8hDgyxFeuwCXqq1LzLti4i9iW9jV6mV8xe0xQsNWtABfYpWdi7vYZLot6Q-Y6Vrb-d9TaKSdNUjeCh14VZOD6q0w8pX8RkImDA2E2BHj8AKi5FsnAvcbkCwEDjatUnTsiY-UQzhIpQu9S9EPTR8gPAnIN43LoTR6FFsZY-AEySmUo7Wo_MyXdSH24F7bGvPz3BEbdnFGoIiM4n6lXienk6zve2QxmeAiRu7gG1k9VpOSPNFbUrlN4sjAhPeCPaWW6-CN-3cqmgK-QIgmsn_C8bt_wTRXiW6nlj0gZ4z-xGb4WuGZrMNX96f1zUTd1y2CnY22IhhcIi8o9TUCCGmbh6qxm7FfP3lEZrmW95g", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-dc82b8b9", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7ba61e4e-5103-4857-a49a-71b82c0f85e0", "record_id": "flaws_cloudtrail:0000061:7ba61e4e-5103-4857-a49a-71b82c0f85e0", "row_index": 61, "timestamp": "2018-04-17T06:16:24Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1926, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7ba61e4e-5103-4857-a49a-71b82c0f85e0", "eventTime": "2018-04-17T06:16:24Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: YuMTYJnbBj9Ttrgj3fJ-JmjfFSot4-TlgN5NhR12oDWfXkk7fPfQCYItAJJJH1hnZ_vFpngodICJHJd3ggW9iTGJkaaWO-Z_PPXM_QeT4eDynxWAawLWXpDRm4C-VewtyS2TZMYOB8ezMCY6UfvEp9EVlkPtXFiZP6a7gg8fl09A_woy3-75NVzOAnj8voWtO5BFZTdZbjOOoVXsTql1TZmQKainewyANnh7mHyou8eG1Q-t1PuBDe6BEeVaGpaVUP6UfE_nxXD29Zo7nos2-8_XXCiSvvxmP4UyXfDYMaJluV8sFADpe0jMpskVe2c_YBWQQFZsV2tb7T5iL6koXL0EpLid_XdiEFt1JTW-gfPfWvBSZ10vISFZhY1yN9vKncqVM_8R0rrKYFz2zkOTPRE2H2lq-uPWKIoBskdQd14yzvkq8lFpQj61D-5qRKtfhDkTRspm5n5vSFtbIJ5zFrSZ7AC7NjIzG3P6KXRfNNxjpw8GTMLqj7VPIfhm7_4gUXGsfJ2NL71ycT_HoW6y4kNl27Xnh7-c9mokxJpcFxfBtDSzvB-KAtFxt9MArOiq-yipVeXbKgoFaNTR2CmVPBiEpgbII73vXZqh2hBnxBY5jp7jQ5XlD9iPZCyF4s27Ds4SAqE-KliZZ-kX5KntwT4B8MUPNSFETA", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ef6f0d3", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6a8ca6f9-d4d8-494c-ae42-cb85b24baced", "record_id": "flaws_cloudtrail:0000062:6a8ca6f9-d4d8-494c-ae42-cb85b24baced", "row_index": 62, "timestamp": "2018-04-17T06:16:25Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1377, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6a8ca6f9-d4d8-494c-ae42-cb85b24baced", "eventTime": "2018-04-17T06:16:25Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-bbcb674a", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f24428-adce-43f6-b45d-30fc79ffab85", "record_id": "flaws_cloudtrail:0000063:f24428-adce-43f6-b45d-30fc79ffab85", "row_index": 63, "timestamp": "2018-04-17T06:16:25Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 906, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f24428-adce-43f6-b45d-30fc79ffab85", "eventTime": "2018-04-17T06:16:25Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5cc05eaa-ecb9-4974-9074-246cb513467df", "record_id": "flaws_cloudtrail:0000064:5cc05eaa-ecb9-4974-9074-246cb513467df", "row_index": 64, "timestamp": "2018-04-17T06:16:26Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 809, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5cc05eaa-ecb9-4974-9074-246cb513467df", "eventTime": "2018-04-17T06:16:26Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8b081358-9c2f-49ae-9013-2700eba3d3cf", "record_id": "flaws_cloudtrail:0000065:8b081358-9c2f-49ae-9013-2700eba3d3cf", "row_index": 65, "timestamp": "2018-04-17T06:16:26Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1273, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8b081358-9c2f-49ae-9013-2700eba3d3cf", "eventTime": "2018-04-17T06:16:26Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-bbcb674a", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fb0ac741-fd0b-4372-96f6-18c376e6b6bd", "record_id": "flaws_cloudtrail:0000066:fb0ac741-fd0b-4372-96f6-18c376e6b6bd", "row_index": 66, "timestamp": "2018-04-17T06:16:26Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fb0ac741-fd0b-4372-96f6-18c376e6b6bd", "eventTime": "2018-04-17T06:16:26Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2f94f26d-5e19-46a7-8827-c1d792aeafc2", "record_id": "flaws_cloudtrail:0000067:2f94f26d-5e19-46a7-8827-c1d792aeafc2", "row_index": 67, "timestamp": "2018-04-17T06:16:27Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2f94f26d-5e19-46a7-8827-c1d792aeafc2", "eventTime": "2018-04-17T06:16:27Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a024662fe-27c1-483a-8173-4e5fef5c8e40", "record_id": "flaws_cloudtrail:0000068:a024662fe-27c1-483a-8173-4e5fef5c8e40", "row_index": 68, "timestamp": "2018-04-17T06:16:27Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 809, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a024662fe-27c1-483a-8173-4e5fef5c8e40", "eventTime": "2018-04-17T06:16:27Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "730f03aa-4c1b-414a-a460-65995c87419f", "record_id": "flaws_cloudtrail:0000069:730f03aa-4c1b-414a-a460-65995c87419f", "row_index": 69, "timestamp": "2018-04-17T06:16:27Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 802, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "730f03aa-4c1b-414a-a460-65995c87419f", "eventTime": "2018-04-17T06:16:27Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "25d06868-d753-42ac-a155-24464c1c15b", "record_id": "flaws_cloudtrail:0000070:25d06868-d753-42ac-a155-24464c1c15b", "row_index": 70, "timestamp": "2018-04-17T06:16:27Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 802, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "25d06868-d753-42ac-a155-24464c1c15b", "eventTime": "2018-04-17T06:16:27Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8211d0c3-65f0-4782-8c3d-1d4a585e49b2", "record_id": "flaws_cloudtrail:0000071:8211d0c3-65f0-4782-8c3d-1d4a585e49b2", "row_index": 71, "timestamp": "2018-04-17T06:16:28Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8211d0c3-65f0-4782-8c3d-1d4a585e49b2", "eventTime": "2018-04-17T06:16:28Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2f798d40-a6bf-4fff-88c6-166e03d60154", "record_id": "flaws_cloudtrail:0000072:2f798d40-a6bf-4fff-88c6-166e03d60154", "row_index": 72, "timestamp": "2018-04-17T06:16:28Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1933, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2f798d40-a6bf-4fff-88c6-166e03d60154", "eventTime": "2018-04-17T06:16:28Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: Q48cyXC2Zue3jERtV8sVHZbPbdAd65MqJWrlbEsZoeCSnzl32mGTfeJYtvKdm3O--6I70nasAPMCltwT191DDZd_BDjZVrf-2GiHNUKJbwQyWlq5cSX4SeOf_VlUWi34CTQcXTiCwQjugz6Lh9vtu_oElTNIueQXQHOZqVwWbPX9c8bxApJFd-W57TP1a5w8NfgLKkEi0o1FkuyRS9BnZCB9hcBr2WFXcY-wD2ATL0jCMj3ZA1FGig9GLsY_tUbyOW7_L1jeSDjeaVSKsFzBvQFDbJ41d_Sl4Y5HXmYuefzB3jIJWGSeDlXwkivXRt3TGjhgtR_XEkq70KNu_imnnwxVmianFOzT3Gbvvw8rHBpdGzQf5ViHEtLFVIThv7RA-1TATVe81OUuR_dHNkds2iluqpdJkIP3DOjRXW4cTFDZE8HPqQg296bz83aBJaWzcX5ATaWbPkzHcapcFBh-ECFokiqqgh_b0UKA6dDbl2AdvposEltgP8qaApsP4kVNyQQvM94n9Gwqh9tmNgRHscSUkm2vB-6gbAbaJltqS0OLWMpmjo8XyZkU2zyt13I-Al4hpaN3VzNBV1bLzqSdVzE27GI0XAvJV_E85HrjVonPL5LM-szx0hFMnlPQYIXK6E75sondeeq7DoJRkbv6E0eoN97YkNYyzZ16FA", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-bbcb674a", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ab5803cf-f695-4726-8208-3f8f6ce2227a", "record_id": "flaws_cloudtrail:0000073:ab5803cf-f695-4726-8208-3f8f6ce2227a", "row_index": 73, "timestamp": "2018-04-17T06:16:29Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 911, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ab5803cf-f695-4726-8208-3f8f6ce2227a", "eventTime": "2018-04-17T06:16:29Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d161668e-0a7e-4d9c-8a10-af1639bb6213", "record_id": "flaws_cloudtrail:0000074:d161668e-0a7e-4d9c-8a10-af1639bb6213", "row_index": 74, "timestamp": "2018-04-17T06:16:29Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d161668e-0a7e-4d9c-8a10-af1639bb6213", "eventTime": "2018-04-17T06:16:29Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "71a911af-1c8b-4f4d-a4ee-6c3b3d5330ae", "record_id": "flaws_cloudtrail:0000075:71a911af-1c8b-4f4d-a4ee-6c3b3d5330ae", "row_index": 75, "timestamp": "2018-04-17T06:16:29Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 804, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "71a911af-1c8b-4f4d-a4ee-6c3b3d5330ae", "eventTime": "2018-04-17T06:16:29Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1254d507-f9fb-49f4-b5bb-127be6c16fab", "record_id": "flaws_cloudtrail:0000076:1254d507-f9fb-49f4-b5bb-127be6c16fab", "row_index": 76, "timestamp": "2018-04-17T06:16:29Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1376, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1254d507-f9fb-49f4-b5bb-127be6c16fab", "eventTime": "2018-04-17T06:16:29Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-009dc204", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dc6ded89-e7de-478c-968f-21ebe23ef75c", "record_id": "flaws_cloudtrail:0000077:dc6ded89-e7de-478c-968f-21ebe23ef75c", "row_index": 77, "timestamp": "2018-04-17T06:16:30Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1382, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dc6ded89-e7de-478c-968f-21ebe23ef75c", "eventTime": "2018-04-17T06:16:30Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-02d34bac", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cc32e48b-cc8a-4401-ade2-f3fbe30b514e", "record_id": "flaws_cloudtrail:0000078:cc32e48b-cc8a-4401-ade2-f3fbe30b514e", "row_index": 78, "timestamp": "2018-04-17T06:16:30Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cc32e48b-cc8a-4401-ade2-f3fbe30b514e", "eventTime": "2018-04-17T06:16:30Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4ffcaa80-4104-4935-ade8-6a77e128aaae", "record_id": "flaws_cloudtrail:0000079:4ffcaa80-4104-4935-ade8-6a77e128aaae", "row_index": 79, "timestamp": "2018-04-17T06:16:30Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1374, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4ffcaa80-4104-4935-ade8-6a77e128aaae", "eventTime": "2018-04-17T06:16:30Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-009dc204", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "684109d-65e8-4e40-8c9d-8447b06df0a7", "record_id": "flaws_cloudtrail:0000080:684109d-65e8-4e40-8c9d-8447b06df0a7", "row_index": 80, "timestamp": "2018-04-17T06:16:31Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1376, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "684109d-65e8-4e40-8c9d-8447b06df0a7", "eventTime": "2018-04-17T06:16:31Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-009dc204", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "90ac3319-8c9f-447f-98bd-5ca154cdd247", "record_id": "flaws_cloudtrail:0000081:90ac3319-8c9f-447f-98bd-5ca154cdd247", "row_index": 81, "timestamp": "2018-04-17T06:16:32Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 805, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "90ac3319-8c9f-447f-98bd-5ca154cdd247", "eventTime": "2018-04-17T06:16:32Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9ffea7c2-12bb-4abc-a2b7-f0726a3ebc7a", "record_id": "flaws_cloudtrail:0000082:9ffea7c2-12bb-4abc-a2b7-f0726a3ebc7a", "row_index": 82, "timestamp": "2018-04-17T06:16:32Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1381, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9ffea7c2-12bb-4abc-a2b7-f0726a3ebc7a", "eventTime": "2018-04-17T06:16:32Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-02d34bac", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4dbc4085-3ae7-4e08-a3f8-d8be4b2e3043", "record_id": "flaws_cloudtrail:0000083:4dbc4085-3ae7-4e08-a3f8-d8be4b2e3043", "row_index": 83, "timestamp": "2018-04-17T06:16:32Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1376, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4dbc4085-3ae7-4e08-a3f8-d8be4b2e3043", "eventTime": "2018-04-17T06:16:32Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-71cdc376", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "aeaececa-53d4-4b63-9ba4-d4ccb2d342ba", "record_id": "flaws_cloudtrail:0000084:aeaececa-53d4-4b63-9ba4-d4ccb2d342ba", "row_index": 84, "timestamp": "2018-04-17T06:16:32Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1926, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "aeaececa-53d4-4b63-9ba4-d4ccb2d342ba", "eventTime": "2018-04-17T06:16:32Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: I7jc_tbXD1IH_ywMrXZ9-Uu8qYKPhWEnx18a7VvHG3AhqiwDPZUEnsP45dRLN431Zf8qnYDiwioXJwNC0l306WkVJ5vY1NN0hyHHFKsayW9y8MMTKAioFYsVdgt43IwV9g0wgMcp6WJpEfbDsDxc2KUwzJ54NoAL9-uEdfChATi7NxWBBATWmIOcoS8V5hlz7jfSohHDN4rY6YLrsgXWzQQ9jpjBsRWpp81WaQvGlulxXRzVY32xEEan5dB-CV7l0DRuepqkBxKgkufq466TRWGHx_na9RE4UiIFnffJP3YrrS4Rd51zwaLoRZxoQrzp1xa5J2lV7UwTRWQempsbt5OjHgoDb6mrqOdEpO1dk0km1M2vJuCUkPIlddlFcj6KGYV2Mpd2WLOrSEQdCntizR7-yVVwTEv3hdCQ6B72akgVGDKDkokbQjDk9rWZyUggyGCltyJburxzLHwQof98VUnhAZ5lstdtxh5MUcL199R1Yb5i9ZiiCfPDV_Pn1t2sw376EJr6QI5kqQmogFgRpk5wQxVU05Sh6KTack5wEdcDoqmwBbTtoGbaWVj6uWlijkrrsKhIX-VceTMtnFxMfQ20V9s98Yi5d1F0uF4OQNX0RTsFz_wyreiRHEDxaJAvIwdiIgprfrlpm7m0JPFub06OqGiSybgJlQ", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-009dc204", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "95a170ca-d58b-4f92-bdea-8f2c0cdbbb8f", "record_id": "flaws_cloudtrail:0000085:95a170ca-d58b-4f92-bdea-8f2c0cdbbb8f", "row_index": 85, "timestamp": "2018-04-17T06:16:33Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 804, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "95a170ca-d58b-4f92-bdea-8f2c0cdbbb8f", "eventTime": "2018-04-17T06:16:33Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "20c4850b-e0bb-4b6e-92ee-9d0fe7ec846f", "record_id": "flaws_cloudtrail:0000086:20c4850b-e0bb-4b6e-92ee-9d0fe7ec846f", "row_index": 86, "timestamp": "2018-04-17T06:16:33Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1382, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "20c4850b-e0bb-4b6e-92ee-9d0fe7ec846f", "eventTime": "2018-04-17T06:16:33Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-02d34bac", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0246a950-05e6-4832-870d-9578a7464c74", "record_id": "flaws_cloudtrail:0000087:0246a950-05e6-4832-870d-9578a7464c74", "row_index": 87, "timestamp": "2018-04-17T06:16:33Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 806, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0246a950-05e6-4832-870d-9578a7464c74", "eventTime": "2018-04-17T06:16:33Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "989f3ac2-0833-4d95-8e81-aa820f892362", "record_id": "flaws_cloudtrail:0000088:989f3ac2-0833-4d95-8e81-aa820f892362", "row_index": 88, "timestamp": "2018-04-17T06:16:33Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 908, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "989f3ac2-0833-4d95-8e81-aa820f892362", "eventTime": "2018-04-17T06:16:33Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "be263ee5-e173-4707-bd4f-cafc6e671d4f", "record_id": "flaws_cloudtrail:0000089:be263ee5-e173-4707-bd4f-cafc6e671d4f", "row_index": 89, "timestamp": "2018-04-17T06:16:33Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1376, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "be263ee5-e173-4707-bd4f-cafc6e671d4f", "eventTime": "2018-04-17T06:16:33Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-71cdc376", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1560c2f0-0b51-47eb-bea7-c6fd03c1a5ac", "record_id": "flaws_cloudtrail:0000090:1560c2f0-0b51-47eb-bea7-c6fd03c1a5ac", "row_index": 90, "timestamp": "2018-04-17T06:16:34Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 804, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1560c2f0-0b51-47eb-bea7-c6fd03c1a5ac", "eventTime": "2018-04-17T06:16:34Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ab71d2fd-a8bc-4640-b3a0-15609db4", "record_id": "flaws_cloudtrail:0000091:ab71d2fd-a8bc-4640-b3a0-15609db4", "row_index": 91, "timestamp": "2018-04-17T06:16:34Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 802, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ab71d2fd-a8bc-4640-b3a0-15609db4", "eventTime": "2018-04-17T06:16:34Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a62c8461-0de5-456d-bb9d-f7b203421896", "record_id": "flaws_cloudtrail:0000092:a62c8461-0de5-456d-bb9d-f7b203421896", "row_index": 92, "timestamp": "2018-04-17T06:16:34Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1270, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a62c8461-0de5-456d-bb9d-f7b203421896", "eventTime": "2018-04-17T06:16:34Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-71cdc376", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0c234692-33f6-4f8e-97b2-229391c13b17", "record_id": "flaws_cloudtrail:0000093:0c234692-33f6-4f8e-97b2-229391c13b17", "row_index": 93, "timestamp": "2018-04-17T06:16:35Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1935, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0c234692-33f6-4f8e-97b2-229391c13b17", "eventTime": "2018-04-17T06:16:35Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: isSkorzaL3eEbuVqN-m6E9FhseCsvXvYMaT4WmuKfEARXwgd7XVw5Hpsmj0pGn_AdBejnlje6v5GmMlEFM2hLRWwDOLHhLKhkXtVVzy18fHM0wlgRpOtPnpEq6FBBAcaZju3wAI2ERlyUUmiTPvqpnb3zhRR3hgilrAqyo0zvIvpl2eLVA5eO9xYumjG-HaO1ZIIwYG_VuXB_smPgMjTxIjCCnPegPCH3HIuMxTbWhChAnAaovWIOJFKkdNFSfiIud3mnOX5R08svifgYzm11_HQGA9QXUHr2bShOHKdUuFb55-wv4RrJGo-5b06bwJwavz5a9KGUvJinp91yZAy4JEz_tL3Tx0Zn8_XEyQ9kFg3pMeNshD9ulBD1_ntu3-wVcdWBztiwkphJhXDhRnwcltGWC-g4EKyXHeOi3mpNcW5biF-mbul081xHliHDFV9USJglgqrQb-pUi8ad-5Z5iw9JsL3zI4f-53cHNwv2-WlPNfCSpcu8KTWumq0jSFrhe2LInfTMLJr1Q2o9zGuuokzLgp47tusOCajROxW5gVC3EQhFNOMT815DjVejDDJ_yeH-9baz9CPyyBNKDm9qV9WsnbL3peJpdKy9hrKbxJQH_fvZBAzP1Iw5mQUawFzb80LH7QiL-iTsPeYyOro7FDCB-N8dkAdO1MFW_8", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-02d34bac", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7b67afc5-128d-4aa0-85bd-8a14def445fc", "record_id": "flaws_cloudtrail:0000094:7b67afc5-128d-4aa0-85bd-8a14def445fc", "row_index": 94, "timestamp": "2018-04-17T06:16:35Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1926, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7b67afc5-128d-4aa0-85bd-8a14def445fc", "eventTime": "2018-04-17T06:16:35Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: Ywmio-31e0jD8GE0e16zHrNdKds--pW_A5TXgBuEfNm9XkqJTIUguT_W6wU22xMqv6qqgdaVAzOY6U_hn641DWmvsF7pX9kHrPSOH0PLiJTohFwUpCPjirDfqSR1LFVPFuBDsStRSbB5zWoyXbZZfrXeJWo10TZpUm0--0HlNYsfShAWhxsyj08FzTzQwCci_Cyb3mAQZAX7GM5O3IslTVv-R6sH2isErnwfOx4a6UOi-mkQb0uoxNBiqynp0OfO9b12Ro4A6Id3KXa6F1cuOQ8BvQlB-dJKS8P2l2_gfdfe-mcCCOlB0XgJndzmt_TTA2DH2JVsHIGx8y0Nih1VYDu1ehiubp66GS2OnJ4JErnQqrnI-n24RopZkcWAzhKbCRyWOTGUoIZ6VVYqix1YdesAh83ZobzxcWLYxkOLp9590XbXDrUPX5NHKiUWTqIh1FlDjKPsDsOpMUrv2BL3RHup0UJ9doqmCpsH1ckAovMr2CDho7mIKIIPhGPgpHS7TMjOipCHFktmu-qNcX9fclAGHZE7Nb8Ek_Vn4OokNxJj8DGq7H0We7e_rKmN_dURZTF2KNg67MR6bpvngG9eL6HGfIC80wGdLOjQyq266QVusqqyQi85EE7l2yz_dvkGquJl5FVTzcn7Vm83cehgzii-ZXjmmi1F3Q", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-71cdc376", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "46dbdd06-6156-49ae-9db7-fafddf84825", "record_id": "flaws_cloudtrail:0000095:46dbdd06-6156-49ae-9db7-fafddf84825", "row_index": 95, "timestamp": "2018-04-17T06:16:36Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 1376, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "46dbdd06-6156-49ae-9db7-fafddf84825", "eventTime": "2018-04-17T06:16:36Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-8c971d21", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d98df9e3-9708-4c6d-9d59-74e585d4c9b5", "record_id": "flaws_cloudtrail:0000096:d98df9e3-9708-4c6d-9d59-74e585d4c9b5", "row_index": 96, "timestamp": "2018-04-17T06:16:36Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d98df9e3-9708-4c6d-9d59-74e585d4c9b5", "eventTime": "2018-04-17T06:16:36Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bb991d21-179c-4e2c-bb79-679050f5bf", "record_id": "flaws_cloudtrail:0000097:bb991d21-179c-4e2c-bb79-679050f5bf", "row_index": 97, "timestamp": "2018-04-17T06:16:36Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 906, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bb991d21-179c-4e2c-bb79-679050f5bf", "eventTime": "2018-04-17T06:16:36Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "adb124e2-723c-46f0-9429-1e2b216660", "record_id": "flaws_cloudtrail:0000098:adb124e2-723c-46f0-9429-1e2b216660", "row_index": 98, "timestamp": "2018-04-17T06:16:37Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 1375, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "adb124e2-723c-46f0-9429-1e2b216660", "eventTime": "2018-04-17T06:16:37Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-8c971d21", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "96affc71-291e-4a3c-8e3a-48931e3e87fa", "record_id": "flaws_cloudtrail:0000099:96affc71-291e-4a3c-8e3a-48931e3e87fa", "row_index": 99, "timestamp": "2018-04-17T06:16:37Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 806, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "96affc71-291e-4a3c-8e3a-48931e3e87fa", "eventTime": "2018-04-17T06:16:37Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "05b4eb3e-b342-48ea-9241-6843a44ffee5", "record_id": "flaws_cloudtrail:0000100:05b4eb3e-b342-48ea-9241-6843a44ffee5", "row_index": 100, "timestamp": "2018-04-17T06:16:37Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "05b4eb3e-b342-48ea-9241-6843a44ffee5", "eventTime": "2018-04-17T06:16:37Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9cfb7f3b-f2f9-4a3e-b67b-17149c074f90", "record_id": "flaws_cloudtrail:0000101:9cfb7f3b-f2f9-4a3e-b67b-17149c074f90", "row_index": 101, "timestamp": "2018-04-17T06:16:38Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1379, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9cfb7f3b-f2f9-4a3e-b67b-17149c074f90", "eventTime": "2018-04-17T06:16:38Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-d10c94e9", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7af5801a-2aa4-4eba-b142-750baa4bfd9c", "record_id": "flaws_cloudtrail:0000102:7af5801a-2aa4-4eba-b142-750baa4bfd9c", "row_index": 102, "timestamp": "2018-04-17T06:16:38Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7af5801a-2aa4-4eba-b142-750baa4bfd9c", "eventTime": "2018-04-17T06:16:38Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7353c04b-6ed1-40ef-84b7-b444aa6423d1", "record_id": "flaws_cloudtrail:0000103:7353c04b-6ed1-40ef-84b7-b444aa6423d1", "row_index": 103, "timestamp": "2018-04-17T06:16:39Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 1270, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7353c04b-6ed1-40ef-84b7-b444aa6423d1", "eventTime": "2018-04-17T06:16:39Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-8c971d21", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "18192b07-d825-4e9a-9467-0d25854b5930", "record_id": "flaws_cloudtrail:0000104:18192b07-d825-4e9a-9467-0d25854b5930", "row_index": 104, "timestamp": "2018-04-17T06:16:39Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1379, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "18192b07-d825-4e9a-9467-0d25854b5930", "eventTime": "2018-04-17T06:16:39Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-d10c94e9", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "554554-d7ea-4bd7-aaeb-a1d53c38cfe7", "record_id": "flaws_cloudtrail:0000105:554554-d7ea-4bd7-aaeb-a1d53c38cfe7", "row_index": 105, "timestamp": "2018-04-17T06:16:39Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 800, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "554554-d7ea-4bd7-aaeb-a1d53c38cfe7", "eventTime": "2018-04-17T06:16:39Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "73cd9c11-99b0-41d4-9065-ea712092d4", "record_id": "flaws_cloudtrail:0000106:73cd9c11-99b0-41d4-9065-ea712092d4", "row_index": 106, "timestamp": "2018-04-17T06:16:40Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1372, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "73cd9c11-99b0-41d4-9065-ea712092d4", "eventTime": "2018-04-17T06:16:40Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-2b129c1b", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "28a4b539-ecf2-418d-a4f5-861287d3b9556", "record_id": "flaws_cloudtrail:0000107:28a4b539-ecf2-418d-a4f5-861287d3b9556", "row_index": 107, "timestamp": "2018-04-17T06:16:40Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 804, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "28a4b539-ecf2-418d-a4f5-861287d3b9556", "eventTime": "2018-04-17T06:16:40Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a3317c79-eb08-40a9-b61c-e4d22471623d", "record_id": "flaws_cloudtrail:0000108:a3317c79-eb08-40a9-b61c-e4d22471623d", "row_index": 108, "timestamp": "2018-04-17T06:16:41Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 1929, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a3317c79-eb08-40a9-b61c-e4d22471623d", "eventTime": "2018-04-17T06:16:41Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: POMB1JZ87pUC4YXAacXuPQfwqROZs7ENbfLaJXBPMvt_jl4SfXbp6A5W4gjIjt2xFa-xvQU-8vPtmJKd0KZUyr5CLfJ886fyhRwYGwoerGEyY3vzCMuUTq8beo6JfP4zRLHr_mvpPLM2lZL7HntCR_3TrJhOIHwwqzBQCWHcrXy_Bpnh6yO3fGgfBbkBE6XjyeNiy9Q1L_rMlstJnjMh5GjYkmNveIL_OeVF_SqaVn-0MnFKxCbKF_myRkxNKVD-i6qlXNg4kW6CXg6AcVcfMusKKMRQBdCOr2lVnXy0db_vZfrNJ3maUNUE9mu57Xte4ehJ8eMJZLQJ0Dw1WJVukAeXwMywVUlh38el1mXTsY5rL21Kc04iH1n9Lljez392W0-Ue1OCpeYvM4so1YERnUesoAG4M8STVvPKpc118dTj1BQ-7ifh5E_7gIyjJTnvP6Gg5OYQoKdpmHaQ-3S6xbu67UzzN1u9hs1pbyEsqoHWb1JdSNEUUnvN9lSD_dPLTwZ95Yx5BuwngnA7gHEF9wLRS7YEtACyC5DjjJhNwfNce812VdmvonS7AgjJe2KgdGKPaKswvVcrsMnxraUeZ8vFKMgPPzdh7iICFEWudK4E6zqM_EBe1nHObJwYEfh4Vb7Rw94nipvWD739jcX7RBHRdsQu0lGloLYj", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-8c971d21", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2d39dfd6-980d-457e-acef-c98fa6a5748c", "record_id": "flaws_cloudtrail:0000109:2d39dfd6-980d-457e-acef-c98fa6a5748c", "row_index": 109, "timestamp": "2018-04-17T06:16:41Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1273, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2d39dfd6-980d-457e-acef-c98fa6a5748c", "eventTime": "2018-04-17T06:16:41Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-d10c94e9", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8189abb7-4dc1-4411-acaf-7fc5d0a3ea64", "record_id": "flaws_cloudtrail:0000110:8189abb7-4dc1-4411-acaf-7fc5d0a3ea64", "row_index": 110, "timestamp": "2018-04-17T06:16:41Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1376, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8189abb7-4dc1-4411-acaf-7fc5d0a3ea64", "eventTime": "2018-04-17T06:16:41Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-2b129c1b", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e48297-0ed3-4f43-b0bb-dfc7f3231903", "record_id": "flaws_cloudtrail:0000111:e48297-0ed3-4f43-b0bb-dfc7f3231903", "row_index": 111, "timestamp": "2018-04-17T06:16:41Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 801, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e48297-0ed3-4f43-b0bb-dfc7f3231903", "eventTime": "2018-04-17T06:16:41Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "76946c6-bda3-42cb-bb8d-ee13799d7983", "record_id": "flaws_cloudtrail:0000112:76946c6-bda3-42cb-bb8d-ee13799d7983", "row_index": 112, "timestamp": "2018-04-17T06:16:42Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1932, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "76946c6-bda3-42cb-bb8d-ee13799d7983", "eventTime": "2018-04-17T06:16:42Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: wS4y9LrixSgLkNLSyGWpjCj0d9Qrr16wJ-FzldZgzEpZ92kwfh-e4bfbtl-GEKiXhLj4EGC8x-ci49u0D518h8Pt1rhMFrDoYcDpuAQIY6DKMkgFwPZ4sahadiRgP3os6_tnshsoD1lNvga_ua7ZwS-UHE70XkNAwD1cTMXMy_6DBdWHgxcAlDF34nvtFbrmTnPUR6thvAYlP_GZFeLp_0vJiQMEMcw9_oLq6VQT0ndR6GxcXtn5cp2QkBdps5xB-p5qOqnlnefBjzlZJ5EJ7LSBSuGH82hDzQD5qHnnL9qi4JcytuVjlwhsJnlgq2ur_Gxvc2swtXAsLgUsf_uLu9tKYke7HCKqoWz445AJAhsYyUQabRvVH245jOseSnY372QSHHMH8mi6mOoJjkpPfKnI3Y8lBaPqITxG8XDou-IrJs4S-Eu3jxjCUITXY1XjrLAvFX2iHe4Fdkfzy0v6GB5sDz8YoViVRUSgg5YgTMnYoB16qTBGIWt_1kyQ7whU-0lSyvjbXihdsqNlmCQOtrBvG-AFmTxGwWyR6WiFQ8Kp1nYBTmue_y9vUaw1wrqbzspd8fXXdX0Sw4VwRJIuZKGSNl411AbmHdIAwPnu_VcPurtDxPVnHSG93ULyq17xMIT3N9_mZ_vZfg8PtDCb4ZOlBt_qRfHFfDC_6w", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-d10c94e9", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7e3cc4b2-adce-4f9f-847f-d0f28b8c153a", "record_id": "flaws_cloudtrail:0000113:7e3cc4b2-adce-4f9f-847f-d0f28b8c153a", "row_index": 113, "timestamp": "2018-04-17T06:16:42Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1377, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7e3cc4b2-adce-4f9f-847f-d0f28b8c153a", "eventTime": "2018-04-17T06:16:42Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-2b129c1b", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "eeb33ce2-fd7d-4432-b76f-2ca5b8800ba1", "record_id": "flaws_cloudtrail:0000114:eeb33ce2-fd7d-4432-b76f-2ca5b8800ba1", "row_index": 114, "timestamp": "2018-04-17T06:16:42Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 801, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "eeb33ce2-fd7d-4432-b76f-2ca5b8800ba1", "eventTime": "2018-04-17T06:16:42Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bde6efaa-cbd4-49e5-a694-3b3d3fe27d77", "record_id": "flaws_cloudtrail:0000115:bde6efaa-cbd4-49e5-a694-3b3d3fe27d77", "row_index": 115, "timestamp": "2018-04-17T06:16:42Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bde6efaa-cbd4-49e5-a694-3b3d3fe27d77", "eventTime": "2018-04-17T06:16:42Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1c97fab5-d999-4011-aed5-c84970f354fd", "record_id": "flaws_cloudtrail:0000116:1c97fab5-d999-4011-aed5-c84970f354fd", "row_index": 116, "timestamp": "2018-04-17T06:16:43Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1926, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1c97fab5-d999-4011-aed5-c84970f354fd", "eventTime": "2018-04-17T06:16:43Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: YR5BeNsD7uWEBdhunJ9awXQZwRRnvyDpwbpo9qNDjV7ieXE_wvMGYgdvmqruS-Bo8366UfXj5VGG6gLHC7po7nxf_4WankhZaHZjXIHW-d-h8ET2NTCBmE_ZQBY4cNqKNMp7yqRxaFukq6srYgcdnyli37ic6yGWCy4SKMYLTeWBlRdtZ2GwHSar0kZMHtN1R4YJD8XwBuQh43OiRANoD4Cu6D_pofU9MpG5ubGOZTMk2RLPWGtAMa9rbI4G_1p1E2B9D2UDRmHFozqJJYzQgP_g-Tb3WdckM2JbXTplrn8QmZqRm_S_gyVtaw-xBHnIQRLMn7i7aKlja_ahfBaBC3gpr6JRbXUVuWy3lYgxMnyrph_Uszh8-oee1VStqC4UKJ39SOp5ZuhI75qcTQWa0kU63HXzlQIm4AffZmnKG8XgGLvRC8D86yu6ksLJQ327NFgCb9wjeM2jkMI7kdlzzSmNvZsh07FC1u0ajI4olZq6NTPnxvlElfKlGchtPFa-p6uZDbZ11FJBzOes4mHIMOO4LBz5vWdTPqZ8WaS7OGeVVkfa_YccilbJQ_7eSZCsntFZiUXbHzGlZpW5a8TGdXOTqil0cv3veaSfk9mgv98ObBA7OZO2g2w-6-zd70vlUrMUMO3AV2fOWztYaDplIfpZURuTsvZ_ug", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-2b129c1b", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "61ac736d-3e50-42cb-aedc-5c91844e7910", "record_id": "flaws_cloudtrail:0000117:61ac736d-3e50-42cb-aedc-5c91844e7910", "row_index": 117, "timestamp": "2018-04-17T06:16:43Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "61ac736d-3e50-42cb-aedc-5c91844e7910", "eventTime": "2018-04-17T06:16:43Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "957830cf-fe85-4b4f-91fa-6302399b7b09", "record_id": "flaws_cloudtrail:0000118:957830cf-fe85-4b4f-91fa-6302399b7b09", "row_index": 118, "timestamp": "2018-04-17T06:16:43Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 801, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "957830cf-fe85-4b4f-91fa-6302399b7b09", "eventTime": "2018-04-17T06:16:43Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "84982ec9-0e71-4e2c-a0e4-67ae110a13cf", "record_id": "flaws_cloudtrail:0000119:84982ec9-0e71-4e2c-a0e4-67ae110a13cf", "row_index": 119, "timestamp": "2018-04-17T06:16:44Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1376, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "84982ec9-0e71-4e2c-a0e4-67ae110a13cf", "eventTime": "2018-04-17T06:16:44Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-63f71193", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "426c11a2-6e80-41be-b758-bdddab73ec75", "record_id": "flaws_cloudtrail:0000120:426c11a2-6e80-41be-b758-bdddab73ec75", "row_index": 120, "timestamp": "2018-04-17T06:16:45Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 1376, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "426c11a2-6e80-41be-b758-bdddab73ec75", "eventTime": "2018-04-17T06:16:45Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-3a3a9be3", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ade844be-01fa-4b09-82d1-fc35d37dd03a", "record_id": "flaws_cloudtrail:0000121:ade844be-01fa-4b09-82d1-fc35d37dd03a", "row_index": 121, "timestamp": "2018-04-17T06:16:46Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1376, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ade844be-01fa-4b09-82d1-fc35d37dd03a", "eventTime": "2018-04-17T06:16:46Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-63f71193", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f6b5dfb9-9f59-4b61-becc-eef98b45c186", "record_id": "flaws_cloudtrail:0000122:f6b5dfb9-9f59-4b61-becc-eef98b45c186", "row_index": 122, "timestamp": "2018-04-17T06:16:46Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 1377, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f6b5dfb9-9f59-4b61-becc-eef98b45c186", "eventTime": "2018-04-17T06:16:46Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-3a3a9be3", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "60a3f861-a373-4b31-b1b1-f1eeb840b310", "record_id": "flaws_cloudtrail:0000123:60a3f861-a373-4b31-b1b1-f1eeb840b310", "row_index": 123, "timestamp": "2018-04-17T06:16:47Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1270, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "60a3f861-a373-4b31-b1b1-f1eeb840b310", "eventTime": "2018-04-17T06:16:47Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-63f71193", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f8a268943-0760-4607-b604-ed2415e2f86e", "record_id": "flaws_cloudtrail:0000124:f8a268943-0760-4607-b604-ed2415e2f86e", "row_index": 124, "timestamp": "2018-04-17T06:16:48Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 1269, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f8a268943-0760-4607-b604-ed2415e2f86e", "eventTime": "2018-04-17T06:16:48Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-3a3a9be3", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d8ae2b98-08e4-4ece-a5f0-40785ad9b463", "record_id": "flaws_cloudtrail:0000125:d8ae2b98-08e4-4ece-a5f0-40785ad9b463", "row_index": 125, "timestamp": "2018-04-17T06:16:49Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1925, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d8ae2b98-08e4-4ece-a5f0-40785ad9b463", "eventTime": "2018-04-17T06:16:49Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: OXS0dluRFlrYl5YT4NnE8LAlZLnqv_S9XxzPMwLj-oc6xAHpZ1QupdwO1MRKwR5Oj1873FY6j2bv0Na3p2BQKs6yGcWcW7HBk_CuUj6EPQVcrOoyPuoeoyeFzQraKzB42FogmdVs3sia-AX-DMwNztKi942XbUfU2UIsuZtUk-ZdtW7fNA3AKBz5kMhN0XBdaIL-_EBVefIAuLF6Gn-5m-OKhWEW4FXczW9g9YKmUm6N4BHL6DYMaU9moIR20DfF4W5_mSdcwBmEB4eo8NTHkidH5sePU37j8XaOqiKuByqTHPwSiyyCM8tH56SEkO119TedxAkBgL701D9eHrgbW1CiJMU-5U5w4dp1iVuvSUa5bepdTzxL91QEKLPx7gKeFt-7l90oW12vS1hBue8Xh_9dOPNwL0yNyxomuztvSNBaDeIMk_EZwxmvJysQMsZyclMNWanJ_Vsj4Dfg2olKys0b67KNrgWc7n_FhHXX2d1F1bWxYflJeOalR1sMTzE-RJEadIr9tZTVZqQcFyntcjFhVdEHPMUnvMDuQktAKsqsKvnwJNIgMdm2jyuGIVt-SfCZdawTJtwAVer0I0UFddj66TrSjN2VGnyrN3i7V7Wa7JNXVyyC68pNJ0dlnhKMYgGWARo_rfO9QTQtP5w3VVqfAhfFCIHT", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-63f71193", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9b74f609-4a64-4b1a-9fc1-825e745b9557", "record_id": "flaws_cloudtrail:0000126:9b74f609-4a64-4b1a-9fc1-825e745b9557", "row_index": 126, "timestamp": "2018-04-17T06:16:50Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 1927, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9b74f609-4a64-4b1a-9fc1-825e745b9557", "eventTime": "2018-04-17T06:16:50Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: 4J6J--psy_nUfovPeAZdufIn0G4ssGTIrJ1zitktInVGXcC3IqYN-QLRriDk_DwgsZX_uxPfJ1Kh8b1YMRVh0fPed0rGw2qYDSQrs92SfAt7r0BbuMPucvvYCmMDuR0SAT682K0WTvQGMKjOROHRd4-mdcPm7LQ7vb-bpFEzk62fCUOJ3GSW3DlBSHN5kSIpy3pX--orBaqoW7yYNbxTarvVZFKpZUu5xe8B-TXRCUaXTwYb3xA5J54YnIXpWpx94q88YB4PsvVj6Av0_DSoovpnGbHeocfoJLmqCKf_1eSkdhdlTp3m9qqbl5SnQPXEtnw-891aWhYBP0cH-70KFtEdF6ASW-AnAnbQOpK7URcCdQevmjrF16QzdGWA2iDwr8IR5nVSMSzpgB3wSQCSRvJBiOW1PorqZJFhqCy-_Bl-SxidIZ-pJiMqOjMCYGc52Ig4Rq3soDazn0IjVWjc7R9EOn9lDcgwdC1dvCbkl5noEJ5E25a-8dsppc51Hh_RpA_BJH_m50NY4sX8YDr20GzL602_080kJmdnbErERgBybzcHzQc74YpRQzJgLeExcrDKSyojE5DUIZVIy7FhpcZCIAA6nMox2FjAwG3Ojk6aiTp3BP0pzrdOdhLcSkX9ArzwNqxBAFoX5CnV0DJYalG19UnoEHhPPtQ", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-3a3a9be3", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2de3816d-f241-4ee2-a903-9edd46070c34", "record_id": "flaws_cloudtrail:0000127:2de3816d-f241-4ee2-a903-9edd46070c34", "row_index": 127, "timestamp": "2018-04-17T06:16:51Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 775, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2de3816d-f241-4ee2-a903-9edd46070c34", "eventTime": "2018-04-17T06:16:51Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "41ebe97f-42a0-454f-a759-5f61679be6d", "record_id": "flaws_cloudtrail:0000128:41ebe97f-42a0-454f-a759-5f61679be6d", "row_index": 128, "timestamp": "2018-04-17T06:47:44Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 873, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "41ebe97f-42a0-454f-a759-5f61679be6d", "eventTime": "2018-04-17T06:47:44Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "90e2226c-488a-4a23-a511-b9e0e3c243245", "record_id": "flaws_cloudtrail:0000129:90e2226c-488a-4a23-a511-b9e0e3c243245", "row_index": 129, "timestamp": "2018-04-17T06:47:45Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "90e2226c-488a-4a23-a511-b9e0e3c243245", "eventTime": "2018-04-17T06:47:45Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e49f0ba8-168a-46b2-a7da-c5ee75bdbb34", "record_id": "flaws_cloudtrail:0000130:e49f0ba8-168a-46b2-a7da-c5ee75bdbb34", "row_index": 130, "timestamp": "2018-04-17T06:47:46Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 913, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e49f0ba8-168a-46b2-a7da-c5ee75bdbb34", "eventTime": "2018-04-17T06:47:46Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "477245e-e743-4115-907b-9257acc7168d", "record_id": "flaws_cloudtrail:0000131:477245e-e743-4115-907b-9257acc7168d", "row_index": 131, "timestamp": "2018-04-17T06:47:46Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 905, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "477245e-e743-4115-907b-9257acc7168d", "eventTime": "2018-04-17T06:47:46Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "54839c7-cfb6-40de-b484-816db4416a0c", "record_id": "flaws_cloudtrail:0000132:54839c7-cfb6-40de-b484-816db4416a0c", "row_index": 132, "timestamp": "2018-04-17T06:47:47Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 912, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "54839c7-cfb6-40de-b484-816db4416a0c", "eventTime": "2018-04-17T06:47:47Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "aa4b3ce7-8b50-4253-93f6-cc0d286e4314", "record_id": "flaws_cloudtrail:0000133:aa4b3ce7-8b50-4253-93f6-cc0d286e4314", "row_index": 133, "timestamp": "2018-04-17T06:47:47Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 908, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "aa4b3ce7-8b50-4253-93f6-cc0d286e4314", "eventTime": "2018-04-17T06:47:47Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2af7efc5-bc38-48e3-bd69-8379d78c3a70", "record_id": "flaws_cloudtrail:0000134:2af7efc5-bc38-48e3-bd69-8379d78c3a70", "row_index": 134, "timestamp": "2018-04-17T06:47:47Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 908, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2af7efc5-bc38-48e3-bd69-8379d78c3a70", "eventTime": "2018-04-17T06:47:47Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dbb40aa7-bcad-4ca8-a357-7d68f22386d", "record_id": "flaws_cloudtrail:0000135:dbb40aa7-bcad-4ca8-a357-7d68f22386d", "row_index": 135, "timestamp": "2018-04-17T06:47:50Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 807, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dbb40aa7-bcad-4ca8-a357-7d68f22386d", "eventTime": "2018-04-17T06:47:50Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a40d4b38-06cb-4bb5-8915-5e4c0a55c39e", "record_id": "flaws_cloudtrail:0000136:a40d4b38-06cb-4bb5-8915-5e4c0a55c39e", "row_index": 136, "timestamp": "2018-04-17T06:47:50Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 802, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a40d4b38-06cb-4bb5-8915-5e4c0a55c39e", "eventTime": "2018-04-17T06:47:50Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e5def210-fc41-4950-9467-e433850e3306", "record_id": "flaws_cloudtrail:0000137:e5def210-fc41-4950-9467-e433850e3306", "row_index": 137, "timestamp": "2018-04-17T06:47:51Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e5def210-fc41-4950-9467-e433850e3306", "eventTime": "2018-04-17T06:47:51Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9fa7ab74-7b6c-4778-a065-49cb292620ab7", "record_id": "flaws_cloudtrail:0000138:9fa7ab74-7b6c-4778-a065-49cb292620ab7", "row_index": 138, "timestamp": "2018-04-17T06:47:51Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 810, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9fa7ab74-7b6c-4778-a065-49cb292620ab7", "eventTime": "2018-04-17T06:47:51Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dfb255321-9f48-4b3a-b3b1-7785e54c7239", "record_id": "flaws_cloudtrail:0000139:dfb255321-9f48-4b3a-b3b1-7785e54c7239", "row_index": 139, "timestamp": "2018-04-17T06:47:51Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 804, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dfb255321-9f48-4b3a-b3b1-7785e54c7239", "eventTime": "2018-04-17T06:47:51Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "271fea13-b9b4-43f4-9293-c9cad4c1a1b7", "record_id": "flaws_cloudtrail:0000140:271fea13-b9b4-43f4-9293-c9cad4c1a1b7", "row_index": 140, "timestamp": "2018-04-17T06:47:51Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 802, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "271fea13-b9b4-43f4-9293-c9cad4c1a1b7", "eventTime": "2018-04-17T06:47:51Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bf2262f2-a14c-4f2f-ba8b-1d0c2759962c", "record_id": "flaws_cloudtrail:0000141:bf2262f2-a14c-4f2f-ba8b-1d0c2759962c", "row_index": 141, "timestamp": "2018-04-17T06:47:52Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bf2262f2-a14c-4f2f-ba8b-1d0c2759962c", "eventTime": "2018-04-17T06:47:52Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cc69694-8c8a-4fcf-b508-f27eb022671a", "record_id": "flaws_cloudtrail:0000142:cc69694-8c8a-4fcf-b508-f27eb022671a", "row_index": 142, "timestamp": "2018-04-17T06:47:52Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 802, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cc69694-8c8a-4fcf-b508-f27eb022671a", "eventTime": "2018-04-17T06:47:52Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "73fa1a10-86d8-4afc-b9be-1dc85a631837", "record_id": "flaws_cloudtrail:0000143:73fa1a10-86d8-4afc-b9be-1dc85a631837", "row_index": 143, "timestamp": "2018-04-17T06:47:52Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "73fa1a10-86d8-4afc-b9be-1dc85a631837", "eventTime": "2018-04-17T06:47:52Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "279346a2d-48b1-467b-a412-d216290bd9187", "record_id": "flaws_cloudtrail:0000144:279346a2d-48b1-467b-a412-d216290bd9187", "row_index": 144, "timestamp": "2018-04-17T06:47:52Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 805, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "279346a2d-48b1-467b-a412-d216290bd9187", "eventTime": "2018-04-17T06:47:52Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e63c07e7-be3f-4145-98a9-2d439c3a693c", "record_id": "flaws_cloudtrail:0000145:e63c07e7-be3f-4145-98a9-2d439c3a693c", "row_index": 145, "timestamp": "2018-04-17T06:47:53Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e63c07e7-be3f-4145-98a9-2d439c3a693c", "eventTime": "2018-04-17T06:47:53Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "23ae3c2c-13e3-445b-bf75-edc84f4e61d8", "record_id": "flaws_cloudtrail:0000146:23ae3c2c-13e3-445b-bf75-edc84f4e61d8", "row_index": 146, "timestamp": "2018-04-17T06:47:53Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1270, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "23ae3c2c-13e3-445b-bf75-edc84f4e61d8", "eventTime": "2018-04-17T06:47:53Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-f5710223", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "aa718952a-4adc-4c18-9078-2ec49813aac", "record_id": "flaws_cloudtrail:0000147:aa718952a-4adc-4c18-9078-2ec49813aac", "row_index": 147, "timestamp": "2018-04-17T06:47:54Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1382, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "aa718952a-4adc-4c18-9078-2ec49813aac", "eventTime": "2018-04-17T06:47:54Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ca57294", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "787a8f7e-2dd0-4a86-a7e8-782f683c2c4f", "record_id": "flaws_cloudtrail:0000148:787a8f7e-2dd0-4a86-a7e8-782f683c2c4f", "row_index": 148, "timestamp": "2018-04-17T06:47:54Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 802, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "787a8f7e-2dd0-4a86-a7e8-782f683c2c4f", "eventTime": "2018-04-17T06:47:54Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "58592a7b-bd32-4fc5-98cd-db3251c6d520", "record_id": "flaws_cloudtrail:0000149:58592a7b-bd32-4fc5-98cd-db3251c6d520", "row_index": 149, "timestamp": "2018-04-17T06:47:54Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1375, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "58592a7b-bd32-4fc5-98cd-db3251c6d520", "eventTime": "2018-04-17T06:47:54Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ef6f0d3", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5591a894-7ad0-46cc-b127-67be23e05f17", "record_id": "flaws_cloudtrail:0000150:5591a894-7ad0-46cc-b127-67be23e05f17", "row_index": 150, "timestamp": "2018-04-17T06:47:54Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1376, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5591a894-7ad0-46cc-b127-67be23e05f17", "eventTime": "2018-04-17T06:47:54Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-f5710223", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "276ea04e-1d3b-4714-a502-8ccb388ebd30", "record_id": "flaws_cloudtrail:0000151:276ea04e-1d3b-4714-a502-8ccb388ebd30", "row_index": 151, "timestamp": "2018-04-17T06:47:55Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1269, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "276ea04e-1d3b-4714-a502-8ccb388ebd30", "eventTime": "2018-04-17T06:47:55Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-f5710223", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "14cce1e6-12be-497d-b384-932b6093f3f1", "record_id": "flaws_cloudtrail:0000152:14cce1e6-12be-497d-b384-932b6093f3f1", "row_index": 152, "timestamp": "2018-04-17T06:47:56Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1381, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "14cce1e6-12be-497d-b384-932b6093f3f1", "eventTime": "2018-04-17T06:47:56Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ca57294", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "26f39d51-99a5-4325-96d1-a09ea4ccf8a8", "record_id": "flaws_cloudtrail:0000153:26f39d51-99a5-4325-96d1-a09ea4ccf8a8", "row_index": 153, "timestamp": "2018-04-17T06:47:56Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "26f39d51-99a5-4325-96d1-a09ea4ccf8a8", "eventTime": "2018-04-17T06:47:56Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "57b96438-46c1-4aac-ae24-2eb54e3926a4", "record_id": "flaws_cloudtrail:0000154:57b96438-46c1-4aac-ae24-2eb54e3926a4", "row_index": 154, "timestamp": "2018-04-17T06:47:56Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 806, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "57b96438-46c1-4aac-ae24-2eb54e3926a4", "eventTime": "2018-04-17T06:47:56Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "70a007a5-7510-4329-b8f4-cfb463975eda2", "record_id": "flaws_cloudtrail:0000155:70a007a5-7510-4329-b8f4-cfb463975eda2", "row_index": 155, "timestamp": "2018-04-17T06:47:56Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 804, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "70a007a5-7510-4329-b8f4-cfb463975eda2", "eventTime": "2018-04-17T06:47:56Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a67da682-0607-4a9e-857a-4e7d74375126", "record_id": "flaws_cloudtrail:0000156:a67da682-0607-4a9e-857a-4e7d74375126", "row_index": 156, "timestamp": "2018-04-17T06:47:56Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1377, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a67da682-0607-4a9e-857a-4e7d74375126", "eventTime": "2018-04-17T06:47:56Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ef6f0d3", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "028d3625-0fb0-49f9-9800-36065ee23d40", "record_id": "flaws_cloudtrail:0000157:028d3625-0fb0-49f9-9800-36065ee23d40", "row_index": 157, "timestamp": "2018-04-17T06:47:56Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1926, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "028d3625-0fb0-49f9-9800-36065ee23d40", "eventTime": "2018-04-17T06:47:56Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: dVdqX5SRnhZafLZj1LAF_GKBwD7Ns2ULllT0MXNW6PScbqaLgkE8WF5oOpPzXEL1KUWQAREZCj8_jZGFlmRlgcrCvE9UbaRPPemZLVFt7ZpGCLkh6s9lNZB7Ql_aFrWh9RRvKKaTSYaTiQu6tilftRBZgXCri38ShTh1PhQqlh421BVCVv1gYe6lIrDMMywT0F4oSoveshcZkWG_QkPmsm5L_KGK-6HOtwxnYaTl6VUzQN9WGmZWFd5muSpzghWnei075vQImCungqqWtr2luUkDY5sQSj7s_uLbt_iLKH7A9iOJKAL8LMrnVtxF4hRjv1hFrreAubIxXTqbtI980V9I6zsEXQlWGa2JVBx-qc9e9RLcEPkoPC0dBKIoaYxnelu5YztSZ7HTohfvhjnS4Hp8b1oGHNn0wWRuil5APG6yLeSI_TyzLhZOzX9VQTvDybHA6-OUHyR02Mana9R4q07Zc5kRM79W6Cwqsh9X5z8up7iMccXa_9d-9AZlHXH0lfoBk7rxZ-cJfZMBiD_g3EQqF_W3SsnuD8dNs8fWcPJWE2osxKDYkRo8Dpn2xAtLQtM7c20W-CLJSjwA5k8Xgk_BnCcH6SZya2trXOrCY96bPeHo7S8GXO3Rd2J7lRXPvZk5iSaZrI4sWoM0THHyXUzQMMZOtMG9tw", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-f5710223", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "eac131227-9afe-4794-b1aa-24506448f187", "record_id": "flaws_cloudtrail:0000158:eac131227-9afe-4794-b1aa-24506448f187", "row_index": 158, "timestamp": "2018-04-17T06:47:57Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1383, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "eac131227-9afe-4794-b1aa-24506448f187", "eventTime": "2018-04-17T06:47:57Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ca57294", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "81969bf-2529-4c29-8f5a-04d1b106c3e8", "record_id": "flaws_cloudtrail:0000159:81969bf-2529-4c29-8f5a-04d1b106c3e8", "row_index": 159, "timestamp": "2018-04-17T06:47:57Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 912, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "81969bf-2529-4c29-8f5a-04d1b106c3e8", "eventTime": "2018-04-17T06:47:57Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2386eadf-76d2-40b5-839c-31e6a1f55f23", "record_id": "flaws_cloudtrail:0000160:2386eadf-76d2-40b5-839c-31e6a1f55f23", "row_index": 160, "timestamp": "2018-04-17T06:47:57Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1377, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2386eadf-76d2-40b5-839c-31e6a1f55f23", "eventTime": "2018-04-17T06:47:57Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ef6f0d3", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0e56728c-64a8-4354-a558-ad00ea4fa887", "record_id": "flaws_cloudtrail:0000161:0e56728c-64a8-4354-a558-ad00ea4fa887", "row_index": 161, "timestamp": "2018-04-17T06:47:58Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1935, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0e56728c-64a8-4354-a558-ad00ea4fa887", "eventTime": "2018-04-17T06:47:58Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: WOlD_fccjzKMoyH8WmuKkJL0xCFf9RYHDOEU3Inblgu_2mfdJAkuv5aBZeVCuxwtIKchsrnQKIkfjlnxdyqQg2mqfr0geIVM5BBc8MQaOyrNEeqIEX3Y4uU8cQBZyeT1MzEXvw4F0U-C6DXnXT8o5fTnSBy3ZF3CHx3oc00uYAraXMyDoHx3ZdWuNT-BdbrmfRorr3mz-9Hy31msmxe9bKSSgKRIdtTlPBg5hwWHEbfVv-EjnbKURI2UyPqWvyE3Bmzz5SARc4dagAw6WUKyutGmSaV-7rPJWroU7MRIH2-bnsXYon6yhOvR7PLfYzdQYUrg8jMU63R50PBHx9zL8yLeMbd7VjfLKgR-KJVDrRxPPS1kcsNLEb3ITQail6wJVcDHLzHKC2bpM-yLkVu7h9y5nguBFXfH4Og0MAd_sxXRiwugf-gOx_i_0NQ10LV8yIZnOoNGplud_9KABQWn2zKJe7y_jQGdXkVfeteKM87YVwRFn_jnS1nHa1s-FKDmVpmkZRCHOGm5WCW8g8wWGZVSocHpsYsmCBzSf3BP84mdZ9FOKem66honfD_C3ru7CD_LaUf1t_V9FZK3EChoQepuBa4agAmv8foa3KblI6qXHvbG2W4Y2q8J69S8jOOfjGiENuKFaY13iaU9B_GAZgMiwK2kaT_4H-_o8w", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ca57294", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2526a2b2-cd9b-4113-b924-249637e2a0f9b", "record_id": "flaws_cloudtrail:0000162:2526a2b2-cd9b-4113-b924-249637e2a0f9b", "row_index": 162, "timestamp": "2018-04-17T06:47:58Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1382, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2526a2b2-cd9b-4113-b924-249637e2a0f9b", "eventTime": "2018-04-17T06:47:58Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-14f2b3cc", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c6b052ab-df13-437e-8690-2ac168dfbca7", "record_id": "flaws_cloudtrail:0000163:c6b052ab-df13-437e-8690-2ac168dfbca7", "row_index": 163, "timestamp": "2018-04-17T06:47:58Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1376, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c6b052ab-df13-437e-8690-2ac168dfbca7", "eventTime": "2018-04-17T06:47:58Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-dc82b8b9", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4a4eebc6-cb1c-4840-a4bc-4ec2893f51f3", "record_id": "flaws_cloudtrail:0000164:4a4eebc6-cb1c-4840-a4bc-4ec2893f51f3", "row_index": 164, "timestamp": "2018-04-17T06:47:59Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1378, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4a4eebc6-cb1c-4840-a4bc-4ec2893f51f3", "eventTime": "2018-04-17T06:47:59Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-14f2b3cc", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e3b54cff-e1d6-4f0d-852d-9abe8f9e9204", "record_id": "flaws_cloudtrail:0000165:e3b54cff-e1d6-4f0d-852d-9abe8f9e9204", "row_index": 165, "timestamp": "2018-04-17T06:47:59Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1275, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e3b54cff-e1d6-4f0d-852d-9abe8f9e9204", "eventTime": "2018-04-17T06:47:59Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-14f2b3cc", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "767717a8c-62de-46fe-9308-9c60bca286ec", "record_id": "flaws_cloudtrail:0000166:767717a8c-62de-46fe-9308-9c60bca286ec", "row_index": 166, "timestamp": "2018-04-17T06:47:59Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 912, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "767717a8c-62de-46fe-9308-9c60bca286ec", "eventTime": "2018-04-17T06:47:59Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1bbee29f-c631-4843-9a42-d39d391bca0e", "record_id": "flaws_cloudtrail:0000167:1bbee29f-c631-4843-9a42-d39d391bca0e", "row_index": 167, "timestamp": "2018-04-17T06:47:59Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1921, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1bbee29f-c631-4843-9a42-d39d391bca0e", "eventTime": "2018-04-17T06:47:59Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: n8yEHIG2MiWuHkCqRgBwKWzGwPU185FKU3zx5mHHqEzeDo9oVAycJ1JgU7259ZDASiLXoAUR3ECv1F2lO4HGZUo0QGYfrdp636rDZqQXv6LFFpMTx_u7n5fICs-N2T8ILCIUd5vN6vRoQq-fs8Qal7M0Y3cmKq_Pouqyk1ds8tv0ZoeYOWkIHYclZAvsfp5C2IotW8slJKAXJ9zzwX4blwGdeDAAjUopzzBpROk3yyyQfAv4iAaP9T2yLlhWhYQDqMeC235C8zzo7DcxwMuTRlqZOxyWZfNYLXKHEP_goE-SGjrEpRqrAStTyp5pAD63_AyqEynqpTkSkGuqVCKJCQmf4FXWJiN_wqMSDm4nX1NYnOZRqUUIx4IRCBIkclc1dLtYU6YQXouXJnVIXzuDHM0MIoR6CLkhCIRGYoay1gDtDzyqTBSM_Z94XlDWmtlEVqIYGQEs-OlA-fxbGvqZXfyhgOvFx612JeUNHnfNwb7w-U66brMXtdYyzmqNj-Ee6bO_fLkEsnP58SzEdPNYHMdFQZKqece20InAQlhEQLnNwk8x9CMcwaOwvWt6VbmdNlQeg9PXIvFBy9nSTJvJIw4Dg66ojzQOkzREU5h88d9AMSDafgFTkFH3b0sfz_L_dXecRgUbQPAw7XL0amJ6JU0hhMfXP7HI", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ef6f0d3", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8675f409-d916-4d9f-8cf7-177e42e4f9ad", "record_id": "flaws_cloudtrail:0000168:8675f409-d916-4d9f-8cf7-177e42e4f9ad", "row_index": 168, "timestamp": "2018-04-17T06:48:00Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 913, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8675f409-d916-4d9f-8cf7-177e42e4f9ad", "eventTime": "2018-04-17T06:48:00Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "055946a6-65d7-4d00-b2f3-8cdbb3787e6e", "record_id": "flaws_cloudtrail:0000169:055946a6-65d7-4d00-b2f3-8cdbb3787e6e", "row_index": 169, "timestamp": "2018-04-17T06:48:00Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1376, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "055946a6-65d7-4d00-b2f3-8cdbb3787e6e", "eventTime": "2018-04-17T06:48:00Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-dc82b8b9", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6eeb4377-1573-4a93-9245-81a8b537f26a", "record_id": "flaws_cloudtrail:0000170:6eeb4377-1573-4a93-9245-81a8b537f26a", "row_index": 170, "timestamp": "2018-04-17T06:48:02Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1270, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6eeb4377-1573-4a93-9245-81a8b537f26a", "eventTime": "2018-04-17T06:48:02Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-dc82b8b9", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "566775-66d3-416a-87db-b24c86bda3a2", "record_id": "flaws_cloudtrail:0000171:566775-66d3-416a-87db-b24c86bda3a2", "row_index": 171, "timestamp": "2018-04-17T06:48:03Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 804, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "566775-66d3-416a-87db-b24c86bda3a2", "eventTime": "2018-04-17T06:48:03Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2f8e8016-b0f3-42b0-8417-d8e2c222935e", "record_id": "flaws_cloudtrail:0000172:2f8e8016-b0f3-42b0-8417-d8e2c222935e", "row_index": 172, "timestamp": "2018-04-17T06:48:04Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1935, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2f8e8016-b0f3-42b0-8417-d8e2c222935e", "eventTime": "2018-04-17T06:48:04Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: oCvVET26ZfF2sUOwNPZ-YiyFKOYuSdGgMIPuuF9D8VDqyo0ceF9mo8S1-07XiCvqIrgVtOCkbg8KCJM0eHNR0B_S4CqQwDK2w3j7IBWl1K3cTiU6HRRA-Qai0hgdcWBpOUeLH93PVJwjh8WEoCsyHBGk6A2xKYOkFZ50V2EJUrW5YaVfzjscxpmxo91TbVnb9VW04l_j9wjlnqCSAvHMUhOjdt1xQHT0AgakKusu-KvrmR2k_shx79u6mUsWSmiPVd0-RdubJY1z49I2bLas5bl1tUzXtsJsfd1MNckpbNQ9nZMZcysFBQQvEG57IfL7gia0mAu4Xhmf2THWxBK0DnOxaYiphD8qDAX0nWGIlJqB0c7xRquzPkdA0YDk7TNuxJ9POZkWk7zVnsbAqu9yi4GN5Sf3yjxEA3ofGpXh7GVTvR9-GZO46NAM12QQUG-uoeOtj5bpl-tnDxvbjr_HmuIF08SVO8sMoEYTGsSOvZnXeArN2Cwgw_r-uDR19odjwqmudRoM169UQJbcjHPvU5K9hAiknMtkuquWP4yFsjOhXx56KHC6b1GBe2RnHmqFgopmdffOAitBQM8fU3GGqTjU-8NOSlOWS4Lf-BlSqJ3DAJuJzrmppKSSCPuQh1byYt5WSbKnwC823dedtO-_UsNpgptQjFDz5mlA5w", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-14f2b3cc", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bce6a5ef-cd30-4879-b2a5-56c98dd2409f", "record_id": "flaws_cloudtrail:0000173:bce6a5ef-cd30-4879-b2a5-56c98dd2409f", "row_index": 173, "timestamp": "2018-04-17T06:48:04Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 806, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bce6a5ef-cd30-4879-b2a5-56c98dd2409f", "eventTime": "2018-04-17T06:48:04Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a2697e1b-ef2f-45ce-81ae-fc11bffeb6bd", "record_id": "flaws_cloudtrail:0000174:a2697e1b-ef2f-45ce-81ae-fc11bffeb6bd", "row_index": 174, "timestamp": "2018-04-17T06:48:04Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1924, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a2697e1b-ef2f-45ce-81ae-fc11bffeb6bd", "eventTime": "2018-04-17T06:48:04Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: IH1dgE1gDfLymYsB1GNO66CEf89bgNPL7gg4BHElLT_h279yCNCZR-po36wDjKROL2TBPGp6jB6WfiAv6MWcuoFHOTD3nyGEn_vx7Ga4uqMA0OtS4YkqkjQm41nE7X_lF6U5zmVI0IqRug7rsoD9aTDOWCPz5tjrhdAe-Dy4ijBflBkGn8Bg02BDRbCbdnOYwqrfswawbjavdgRORbHy3kwwUSXF0HaTTPNBZNefI7wkzfUQ1IV6o_akKfwwzNTXxTVwYnp59_h3D2FtV78pnSOQMWduH5R5VaeN1PTkGT1LZNya1OdwM62yuaK8D-_ZbRRaDseifkGDbXk0PaTzxWKSkIHNKJnFMjtvm3Gf3lkf-y9lNfrtG4mixdhnvRUtrK8G8ifXtnALb5g95Eo8Xpf40sATD9xMGQigSJD4JTvZex-Mo8i9EHPRhUqx9e0IUdHUhiaYvHaMzTKIPD-4siotUqG3zrIft2yN6ObDCHSrvOyCMHLcqEE-vomYWEVvsPiSVoqrjFo7B2IiTkfuFMiGln9gUPZpTh87DYki_6j7PBI2NsFJ9JostCryBaqex_qz74Ct_rstQcUTR6zt6RdmfWOe1pAi0InFN4LzL9lcK2FrqsMj523KglPfOPJKEavVgkK9S-8c8A_micbf0gSSiRVy8Pcg", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-dc82b8b9", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8e8ccf0f-1bfe-4cf3-a12a-8231c2c9cb80", "record_id": "flaws_cloudtrail:0000175:8e8ccf0f-1bfe-4cf3-a12a-8231c2c9cb80", "row_index": 175, "timestamp": "2018-04-17T06:48:05Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8e8ccf0f-1bfe-4cf3-a12a-8231c2c9cb80", "eventTime": "2018-04-17T06:48:05Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cf22f6a8-6ae8-4ffa-a8c9-92a343c8f234", "record_id": "flaws_cloudtrail:0000176:cf22f6a8-6ae8-4ffa-a8c9-92a343c8f234", "row_index": 176, "timestamp": "2018-04-17T06:48:05Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 806, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cf22f6a8-6ae8-4ffa-a8c9-92a343c8f234", "eventTime": "2018-04-17T06:48:05Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "817033-3cac-45e8-8eca-2a4cd8b63c11", "record_id": "flaws_cloudtrail:0000177:817033-3cac-45e8-8eca-2a4cd8b63c11", "row_index": 177, "timestamp": "2018-04-17T06:48:05Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 904, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "817033-3cac-45e8-8eca-2a4cd8b63c11", "eventTime": "2018-04-17T06:48:05Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "09164e0-652e-4c9f-8da8-3d45f3d6b1d0", "record_id": "flaws_cloudtrail:0000178:09164e0-652e-4c9f-8da8-3d45f3d6b1d0", "row_index": 178, "timestamp": "2018-04-17T06:48:06Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1378, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "09164e0-652e-4c9f-8da8-3d45f3d6b1d0", "eventTime": "2018-04-17T06:48:06Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-bbcb674a", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4eff9862-6db8-4af3-8bb5-01e74b5fbb4a", "record_id": "flaws_cloudtrail:0000179:4eff9862-6db8-4af3-8bb5-01e74b5fbb4a", "row_index": 179, "timestamp": "2018-04-17T06:48:06Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 908, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4eff9862-6db8-4af3-8bb5-01e74b5fbb4a", "eventTime": "2018-04-17T06:48:06Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "30461c19-82c6-4fa6-8e32-e24edf3cbdc2", "record_id": "flaws_cloudtrail:0000180:30461c19-82c6-4fa6-8e32-e24edf3cbdc2", "row_index": 180, "timestamp": "2018-04-17T06:48:07Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 809, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "30461c19-82c6-4fa6-8e32-e24edf3cbdc2", "eventTime": "2018-04-17T06:48:07Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "88accdf5-9edd-472d-a1f9-2ffc295561", "record_id": "flaws_cloudtrail:0000181:88accdf5-9edd-472d-a1f9-2ffc295561", "row_index": 181, "timestamp": "2018-04-17T06:48:07Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1376, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "88accdf5-9edd-472d-a1f9-2ffc295561", "eventTime": "2018-04-17T06:48:07Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-bbcb674a", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "be67fed3-edee-4906-ab3d-aee54943ef41", "record_id": "flaws_cloudtrail:0000182:be67fed3-edee-4906-ab3d-aee54943ef41", "row_index": 182, "timestamp": "2018-04-17T06:48:08Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "be67fed3-edee-4906-ab3d-aee54943ef41", "eventTime": "2018-04-17T06:48:08Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ced905b3-b322-490a-bca7-b8d87c9750ca", "record_id": "flaws_cloudtrail:0000183:ced905b3-b322-490a-bca7-b8d87c9750ca", "row_index": 183, "timestamp": "2018-04-17T06:48:09Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1273, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ced905b3-b322-490a-bca7-b8d87c9750ca", "eventTime": "2018-04-17T06:48:09Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-bbcb674a", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "91022d27-1740-4644-a4f9-e444ebd59f34", "record_id": "flaws_cloudtrail:0000184:91022d27-1740-4644-a4f9-e444ebd59f34", "row_index": 184, "timestamp": "2018-04-17T06:48:09Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "91022d27-1740-4644-a4f9-e444ebd59f34", "eventTime": "2018-04-17T06:48:09Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d570d55f-2410-4144-a8b5-a2756f1a3e30", "record_id": "flaws_cloudtrail:0000185:d570d55f-2410-4144-a8b5-a2756f1a3e30", "row_index": 185, "timestamp": "2018-04-17T06:48:10Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1930, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d570d55f-2410-4144-a8b5-a2756f1a3e30", "eventTime": "2018-04-17T06:48:10Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: qIcyRasR4cauSByaoeXTupsj50VdJxLf0WX1qQdg4_Pe_OhhixDRq2A8dDcWXAN7-O9qxk7XflLU7-WomguiqCMP0N_O1XSD4ihXjGbrZBhSW3c4qWyAKw5RjaSu0yaP1MJqDTbgMt8ow4eKdHoj0FainI5BLglCXL6GXTHlr-oFjk-eMazAlcyOC9cJdsyXY7RkzqS69C5JBhG5PnvbwgYfZqivW6SZPJ1PvkstZ-b8ovDX2dRjZPA9_PjieeCa0UxKZv1SQ2K03vCAl69zclw8H4Zj8t8AVJtVmPCPATAbfiDlAcAXg0FJlHctvLGDEqiGQ7WH8mRfLfWdNIs48VPuNb-GSLA9Gc32RmlNAPGEQFxFaSxNwV_vBPXPZqMeiOj-6bxLnVLGRQ2csQ28ReH_Wt5F7kqJCTYWvU5mOnT2eouiSVsjfwAm3rQ5PTkSd-89r_raOXHmg_w_rVF1h_QsTeGc0hltZJKQfa-72Ry-aicBh6AA_Z-SRzXFfzwpU7nb9UP_icnwJaC4_6Jl3xwvEBIHNLk4Th26zgjlH3E0Rs8-J1xC1YM_9nnqH0AnXNfHtBRv_aCXCABAeOFEW8JuRGFp2yKO1Nc2V8HShSI7JHUm7QW0wNyn9GtrpiTXRdXHKgVsjkkLbgv7JfzRTZoOy8WYU0xfdNg", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-bbcb674a", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5a18fce6-b9a0-4602-95d9-9538b6092ba6", "record_id": "flaws_cloudtrail:0000186:5a18fce6-b9a0-4602-95d9-9538b6092ba6", "row_index": 186, "timestamp": "2018-04-17T06:48:10Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5a18fce6-b9a0-4602-95d9-9538b6092ba6", "eventTime": "2018-04-17T06:48:10Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f2a4d60c-0b58-48f3-9ef8-8a9076bf2504", "record_id": "flaws_cloudtrail:0000187:f2a4d60c-0b58-48f3-9ef8-8a9076bf2504", "row_index": 187, "timestamp": "2018-04-17T06:48:11Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f2a4d60c-0b58-48f3-9ef8-8a9076bf2504", "eventTime": "2018-04-17T06:48:11Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8f162e71-c40b-4b3d-b56b-2d9f8b8736e4", "record_id": "flaws_cloudtrail:0000188:8f162e71-c40b-4b3d-b56b-2d9f8b8736e4", "row_index": 188, "timestamp": "2018-04-17T06:48:11Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8f162e71-c40b-4b3d-b56b-2d9f8b8736e4", "eventTime": "2018-04-17T06:48:11Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c40bc01a-b1dd-447b-845b-aeaf7f0040f1", "record_id": "flaws_cloudtrail:0000189:c40bc01a-b1dd-447b-845b-aeaf7f0040f1", "row_index": 189, "timestamp": "2018-04-17T06:48:11Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c40bc01a-b1dd-447b-845b-aeaf7f0040f1", "eventTime": "2018-04-17T06:48:11Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f7fa3f31-cf42-4566-a43a-adb1e03aa887", "record_id": "flaws_cloudtrail:0000190:f7fa3f31-cf42-4566-a43a-adb1e03aa887", "row_index": 190, "timestamp": "2018-04-17T06:48:12Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f7fa3f31-cf42-4566-a43a-adb1e03aa887", "eventTime": "2018-04-17T06:48:12Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "66bc0a5d-1229-4ca6-bc34-45eb95c1c3be", "record_id": "flaws_cloudtrail:0000191:66bc0a5d-1229-4ca6-bc34-45eb95c1c3be", "row_index": 191, "timestamp": "2018-04-17T06:48:12Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "66bc0a5d-1229-4ca6-bc34-45eb95c1c3be", "eventTime": "2018-04-17T06:48:12Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "463d9fd7-88ec-4b7f-818e-7b92d8e96a93", "record_id": "flaws_cloudtrail:0000192:463d9fd7-88ec-4b7f-818e-7b92d8e96a93", "row_index": 192, "timestamp": "2018-04-17T06:48:12Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1376, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "463d9fd7-88ec-4b7f-818e-7b92d8e96a93", "eventTime": "2018-04-17T06:48:12Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-009dc204", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "137d2ed0-053f-49c9-a781-ff2d7204d667", "record_id": "flaws_cloudtrail:0000193:137d2ed0-053f-49c9-a781-ff2d7204d667", "row_index": 193, "timestamp": "2018-04-17T06:48:13Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1381, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "137d2ed0-053f-49c9-a781-ff2d7204d667", "eventTime": "2018-04-17T06:48:13Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-02d34bac", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fca56ec7-f7f0-45e6-aebd-ded54392c601", "record_id": "flaws_cloudtrail:0000194:fca56ec7-f7f0-45e6-aebd-ded54392c601", "row_index": 194, "timestamp": "2018-04-17T06:48:13Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1376, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fca56ec7-f7f0-45e6-aebd-ded54392c601", "eventTime": "2018-04-17T06:48:13Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-009dc204", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "089e798b-197d-40b3-ba4a-6e71800c22a7", "record_id": "flaws_cloudtrail:0000195:089e798b-197d-40b3-ba4a-6e71800c22a7", "row_index": 195, "timestamp": "2018-04-17T06:48:14Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1381, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "089e798b-197d-40b3-ba4a-6e71800c22a7", "eventTime": "2018-04-17T06:48:14Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-02d34bac", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "61c787ba-981c-4e74-ab2c-2b80e083b546", "record_id": "flaws_cloudtrail:0000196:61c787ba-981c-4e74-ab2c-2b80e083b546", "row_index": 196, "timestamp": "2018-04-17T06:48:14Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "61c787ba-981c-4e74-ab2c-2b80e083b546", "eventTime": "2018-04-17T06:48:14Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b98cc26e-399f-46d8-a658-a0bc973fa1b3", "record_id": "flaws_cloudtrail:0000197:b98cc26e-399f-46d8-a658-a0bc973fa1b3", "row_index": 197, "timestamp": "2018-04-17T06:48:14Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1377, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b98cc26e-399f-46d8-a658-a0bc973fa1b3", "eventTime": "2018-04-17T06:48:14Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-009dc204", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9fc54b60-fd5b-42b4-adc7-8813e103fd58", "record_id": "flaws_cloudtrail:0000198:9fc54b60-fd5b-42b4-adc7-8813e103fd58", "row_index": 198, "timestamp": "2018-04-17T06:48:15Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9fc54b60-fd5b-42b4-adc7-8813e103fd58", "eventTime": "2018-04-17T06:48:15Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9cd55b92-4b71-436a-b45b-bacbc9a478ba", "record_id": "flaws_cloudtrail:0000199:9cd55b92-4b71-436a-b45b-bacbc9a478ba", "row_index": 199, "timestamp": "2018-04-17T06:48:15Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1926, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9cd55b92-4b71-436a-b45b-bacbc9a478ba", "eventTime": "2018-04-17T06:48:15Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: q-ux-ZXR39cc2UZnLn-KR6diMOPl_YnPTnGiMPeayb9Alz972VvCIad91gdigAlTowLS4flIgq2xHUyBgG9dvZCXRSc3xh4q1i1ju5sQ8xA8Ce_Eyn9268_f6TfTiVDm3Y-QBkR-Jz-W9gVak4mQmeQqYTvLWaj9uVHnwMKaXNJoyzAsoEDcjo863PsPUkBmX0R8L4tvLY6kLhRPG_sDerepuaMNR2eDnfyKQVKeb51VwXXUFh0ir938_TVdUEzW-Gjm4JdBC3NkuWRAYC-gDw8SUXVa1xKHzTzgIAHgUFKTCZMgrpyn7KBlBuqDhv_AS7N-gT_5HjrEDG2VXuVVgD3iXZ5vS2CuCFo09Vc5Kb8AkDtb7Qgi-xJGo3qwyxnkQY-S4PvacXFBKxK1HqyEVK_shDBIlwqR9u69vMgTeDI4Hy0NkKsrynKrYuWQA5o1yFhOSuE3Ag0TC3UXRVTkejAj_61duJdJFfcL8gqv3K2MF_OudsKw7b7hQ6B93iEvflmyViokPoGI92vILcp388R_BQLl3pVFetSRAc9NyhAYdmtSQDEUA_oMnWUd8BYM9Qw8F1OP6e9-hrwjhczy8Uqe3Elae4ZIotevxEmR5NNTKuy2Nwt-nEb1CfQVGs_IpZOZ_H9eccm3GVM7ikvbx33GYsSga3VbTQ", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-009dc204", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d08424e4-847f-4e01-8544-cb1354a921664", "record_id": "flaws_cloudtrail:0000200:d08424e4-847f-4e01-8544-cb1354a921664", "row_index": 200, "timestamp": "2018-04-17T06:48:16Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 802, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d08424e4-847f-4e01-8544-cb1354a921664", "eventTime": "2018-04-17T06:48:16Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b09d4850-7698-4acd-9428-3ebdecb908c2", "record_id": "flaws_cloudtrail:0000201:b09d4850-7698-4acd-9428-3ebdecb908c2", "row_index": 201, "timestamp": "2018-04-17T06:48:16Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1382, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b09d4850-7698-4acd-9428-3ebdecb908c2", "eventTime": "2018-04-17T06:48:16Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-02d34bac", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "556dbc6c-419a-486b-a2d8-b842823abd991", "record_id": "flaws_cloudtrail:0000202:556dbc6c-419a-486b-a2d8-b842823abd991", "row_index": 202, "timestamp": "2018-04-17T06:48:16Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 912, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "556dbc6c-419a-486b-a2d8-b842823abd991", "eventTime": "2018-04-17T06:48:16Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c32939ee-6cd5-4aee-891f-1422c40f790e", "record_id": "flaws_cloudtrail:0000203:c32939ee-6cd5-4aee-891f-1422c40f790e", "row_index": 203, "timestamp": "2018-04-17T06:48:17Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 804, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c32939ee-6cd5-4aee-891f-1422c40f790e", "eventTime": "2018-04-17T06:48:17Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a276a7b9-4d65-4eb4-9261-477d2d516294d", "record_id": "flaws_cloudtrail:0000204:a276a7b9-4d65-4eb4-9261-477d2d516294d", "row_index": 204, "timestamp": "2018-04-17T06:48:17Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1382, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a276a7b9-4d65-4eb4-9261-477d2d516294d", "eventTime": "2018-04-17T06:48:17Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-546ae567", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "121cf564-009b-422a-a33b-acc04e857d68", "record_id": "flaws_cloudtrail:0000205:121cf564-009b-422a-a33b-acc04e857d68", "row_index": 205, "timestamp": "2018-04-17T06:48:17Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "121cf564-009b-422a-a33b-acc04e857d68", "eventTime": "2018-04-17T06:48:17Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fc0b8f93-7a55-438b-9e59-76d7dd911175d", "record_id": "flaws_cloudtrail:0000206:fc0b8f93-7a55-438b-9e59-76d7dd911175d", "row_index": 206, "timestamp": "2018-04-17T06:48:18Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1937, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fc0b8f93-7a55-438b-9e59-76d7dd911175d", "eventTime": "2018-04-17T06:48:18Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: u3EPDK5KvcDmY3-ry6rGOf9gH_bX8YyuYWo-Ud09fzX8vYfjjPifWoZwG4j7MCEROLwceRmGwrRbgYYlawXDyiBurIalvMjmuw_wxh6LpTbkgri1XWWBhdeiEPFRPcPGZvf7LAoh5Vd_qGceSr2VHKgVC-1dfGBkKIbIe0u24QrUkawJos9W56e66qz2cr-zoeJIIMNknSZ_AFHlCeRSzNmGNS5iCs9ZZX2Qc2MY6D_XNCXJK-nUEVmDhoRGL-HkWsZU82d7-SWNDvitxb1X0dmlj56CjdIb6-2mL-84gtS9C2v5tyjj6XCcx8Dgvf5nBLDIwwTmY_EdFa0oamavgw_eSFEUxdAwY-G3x_v_77LpbrDuc2hH4xebkSEhWOlP59NY0F3wEYt3zL0sJTP61EIFxsgbNdXLOt8CMQkwGEc2s3ceLFIH3yMRkgK0UB3KFLgdOw2vE3E6VxgS4sbPqpg0NfGUS7ARXwgGb5UxAvAu3mGnvJ8B3xXDDQEvz6hzNpkq3u8xtf8W2K10O8jjSQ4ve6v6ExTTtBheSRK-_GxBwUxOojZg5bDtCWjeLVLCe0HvSFrO3Q2qJ-RjO_NhsYATqd-bdKcmDH4dlEzhXPC7EzTsYPltEF-Y_R_12Yq8Ho4xOENv_Tn-F7b7-NLv6j8qIBm_YmcOmpyXG0k", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-02d34bac", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "10868-c84c-407f-9d2c-9edcd3b1b763", "record_id": "flaws_cloudtrail:0000207:10868-c84c-407f-9d2c-9edcd3b1b763", "row_index": 207, "timestamp": "2018-04-17T06:48:18Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1373, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "10868-c84c-407f-9d2c-9edcd3b1b763", "eventTime": "2018-04-17T06:48:18Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-71cdc376", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e2ec78b0-2480-4361-a4b3-9b9faa2ba3ff", "record_id": "flaws_cloudtrail:0000208:e2ec78b0-2480-4361-a4b3-9b9faa2ba3ff", "row_index": 208, "timestamp": "2018-04-17T06:48:19Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 804, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e2ec78b0-2480-4361-a4b3-9b9faa2ba3ff", "eventTime": "2018-04-17T06:48:19Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d8031f70-1398-4eb2-a51a-809e724b8987", "record_id": "flaws_cloudtrail:0000209:d8031f70-1398-4eb2-a51a-809e724b8987", "row_index": 209, "timestamp": "2018-04-17T06:48:19Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 908, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d8031f70-1398-4eb2-a51a-809e724b8987", "eventTime": "2018-04-17T06:48:19Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "abbc9d7a-dd75-40b0-8ce1-afffd5fc5bd0", "record_id": "flaws_cloudtrail:0000210:abbc9d7a-dd75-40b0-8ce1-afffd5fc5bd0", "row_index": 210, "timestamp": "2018-04-17T06:48:20Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 1377, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "abbc9d7a-dd75-40b0-8ce1-afffd5fc5bd0", "eventTime": "2018-04-17T06:48:20Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-8c971d21", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "697d86d7-b7e7-4c53-925a-6d002ad6f448", "record_id": "flaws_cloudtrail:0000211:697d86d7-b7e7-4c53-925a-6d002ad6f448", "row_index": 211, "timestamp": "2018-04-17T06:48:20Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 805, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "697d86d7-b7e7-4c53-925a-6d002ad6f448", "eventTime": "2018-04-17T06:48:20Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ddc2c235-fa39-4a34-a885-465d2290e467", "record_id": "flaws_cloudtrail:0000212:ddc2c235-fa39-4a34-a885-465d2290e467", "row_index": 212, "timestamp": "2018-04-17T06:48:20Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1376, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ddc2c235-fa39-4a34-a885-465d2290e467", "eventTime": "2018-04-17T06:48:20Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-71cdc376", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ee537f0d-2092-4d8b-b9f7-5a609b82966", "record_id": "flaws_cloudtrail:0000213:ee537f0d-2092-4d8b-b9f7-5a609b82966", "row_index": 213, "timestamp": "2018-04-17T06:48:21Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1379, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ee537f0d-2092-4d8b-b9f7-5a609b82966", "eventTime": "2018-04-17T06:48:21Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-546ae567", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fbd4b73c-28ce-42c4-88d2-e186834b2fe", "record_id": "flaws_cloudtrail:0000214:fbd4b73c-28ce-42c4-88d2-e186834b2fe", "row_index": 214, "timestamp": "2018-04-17T06:48:22Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 1376, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fbd4b73c-28ce-42c4-88d2-e186834b2fe", "eventTime": "2018-04-17T06:48:22Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-8c971d21", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1f32075-518c-4844-812c-83a8c1399358", "record_id": "flaws_cloudtrail:0000215:1f32075-518c-4844-812c-83a8c1399358", "row_index": 215, "timestamp": "2018-04-17T06:48:22Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1273, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1f32075-518c-4844-812c-83a8c1399358", "eventTime": "2018-04-17T06:48:22Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-546ae567", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9a6a35f6-0fd6-4609-8b3c-a9751d47a148", "record_id": "flaws_cloudtrail:0000216:9a6a35f6-0fd6-4609-8b3c-a9751d47a148", "row_index": 216, "timestamp": "2018-04-17T06:48:22Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 806, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9a6a35f6-0fd6-4609-8b3c-a9751d47a148", "eventTime": "2018-04-17T06:48:22Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bb2fa805-e656-49ac-9bea-f8270eed4133", "record_id": "flaws_cloudtrail:0000217:bb2fa805-e656-49ac-9bea-f8270eed4133", "row_index": 217, "timestamp": "2018-04-17T06:48:23Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 1271, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bb2fa805-e656-49ac-9bea-f8270eed4133", "eventTime": "2018-04-17T06:48:23Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-8c971d21", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "defb6734-0e2e-42b0-b6a5-f0b058ab9899", "record_id": "flaws_cloudtrail:0000218:defb6734-0e2e-42b0-b6a5-f0b058ab9899", "row_index": 218, "timestamp": "2018-04-17T06:48:23Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 806, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "defb6734-0e2e-42b0-b6a5-f0b058ab9899", "eventTime": "2018-04-17T06:48:23Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7e4e1638-d94b-4946-ac6e-e926c7ae6d88", "record_id": "flaws_cloudtrail:0000219:7e4e1638-d94b-4946-ac6e-e926c7ae6d88", "row_index": 219, "timestamp": "2018-04-17T06:48:23Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7e4e1638-d94b-4946-ac6e-e926c7ae6d88", "eventTime": "2018-04-17T06:48:23Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6c0b5201-7e9c-43ba-91d0-3ba6639c6850", "record_id": "flaws_cloudtrail:0000220:6c0b5201-7e9c-43ba-91d0-3ba6639c6850", "row_index": 220, "timestamp": "2018-04-17T06:48:23Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1270, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6c0b5201-7e9c-43ba-91d0-3ba6639c6850", "eventTime": "2018-04-17T06:48:23Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-71cdc376", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "86b82e79-ea4a-40ef-81c5-f3c744ec2248", "record_id": "flaws_cloudtrail:0000221:86b82e79-ea4a-40ef-81c5-f3c744ec2248", "row_index": 221, "timestamp": "2018-04-17T06:48:24Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1380, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "86b82e79-ea4a-40ef-81c5-f3c744ec2248", "eventTime": "2018-04-17T06:48:24Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-d10c94e9", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bd2155c6-4e59-4032-85ac-6ecba29c0d4d", "record_id": "flaws_cloudtrail:0000222:bd2155c6-4e59-4032-85ac-6ecba29c0d4d", "row_index": 222, "timestamp": "2018-04-17T06:48:24Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bd2155c6-4e59-4032-85ac-6ecba29c0d4d", "eventTime": "2018-04-17T06:48:24Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ae73f2f6-3437-4979-8df6-47f5afa8a26d", "record_id": "flaws_cloudtrail:0000223:ae73f2f6-3437-4979-8df6-47f5afa8a26d", "row_index": 223, "timestamp": "2018-04-17T06:48:24Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ae73f2f6-3437-4979-8df6-47f5afa8a26d", "eventTime": "2018-04-17T06:48:24Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "010654d72-78a4-4379-9487-14ed826e8b96", "record_id": "flaws_cloudtrail:0000224:010654d72-78a4-4379-9487-14ed826e8b96", "row_index": 224, "timestamp": "2018-04-17T06:48:24Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1927, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "010654d72-78a4-4379-9487-14ed826e8b96", "eventTime": "2018-04-17T06:48:24Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: y6lFFDlMSPXawJt0I-_zAof3QP7WbGcSU9cWvCy3aLO-84BmYFHkwqM4R2vdg7mxnIEoipgwJqT4m3Hj1Qg0gn0Va6pSdMq1cyABxktaIF3mL2NeJGEEyPgZZ4YEDETTJsWDQtDSbSkVNo4vVCKxuR_neVIwfs1zV7JecCdwX4KIoIEMSiBlOGTLGbo8SD0-8sB408tjKQIB1PyfEicOLBo3GBCrqwftS8-nmT8Xw9hGOeqklvYkRjKdYx7NkUKjELmI6lZg3zsSiibvdqiNFNHqSgEMwyurGcGVJDqpr96J--0M1E75405FXb8T_VfN8k5cow7EbFcMeWoXNN8t6amS5J3G5pnKCEIorkEkmttgXsQlnLmcMDsTTAOVeFU2nR7vmS-6aBOrEtrE3-h3U2ni6G0Myt2j60fYdde-cyVjVjHt3Sm9nnygDz3W54oDPY2P3Y_9l27nnaT-ieVxXUQsumPhYHemZPmsoS-5PoWbh_UdMo8iHlqkL6r5r5FHFnCe2Uy1MNPMd2zEYgR62cr6j7_rZEf0ROEY9_-jDk9a9OD0U-Mger0zISZQfDGd7w6T-TNWd7jF4bvS8lHFmy5q8C_O3_gU4lOkRLgAJwiVTDxRa_qFEQbXxdKLAd-lFr0S_vi0siZ_E63Yt05JCR-7SD_n7dEDVg", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-71cdc376", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5dc5b1e1-3779-4d9a-83d5-fce0369aee0a", "record_id": "flaws_cloudtrail:0000225:5dc5b1e1-3779-4d9a-83d5-fce0369aee0a", "row_index": 225, "timestamp": "2018-04-17T06:48:25Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 1928, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5dc5b1e1-3779-4d9a-83d5-fce0369aee0a", "eventTime": "2018-04-17T06:48:25Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: nXVm5yGAKD5wX5qEtLHYBYudIMfox4U4wCPuLixGnfPWTpChWU6z8LtelR9qMvZFEppfLg_A7CKrmNGUjuLjw2G_ghgu10Q_D_lzxyQX12QBDLarTn7CJ-6Bo-cWq7q6TxqoclhwiXLPqzgVEGniFlxFy8fB0PjMYO1t-Ufz74lyx4yMqD5Uzo8muI_ABokD1hwhhYQ_7RBzhjdgDkQFH67GLcsoa3LWu1qCS5ybfwKTpaMSg8Oz4pL4J2Y1vAABYTAQKSe4uedvOhAFn5Kjm_IdacruBWpNDkqYbQuACDCt5D6cAYmDWqfPxaQijMkRN3GJcwi7LegokjCnw0orT5nMsWkUaAQNfKUlG5Ph8EVukezkBFedXWFzseIiSkO5IR5bAgqz50zcrGS4EHygmTtDmWIwMM78oLYOXUwholiYJax5NDAHsKxMafL9WIOmHRIauhpwwrfo_ozyVgnv-ON4-a6LpHytWmlTKy1M1Yfxsi-lDxSFLd-nkJ6odToGYKfbK102jxRDgNeA5o8D6Uai0hoKR8XsbE7kvkmdJT6ddnc2iTOxrE4Ln-vwk57mMLsQ_C1U2ubRrvX3056U4nEXxy76TZQoehVPoFN9AlSNiKo52L3s1RXZAC5H6oVu_EWptLygY_1IX24yN9IqgVojm7HTebIkQy4", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-8c971d21", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "835f3523-18b5-4303-b8c6-28e1d4bcc85b", "record_id": "flaws_cloudtrail:0000226:835f3523-18b5-4303-b8c6-28e1d4bcc85b", "row_index": 226, "timestamp": "2018-04-17T06:48:25Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1936, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "835f3523-18b5-4303-b8c6-28e1d4bcc85b", "eventTime": "2018-04-17T06:48:25Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: j1b_VzYXgEJh3cjf-fyZDD0ZrL1FYcjTc79WzhZPD3FbgH0rKg2ABE4_UwtyAa5YLnOVGKCegy1Ao7HsGK1XHKa7W8ihwvvH_Qrjtopv6gCDiJhw8NciTDE14o8Fz6IjjO0R0ysLvv2AUQ1CH-EYB3CjRoyg9soaY6adxbpQ-CBK78Rt5ZWLdykNORu65K427RBq0ydQarTq3XsJ08P2_6ws2jl84X7N_X889KAPdBD-VhMeWGQsCMZBTK8ED08wba5gtehDW-vAfV811k2WX7VukSFG775cO7fy8DMU1-jiDWPpwsRl60X9uqM5ZrFiiOnZmrfPvIo9us-dX1CWbGhmOtr3PZmhfy1mjWOUz9Px_Q8xz7VaR97tHWg6JLBZMCXpJq6ce8BykY72XigaZJXQUzvmZdZ1hCfCnryfjSIsATL5MQ_auOJ8TQi1GjYjEnG58Xp77NRcfPoOhd8HOFpx63AjyvJzQh5nTh0edIVG9VOnKy-wb4pCYWGV-FohfMD0dOq1snifrKBaRT437eo_dK-HJpuJMSBD-u54iBs30BPmRXYPS5vn06IW5_nN7pH5q1_obajWsLQdrpGboFPdUiam8vVBfupMnC9cC0cXFlYYGnw0LwLtTxhFvyAxRH-NGR0Ob789T-UVcBEKqkecVLNd6t_vHeIb870", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-546ae567", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "52a61982-3555-44f2-936e-661936e9cc5a", "record_id": "flaws_cloudtrail:0000227:52a61982-3555-44f2-936e-661936e9cc5a", "row_index": 227, "timestamp": "2018-04-17T06:48:25Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1376, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "52a61982-3555-44f2-936e-661936e9cc5a", "eventTime": "2018-04-17T06:48:25Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-d10c94e9", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "37525c53-6bba-40f2-8148-877a51b0e1da", "record_id": "flaws_cloudtrail:0000228:37525c53-6bba-40f2-8148-877a51b0e1da", "row_index": 228, "timestamp": "2018-04-17T06:48:26Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1376, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "37525c53-6bba-40f2-8148-877a51b0e1da", "eventTime": "2018-04-17T06:48:26Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-2b129c1b", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "618c6549-716b-4fd3-8b2e-23ee9cddc90e", "record_id": "flaws_cloudtrail:0000229:618c6549-716b-4fd3-8b2e-23ee9cddc90e", "row_index": 229, "timestamp": "2018-04-17T06:48:26Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "618c6549-716b-4fd3-8b2e-23ee9cddc90e", "eventTime": "2018-04-17T06:48:26Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e1c2c15a-1d1e-4d63-9dcb-89e2c5d0a488", "record_id": "flaws_cloudtrail:0000230:e1c2c15a-1d1e-4d63-9dcb-89e2c5d0a488", "row_index": 230, "timestamp": "2018-04-17T06:48:26Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 906, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e1c2c15a-1d1e-4d63-9dcb-89e2c5d0a488", "eventTime": "2018-04-17T06:48:26Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "13d66272-0b5a-40ab-91b7-fc33ae2ab480", "record_id": "flaws_cloudtrail:0000231:13d66272-0b5a-40ab-91b7-fc33ae2ab480", "row_index": 231, "timestamp": "2018-04-17T06:48:27Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1273, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "13d66272-0b5a-40ab-91b7-fc33ae2ab480", "eventTime": "2018-04-17T06:48:27Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-d10c94e9", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b8d47460-e46d-4dab-937a-0ef4bf90faef", "record_id": "flaws_cloudtrail:0000232:b8d47460-e46d-4dab-937a-0ef4bf90faef", "row_index": 232, "timestamp": "2018-04-17T06:48:27Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1374, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b8d47460-e46d-4dab-937a-0ef4bf90faef", "eventTime": "2018-04-17T06:48:27Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-2b129c1b", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "17edc57b-8e6e-4d51-8ddd-6a03a22dd9b6", "record_id": "flaws_cloudtrail:0000233:17edc57b-8e6e-4d51-8ddd-6a03a22dd9b6", "row_index": 233, "timestamp": "2018-04-17T06:48:28Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1931, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "17edc57b-8e6e-4d51-8ddd-6a03a22dd9b6", "eventTime": "2018-04-17T06:48:28Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: PYWLy7PoGQDX4Q9UZnUsIHq0de6KUP8P1lY7boLpGlaDN6XUA_UsIWwDj8InwKuQEsJDwfoHnEc5lTqHk9qV2tEdqk7ylaoH14AK9E7ctoIpDi7MmCgK_6PgN6XjlR0w8ebsn8C2_e-aw0ngaePbDNuV-GwUfNFosjmotSDgLS0IXIyaeSExbd6xzrnWxGw3z8YWq9U3I8esgpsD0OC1g1sTT0ecLBtzyWVUMttho786dKrs3yr1TIrJtDq587LBFwyIJoCNejgo_CIJNwaU7OiUHmAo95qIcgOhBMIVSuHgtdP8T2pxK0TkagbEv9EPFhTcav1XB7lasBd5JTcR7NPZOJLAQu2ZVNYamBW15q6o7EZrzD6dUgwsVW8hdIngKo9850Ht8-UekhsoHmQ5qHCCS2nVLTKh66bBlrVPjXuxfsQpa92l-RphsQ7oTAqcUsyftGQmH6ro7CL2hnxjtSPmdWxgQcPFJVPC7zL846HYw-mhtXCwq3pMFb9hEF2dzzV7D4XTWC2Nn3FWPAJB3M-6Xcnt4AYblyVc8g3R_gGxodtHfCdOGfGf-1H2rChmbg5UbzxReFV-Anf44Bcs_qEMqwUxMM9Pa9IxBnjzuNZ60JJLb7EWtdyEl2JOhoBqyHPBdEoD2EDndy10lb586CG-mQvPt_i781C3", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-d10c94e9", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a778272f0-413f-49ef-8bde-ac9aeffca6b6", "record_id": "flaws_cloudtrail:0000234:a778272f0-413f-49ef-8bde-ac9aeffca6b6", "row_index": 234, "timestamp": "2018-04-17T06:48:28Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1378, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a778272f0-413f-49ef-8bde-ac9aeffca6b6", "eventTime": "2018-04-17T06:48:28Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-2b129c1b", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "53a903c1-a470-4163-8558-c972a4b66cf9", "record_id": "flaws_cloudtrail:0000235:53a903c1-a470-4163-8558-c972a4b66cf9", "row_index": 235, "timestamp": "2018-04-17T06:48:29Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1926, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "53a903c1-a470-4163-8558-c972a4b66cf9", "eventTime": "2018-04-17T06:48:29Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: 5oSTesdnOR8eGjeJhGYAc8ZXoxzgGo-44sHBCTyknALb01vLcdtMsbnsvWsvNM2SwwORCKuNsTCibItZii4_u2x1QmUVdWRLiJEqwhdguDMU6clAaY5Y04aSm08PiyYA6NtDQ-GjBHrdBJyA3Dv4DrxlKe1qDP63Gfuj61KRxBh8g7AO_ux3q1chTyI3wdyIwJkU0UQzRpODGKL_h0eM1ZBnP7kX4qRCYnn7B4JwGrM5vKqzB31qW44lwYNSWT53ROkpHYGlrOLWIoyXSAWtXiLrEVsHpD3GOWMhaLyKH12mtnJ133MLgpW0cJW9ghhtf822USMEWAb8VBv6P4IdbxBtB5AF1gKM71BvNlGyuk5ZvthFGdqV6oMvqzHHRXPhrbgGPPiLrVwdZwCVC9JYi9lHPOCF7wCg-sxs8K2QbLxXGe7LN4lgZwpE5PijbjxiAfwg5KJosipeRbzljhdt71ueEHtnS6yZ07mlDiaKrm4kybmrRHp9PribV29qtRcUBvZFq0WoljGsAj8Xq_3qEDsK32Y-Ftw26iJY0kZyHvBz1t85U7nGkClmdfhBO7syOsP5f6_oNsT3-9gFbpN5YzMPTIweQZ-BtWlm6SnXtjCYJi-wOHfsmFW35M3WG54OU2fMQvbsSWtFGXanuKfitVlOp8ajaWnMiQ", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-2b129c1b", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2a7d887d-b230-4516-b8ca-2f97fdf3e060", "record_id": "flaws_cloudtrail:0000236:2a7d887d-b230-4516-b8ca-2f97fdf3e060", "row_index": 236, "timestamp": "2018-04-17T06:48:30Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2a7d887d-b230-4516-b8ca-2f97fdf3e060", "eventTime": "2018-04-17T06:48:30Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "77c84267-060f-4e23-8a17-ff89d0ee0133", "record_id": "flaws_cloudtrail:0000237:77c84267-060f-4e23-8a17-ff89d0ee0133", "row_index": 237, "timestamp": "2018-04-17T06:48:31Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "77c84267-060f-4e23-8a17-ff89d0ee0133", "eventTime": "2018-04-17T06:48:31Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1da913c2-fd26-49b1-9fc6-ee27274c", "record_id": "flaws_cloudtrail:0000238:1da913c2-fd26-49b1-9fc6-ee27274c", "row_index": 238, "timestamp": "2018-04-17T06:48:31Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 799, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1da913c2-fd26-49b1-9fc6-ee27274c", "eventTime": "2018-04-17T06:48:31Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "26936a6f-e66e-4a15-a6a2-c155d9d03a2a", "record_id": "flaws_cloudtrail:0000239:26936a6f-e66e-4a15-a6a2-c155d9d03a2a", "row_index": 239, "timestamp": "2018-04-17T06:48:32Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "26936a6f-e66e-4a15-a6a2-c155d9d03a2a", "eventTime": "2018-04-17T06:48:32Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cec2173f-1fa6-4f0c-9266-bea8290b4ced", "record_id": "flaws_cloudtrail:0000240:cec2173f-1fa6-4f0c-9266-bea8290b4ced", "row_index": 240, "timestamp": "2018-04-17T06:48:32Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cec2173f-1fa6-4f0c-9266-bea8290b4ced", "eventTime": "2018-04-17T06:48:32Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "256ea890-0767-4584-b7dd-9171982846c1", "record_id": "flaws_cloudtrail:0000241:256ea890-0767-4584-b7dd-9171982846c1", "row_index": 241, "timestamp": "2018-04-17T06:48:33Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "256ea890-0767-4584-b7dd-9171982846c1", "eventTime": "2018-04-17T06:48:33Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "376bc40f-4fd6-41cc-aef6-2124abbe4b82", "record_id": "flaws_cloudtrail:0000242:376bc40f-4fd6-41cc-aef6-2124abbe4b82", "row_index": 242, "timestamp": "2018-04-17T06:48:34Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1376, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "376bc40f-4fd6-41cc-aef6-2124abbe4b82", "eventTime": "2018-04-17T06:48:34Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-63f71193", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c6e54e5b-fc03-45dd-95bd-53f9d2b4f5e0", "record_id": "flaws_cloudtrail:0000243:c6e54e5b-fc03-45dd-95bd-53f9d2b4f5e0", "row_index": 243, "timestamp": "2018-04-17T06:48:34Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 1376, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c6e54e5b-fc03-45dd-95bd-53f9d2b4f5e0", "eventTime": "2018-04-17T06:48:34Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-3a3a9be3", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "463faee1-0ff6-4101-85d1-7908a22f1d8b", "record_id": "flaws_cloudtrail:0000244:463faee1-0ff6-4101-85d1-7908a22f1d8b", "row_index": 244, "timestamp": "2018-04-17T06:48:35Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1376, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "463faee1-0ff6-4101-85d1-7908a22f1d8b", "eventTime": "2018-04-17T06:48:35Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-63f71193", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b2831d7c-4ace-4748-b19d-da7bc7592edd", "record_id": "flaws_cloudtrail:0000245:b2831d7c-4ace-4748-b19d-da7bc7592edd", "row_index": 245, "timestamp": "2018-04-17T06:48:36Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1269, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b2831d7c-4ace-4748-b19d-da7bc7592edd", "eventTime": "2018-04-17T06:48:36Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-63f71193", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e0cd6c9a-8441-40c6-8a87-984033cade", "record_id": "flaws_cloudtrail:0000246:e0cd6c9a-8441-40c6-8a87-984033cade", "row_index": 246, "timestamp": "2018-04-17T06:48:36Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 1374, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e0cd6c9a-8441-40c6-8a87-984033cade", "eventTime": "2018-04-17T06:48:36Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-3a3a9be3", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "eee5acd9-992f-472f-9ea3-34a02bfb7038", "record_id": "flaws_cloudtrail:0000247:eee5acd9-992f-472f-9ea3-34a02bfb7038", "row_index": 247, "timestamp": "2018-04-17T06:48:37Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1926, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "eee5acd9-992f-472f-9ea3-34a02bfb7038", "eventTime": "2018-04-17T06:48:37Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: BCWTDmTh99vLG81NauV7ut_GL1A1FIYJX1xZqhJ-Zfo63Dt2ygAD0bUgPv9psBo3puEEp4D-Nb2v0Vj5E9lV1RHYGIuPUNVuvzc-6aiqDpcNpLUUSGd7GJrRTPLa9Bz3zxw6WXzhq2WF3YpmKUY8ZBoKE4Pf2_tuRHrPuVjGGu8-8FV-dxRS_FrbvhNK8VAoqkuQZ1AHsFXKxFTho1muaqbew21DVFAsXt8NPw_E4AoN_i3kxH7dLs8SAfEpgXHCzVZnyFR5ny054BR6TbADqOUgHAyt7AG1C90-H2q6U-tDnsoSBYawQDJ1RhS2PLI4Vfiil_cdMar3j-XH5guS0O-kIRqNDZMU-6axSSLVr8y65DZUQv0PfZITGuq1IA7Qre1r-MMFWICauN69K2lNi3OXT5hInpFAhhrFbATBI3nmVKmRjGgJNojw44-SqrucRmr68MlCfkDxEI8Q3zCSPjSCVS73TMDdfvECgB5KS4_W8ZfCuM9nImQbGrwSuaNp_3s4Onjl68wB676daMOFMQgyG5t2IyogbIJkAbhAQ_KDD10izeAOPhHcSzfpSaR0RCoj7YPgY4kn0FdV0Oed6QJzorEhpOX_JB0PXDTBG3xmcKIG-1kWHOdcZ-YBxPnMN7ms7rHse-KmIVOD4eH3VxQNK017lAd8VQ", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-63f71193", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bea0319b-9f76-416f-894a-3ddb555bcb01", "record_id": "flaws_cloudtrail:0000248:bea0319b-9f76-416f-894a-3ddb555bcb01", "row_index": 248, "timestamp": "2018-04-17T06:48:37Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 1270, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bea0319b-9f76-416f-894a-3ddb555bcb01", "eventTime": "2018-04-17T06:48:37Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-3a3a9be3", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "61d0f3b6-f64a-41a3-a737-b20488aad", "record_id": "flaws_cloudtrail:0000249:61d0f3b6-f64a-41a3-a737-b20488aad", "row_index": 249, "timestamp": "2018-04-17T06:48:38Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 1923, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "61d0f3b6-f64a-41a3-a737-b20488aad", "eventTime": "2018-04-17T06:48:38Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: U1ryaO1l0ozXNOW5V79P50ucvZy9fVMnBUo2QLTIQjPSgVZizuyF7D-nnNgXmRCV_FAeGL0ht9PMLaM8q8TzEVC1IWCXqozNhmBBBP6WvhyMpgcHzW5hUCjTeFd1rcVzAJeuSz9e6esFo6nPfe-nt51akw5Vqul8v5zDUsF5YZti4r-ShI6UQQdqNK5rlcUSKey3_OxKVrs6DpDxDp93ZlCoB60_ydGfG66rpSdB40RDe1hgPKfNLYflpj4mbBuroIN_QbvOrb1wwPqhT-z-jQ_o0cdwZFtYbaU8jG4xcGXf8_uc4oSgHlttUCfalx7zdnWI0tjJXMO4f5RDeHOMHZTwBksDf7Cfox2M6Vgm5NE07wSjGew8QeffHkHoPNyhrZMzDU-xH7TI75LJP6FtK54PPPcqkGxsCJsRdVmbMq0A54l3rBVcNT-s7GIZSWS5NBbIxj23T7edQV46Qfcjn3HPK8UVNOb3Alz1CT7SUZ4yn5Iy7VIWQUJVNHbw_2mMQQ8FgmjMfdxK3JPkmB8dQT4h_DlKFW5HeeC_KnDS4hwTQ04V-2yqiukMJ1QSlkhEphXBxNQ8Zmhtz192Om1qSvu3sVMm9pthSOq2WfIbPn6Cb-AtR7qUErJPFv4mhZmqCo3817S4IqsPzYzqFWtK6tavWljRgOuvow", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-3a3a9be3", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d8cf38c8-44da-4b0b-b2be-d527ad9e07cc", "record_id": "flaws_cloudtrail:0000250:d8cf38c8-44da-4b0b-b2be-d527ad9e07cc", "row_index": 250, "timestamp": "2018-04-17T06:48:40Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 775, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d8cf38c8-44da-4b0b-b2be-d527ad9e07cc", "eventTime": "2018-04-17T06:48:40Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "73868-750e-4832-a13a-cc6e0e1a0aa4", "record_id": "flaws_cloudtrail:0000251:73868-750e-4832-a13a-cc6e0e1a0aa4", "row_index": 251, "timestamp": "2018-04-17T06:49:49Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1487, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "73868-750e-4832-a13a-cc6e0e1a0aa4", "eventTime": "2018-04-17T06:49:49Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIAJC0D7LU0VRQ152VF", "expiration": "Apr 17, 2018 1:18:50 PM", "sessionToken": "FQoDYXdzEKD//////////wEaDIIYNgGCA6TnKJNGUyK3Ayw4NwBN2sJSE8AUoRpQ+PZ8MzJiRTG15/Q6FFHSp9gRlWlRY74f8+Zd2KSCKT+1dYzxYRmXJfM2iVfZW3t+ntGAWd99WKzZRS1H50eYkt/Kxp8+q4LgTvhRYWAYoZKOrFcUZsjKyBKtaag1kwvt5vJnz7gZXg49a3HlRe5bRxtTnGonB02wXhaklhnWl+pQC64+S6celALciiHF8dGRo/bOvms0LxtjN2ShAFO50+GFaDngRHYZFMHwF5lk86QbCbPIYNMh0odbmJSQdoDePAshSp5k9H3PZs3367ZH01MtbMRyKZ6WK2OqQWXHZ9mmyjlbNxU8NrJuFLa08PSKk44YNRUMi5rfyfsWFSf+ReVHr/3WaF92aSSiVvoEk8E7ajifWj818Ldp/5GV9EVGRc2Ulw/v64WhRq+7OSpfak67pkY4rYlrizapIZ+xwCVBpckCwv9wBrOJfQh1UxjbRgwo3gP6eWMzkK1bBwXssVo2PRo81hQ3myXK3ewsE5rG0sfx1FCzlpRlph/XvoLdvHa8QLf5unpUHF88+wJYiM8SCbo7t1ueBUZrxND/U5qSbxx18N9r0RoojbLW1gU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "17f32e61-6b17-48bb-a262-b2c702c6da0a", "record_id": "flaws_cloudtrail:0000252:17f32e61-6b17-48bb-a262-b2c702c6da0a", "row_index": 252, "timestamp": "2018-04-17T07:02:47Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "214.6.1.16", "user_agent": "[aws-cli/1.12.2 Python/3.5.1 Darwin/15.6.0 botocore/1.8.2]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 637, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "17f32e61-6b17-48bb-a262-b2c702c6da0a", "eventTime": "2018-04-17T07:02:47Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "214.6.1.16", "userAgent": "[aws-cli/1.12.2 Python/3.5.1 Darwin/15.6.0 botocore/1.8.2]", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5ac880b4-515c-4135-b286-35e506486", "record_id": "flaws_cloudtrail:0000253:5ac880b4-515c-4135-b286-35e506486", "row_index": 253, "timestamp": "2018-04-17T07:16:28Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "214.6.1.16", "user_agent": "aws-cli/1.12.2 Python/3.5.1 Darwin/15.6.0 botocore/1.8.2", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 689, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5ac880b4-515c-4135-b286-35e506486", "eventTime": "2018-04-17T07:16:28Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "214.6.1.16", "userAgent": "aws-cli/1.12.2 Python/3.5.1 Darwin/15.6.0 botocore/1.8.2", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b32faa45-28e1-40da-9b16-13c6938d0184", "record_id": "flaws_cloudtrail:0000254:b32faa45-28e1-40da-9b16-13c6938d0184", "row_index": 254, "timestamp": "2018-04-17T07:21:25Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "214.6.1.16", "user_agent": "aws-cli/1.12.2 Python/3.5.1 Darwin/15.6.0 botocore/1.8.2", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 763, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b32faa45-28e1-40da-9b16-13c6938d0184", "eventTime": "2018-04-17T07:21:25Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "214.6.1.16", "userAgent": "aws-cli/1.12.2 Python/3.5.1 Darwin/15.6.0 botocore/1.8.2", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "329e009e-388d-49d5-98e7-211785ac199004", "record_id": "flaws_cloudtrail:0000255:329e009e-388d-49d5-98e7-211785ac199004", "row_index": 255, "timestamp": "2018-04-17T07:22:36Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "214.6.1.16", "user_agent": "aws-cli/1.12.2 Python/3.5.1 Darwin/15.6.0 botocore/1.8.2", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 780, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "329e009e-388d-49d5-98e7-211785ac199004", "eventTime": "2018-04-17T07:22:36Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "214.6.1.16", "userAgent": "aws-cli/1.12.2 Python/3.5.1 Darwin/15.6.0 botocore/1.8.2", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "965e7cb1-e5cf-4fcc-974a-7956cf58fc0d", "record_id": "flaws_cloudtrail:0000256:965e7cb1-e5cf-4fcc-974a-7956cf58fc0d", "row_index": 256, "timestamp": "2018-04-17T07:23:57Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 874, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "965e7cb1-e5cf-4fcc-974a-7956cf58fc0d", "eventTime": "2018-04-17T07:23:57Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7b37f865-5eab-48b8-93cf-bacdac07f9b6", "record_id": "flaws_cloudtrail:0000257:7b37f865-5eab-48b8-93cf-bacdac07f9b6", "row_index": 257, "timestamp": "2018-04-17T07:23:58Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7b37f865-5eab-48b8-93cf-bacdac07f9b6", "eventTime": "2018-04-17T07:23:58Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "12b6e4fe-f7c7-47af-a181-ed6875d978949", "record_id": "flaws_cloudtrail:0000258:12b6e4fe-f7c7-47af-a181-ed6875d978949", "row_index": 258, "timestamp": "2018-04-17T07:23:59Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 914, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "12b6e4fe-f7c7-47af-a181-ed6875d978949", "eventTime": "2018-04-17T07:23:59Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a0ac3265-17ef-431d-b16e-7326b91bf908", "record_id": "flaws_cloudtrail:0000259:a0ac3265-17ef-431d-b16e-7326b91bf908", "row_index": 259, "timestamp": "2018-04-17T07:23:59Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 913, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a0ac3265-17ef-431d-b16e-7326b91bf908", "eventTime": "2018-04-17T07:23:59Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "089d5967-a3f3-4a91-bbfa-074aeff7210f", "record_id": "flaws_cloudtrail:0000260:089d5967-a3f3-4a91-bbfa-074aeff7210f", "row_index": 260, "timestamp": "2018-04-17T07:23:59Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "089d5967-a3f3-4a91-bbfa-074aeff7210f", "eventTime": "2018-04-17T07:23:59Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e839392f8-c4d6-44c8-a0af-3eff2588be04", "record_id": "flaws_cloudtrail:0000261:e839392f8-c4d6-44c8-a0af-3eff2588be04", "row_index": 261, "timestamp": "2018-04-17T07:23:59Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 910, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e839392f8-c4d6-44c8-a0af-3eff2588be04", "eventTime": "2018-04-17T07:23:59Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6150c738-0173-4d3f-9492-fdeebd96ca0e", "record_id": "flaws_cloudtrail:0000262:6150c738-0173-4d3f-9492-fdeebd96ca0e", "row_index": 262, "timestamp": "2018-04-17T07:24:00Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 908, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6150c738-0173-4d3f-9492-fdeebd96ca0e", "eventTime": "2018-04-17T07:24:00Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2ab5d7ef-f600-454e-acc9-3e438825e0", "record_id": "flaws_cloudtrail:0000263:2ab5d7ef-f600-454e-acc9-3e438825e0", "row_index": 263, "timestamp": "2018-04-17T07:24:02Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 806, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2ab5d7ef-f600-454e-acc9-3e438825e0", "eventTime": "2018-04-17T07:24:02Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a21de9c5-a583-4f70-b534-30ce780f20a7", "record_id": "flaws_cloudtrail:0000264:a21de9c5-a583-4f70-b534-30ce780f20a7", "row_index": 264, "timestamp": "2018-04-17T07:24:03Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a21de9c5-a583-4f70-b534-30ce780f20a7", "eventTime": "2018-04-17T07:24:03Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9a180019e-2dfa-4cd7-9bd3-dd8e7e6e57e4", "record_id": "flaws_cloudtrail:0000265:9a180019e-2dfa-4cd7-9bd3-dd8e7e6e57e4", "row_index": 265, "timestamp": "2018-04-17T07:24:03Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 807, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9a180019e-2dfa-4cd7-9bd3-dd8e7e6e57e4", "eventTime": "2018-04-17T07:24:03Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5b6f3cc2-b03d-41d1-99f3-8d444821e94d0", "record_id": "flaws_cloudtrail:0000266:5b6f3cc2-b03d-41d1-99f3-8d444821e94d0", "row_index": 266, "timestamp": "2018-04-17T07:24:03Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 805, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5b6f3cc2-b03d-41d1-99f3-8d444821e94d0", "eventTime": "2018-04-17T07:24:03Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2ae69206-bc15-4532-94cf-ae476e68bb8b", "record_id": "flaws_cloudtrail:0000267:2ae69206-bc15-4532-94cf-ae476e68bb8b", "row_index": 267, "timestamp": "2018-04-17T07:24:03Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2ae69206-bc15-4532-94cf-ae476e68bb8b", "eventTime": "2018-04-17T07:24:03Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e26fef35-e4fc-4a76-b222-c91710e23cb1", "record_id": "flaws_cloudtrail:0000268:e26fef35-e4fc-4a76-b222-c91710e23cb1", "row_index": 268, "timestamp": "2018-04-17T07:24:03Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e26fef35-e4fc-4a76-b222-c91710e23cb1", "eventTime": "2018-04-17T07:24:03Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a7bea7cc-bd57-4853-8778-29d4b999215a0", "record_id": "flaws_cloudtrail:0000269:a7bea7cc-bd57-4853-8778-29d4b999215a0", "row_index": 269, "timestamp": "2018-04-17T07:24:04Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 810, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a7bea7cc-bd57-4853-8778-29d4b999215a0", "eventTime": "2018-04-17T07:24:04Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e27664bb-67fc-489a-a5e9-350b9f996b64", "record_id": "flaws_cloudtrail:0000270:e27664bb-67fc-489a-a5e9-350b9f996b64", "row_index": 270, "timestamp": "2018-04-17T07:24:04Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 806, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e27664bb-67fc-489a-a5e9-350b9f996b64", "eventTime": "2018-04-17T07:24:04Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "26b84e03-e1a5-4842-931d-96524ae44141", "record_id": "flaws_cloudtrail:0000271:26b84e03-e1a5-4842-931d-96524ae44141", "row_index": 271, "timestamp": "2018-04-17T07:24:04Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "26b84e03-e1a5-4842-931d-96524ae44141", "eventTime": "2018-04-17T07:24:04Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "604b93af-46c0-4b65-a70c-2284d6df6f02", "record_id": "flaws_cloudtrail:0000272:604b93af-46c0-4b65-a70c-2284d6df6f02", "row_index": 272, "timestamp": "2018-04-17T07:24:04Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "604b93af-46c0-4b65-a70c-2284d6df6f02", "eventTime": "2018-04-17T07:24:04Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b9b795315-9b24-4626-89ce-f4cc85150a6b", "record_id": "flaws_cloudtrail:0000273:b9b795315-9b24-4626-89ce-f4cc85150a6b", "row_index": 273, "timestamp": "2018-04-17T07:24:04Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 804, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b9b795315-9b24-4626-89ce-f4cc85150a6b", "eventTime": "2018-04-17T07:24:04Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "269cccad-4e52-4cf6-9808-26df022de2dc", "record_id": "flaws_cloudtrail:0000274:269cccad-4e52-4cf6-9808-26df022de2dc", "row_index": 274, "timestamp": "2018-04-17T07:24:05Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "269cccad-4e52-4cf6-9808-26df022de2dc", "eventTime": "2018-04-17T07:24:05Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c57e6e20-00d9-47e5-848c-cd7b97498782", "record_id": "flaws_cloudtrail:0000275:c57e6e20-00d9-47e5-848c-cd7b97498782", "row_index": 275, "timestamp": "2018-04-17T07:24:05Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1381, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c57e6e20-00d9-47e5-848c-cd7b97498782", "eventTime": "2018-04-17T07:24:05Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-14f2b3cc", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2f486a3e-e371-4279-af7d-ed6b94841384", "record_id": "flaws_cloudtrail:0000276:2f486a3e-e371-4279-af7d-ed6b94841384", "row_index": 276, "timestamp": "2018-04-17T07:24:05Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2f486a3e-e371-4279-af7d-ed6b94841384", "eventTime": "2018-04-17T07:24:05Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "96c1d18c-803e-42dd-9341-313bb7f96672", "record_id": "flaws_cloudtrail:0000277:96c1d18c-803e-42dd-9341-313bb7f96672", "row_index": 277, "timestamp": "2018-04-17T07:24:05Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1269, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "96c1d18c-803e-42dd-9341-313bb7f96672", "eventTime": "2018-04-17T07:24:05Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-f5710223", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ef66f6d8-6bf0-4451-aa8a-c40443e22927", "record_id": "flaws_cloudtrail:0000278:ef66f6d8-6bf0-4451-aa8a-c40443e22927", "row_index": 278, "timestamp": "2018-04-17T07:24:06Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ef66f6d8-6bf0-4451-aa8a-c40443e22927", "eventTime": "2018-04-17T07:24:06Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "89ff6db9-fd8b-4b16-92a1-7f6549a607a2", "record_id": "flaws_cloudtrail:0000279:89ff6db9-fd8b-4b16-92a1-7f6549a607a2", "row_index": 279, "timestamp": "2018-04-17T07:24:07Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1381, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "89ff6db9-fd8b-4b16-92a1-7f6549a607a2", "eventTime": "2018-04-17T07:24:07Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ca57294", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6df68478-7fe8-4e63-b914-66d204da5678", "record_id": "flaws_cloudtrail:0000280:6df68478-7fe8-4e63-b914-66d204da5678", "row_index": 280, "timestamp": "2018-04-17T07:24:07Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1376, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6df68478-7fe8-4e63-b914-66d204da5678", "eventTime": "2018-04-17T07:24:07Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ef6f0d3", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6b09118a-aefb-4fdd-ab7c-8880727b95a9", "record_id": "flaws_cloudtrail:0000281:6b09118a-aefb-4fdd-ab7c-8880727b95a9", "row_index": 281, "timestamp": "2018-04-17T07:24:07Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1376, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6b09118a-aefb-4fdd-ab7c-8880727b95a9", "eventTime": "2018-04-17T07:24:07Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-f5710223", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "30c77b5c-4897-4fd4-bdda-63dd01ea7f43", "record_id": "flaws_cloudtrail:0000282:30c77b5c-4897-4fd4-bdda-63dd01ea7f43", "row_index": 282, "timestamp": "2018-04-17T07:24:08Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1381, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "30c77b5c-4897-4fd4-bdda-63dd01ea7f43", "eventTime": "2018-04-17T07:24:08Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-14f2b3cc", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "683e1bbf-6fae-4786-80a0-33e50399d2f8", "record_id": "flaws_cloudtrail:0000283:683e1bbf-6fae-4786-80a0-33e50399d2f8", "row_index": 283, "timestamp": "2018-04-17T07:24:08Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 804, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "683e1bbf-6fae-4786-80a0-33e50399d2f8", "eventTime": "2018-04-17T07:24:08Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fbcd1187-bc61-44fd-b696-28c23bd0632a", "record_id": "flaws_cloudtrail:0000284:fbcd1187-bc61-44fd-b696-28c23bd0632a", "row_index": 284, "timestamp": "2018-04-17T07:24:08Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1376, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fbcd1187-bc61-44fd-b696-28c23bd0632a", "eventTime": "2018-04-17T07:24:08Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ef6f0d3", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a2b62ae7-053a-4da3-9beb-775317185840", "record_id": "flaws_cloudtrail:0000285:a2b62ae7-053a-4da3-9beb-775317185840", "row_index": 285, "timestamp": "2018-04-17T07:24:08Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1271, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a2b62ae7-053a-4da3-9beb-775317185840", "eventTime": "2018-04-17T07:24:08Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-f5710223", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f714ee9f-1351-4925-ae52-49a371853b6c", "record_id": "flaws_cloudtrail:0000286:f714ee9f-1351-4925-ae52-49a371853b6c", "row_index": 286, "timestamp": "2018-04-17T07:24:09Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1377, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f714ee9f-1351-4925-ae52-49a371853b6c", "eventTime": "2018-04-17T07:24:09Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ef6f0d3", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "58a30ae6-f042-4b59-858d-311502126e98", "record_id": "flaws_cloudtrail:0000287:58a30ae6-f042-4b59-858d-311502126e98", "row_index": 287, "timestamp": "2018-04-17T07:24:09Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1926, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "58a30ae6-f042-4b59-858d-311502126e98", "eventTime": "2018-04-17T07:24:09Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: TU9nwDiANCK94oYN5JKo2DslWpP9LebXX2TpW_u4ywD-x6YDeJ7lVVdEaiZH9X1PAGCHUyiT_T9U12mVD_HzuEUcRZXoqzJO0iYTnEWwpe-hdXwR9XGIkWvboCuOdAkcK0THC8rGBrbVXJfZl7nOLiRBRdYFiK_D6wTr-mai4ZbicbvEHCdksBM6tU-zLgg_LdC8v_qWNUdgDqjD5ZmcUS08YmjH-ZYszQl1sOQIH-EyacCqcieHJY64B07Uh_-m0bNwjsWuPl8GCrNaJIreI09tdCYV4zqcEdxSg6XxAwtIXpJmLdWSS_L969etF7p7fplat0IkRRjIign86sbq_4fXp3wtkad2cShTyhyzO6fvw3SUTnoJ2bQ1cUbNv1HjxWLm9206o0g2YDqhzejlgsZwn2YBfqOZydnIZ-5XT74LEf6AB9ViWKenbCz_nyXuNXAys0JKscgcPJkUVnSO5dxGVnvp131Ae_p0gYJwyYA2riF7TOQgjzKCIsl4pG2InR3RKPmoyRnnsWfIGKg4IEacvDvRUtdx-ntEceA2KSF0XXJfC6Wgk4WW4H5AEc-btne8qwPijCc-KhdFXwqahP-RLr8ftH8OFBQR1PeFgYY_tLoFkqvsPjObkSfP0PXQaA4L2aO56cUE2peC-rtxGU3PQsPjEqe1vA", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-f5710223", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5f25322-399a-45f5-9371-18845d5f", "record_id": "flaws_cloudtrail:0000288:5f25322-399a-45f5-9371-18845d5f", "row_index": 288, "timestamp": "2018-04-17T07:24:10Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 908, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5f25322-399a-45f5-9371-18845d5f", "eventTime": "2018-04-17T07:24:10Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "814992-97dd-47f3-b547-fad040d636df", "record_id": "flaws_cloudtrail:0000289:814992-97dd-47f3-b547-fad040d636df", "row_index": 289, "timestamp": "2018-04-17T07:24:10Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1374, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "814992-97dd-47f3-b547-fad040d636df", "eventTime": "2018-04-17T07:24:10Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-dc82b8b9", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3bbb6917-b8b1-4f5f-a2b0-49560e47a333", "record_id": "flaws_cloudtrail:0000290:3bbb6917-b8b1-4f5f-a2b0-49560e47a333", "row_index": 290, "timestamp": "2018-04-17T07:24:11Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1376, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3bbb6917-b8b1-4f5f-a2b0-49560e47a333", "eventTime": "2018-04-17T07:24:11Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-dc82b8b9", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "04582a17-6ccc-463f-8e6f-a9bb6d6789df", "record_id": "flaws_cloudtrail:0000291:04582a17-6ccc-463f-8e6f-a9bb6d6789df", "row_index": 291, "timestamp": "2018-04-17T07:24:11Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1926, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "04582a17-6ccc-463f-8e6f-a9bb6d6789df", "eventTime": "2018-04-17T07:24:11Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: 5-nTksrWYb2Ztu4XisrCIPp9IXA-S_15bjDC4S_1HNJ4KphNP_rweuz9IYJ55RsbMsifyRt9jM8vP5rgRZniaCPq9XkNblvM8x9kprqvE12WXCLxQseCYH_ZnJlBlni_O1T2blBKDQiuXAbSR109KplwV9Fsi9BEGpM3uKM4cBhvtmnKrDhaDXVRpZBmn68Lbwyqaso1j0hqQGQmW5kVKYWCKl4iTUtfhwmazR6wKACMXwrICcZfhazamc58WeVDn8yobyIGJgex-hlEzkVDTbZedxNWtDQrTbWxpyhL7cU6G6rXvwIXOIaIW77dtO7IqG-gieVXouOSYWWp2RfoNB3nSDjBKn5dg8x_UPFg1N3fPpTDPWt3ZvpWAu06gPC9dnT4aOhNKjFo3Cv-Ve9Wk4z0bEkW6QTRIpbld2yFUE93ZlJw5tndgEm1mQOUaOxiaperiiM76hzwYlyDQ2BxfNCLLsfsL1y9-NtDjmYX9Ob1YvO0Alf9MoYlzSGEKnUX4OG71h7RaFGGWX71RFxxdIKog8HhMYoTh6aGxeOlwgY0eiHRCTqpk0D1ajt2Sme1pKvzG-6u1fwoUrYxph2vuPEiH0YxNS09J91wXoIU-dmo6ng730n2GsQnKdlYjXiHZxPd_Pzw417uRmLEqb79qK5mspodr2b3wg", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ef6f0d3", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fd58b5fe-bc56-45ab-9ec2-134dbb41c18e", "record_id": "flaws_cloudtrail:0000292:fd58b5fe-bc56-45ab-9ec2-134dbb41c18e", "row_index": 292, "timestamp": "2018-04-17T07:24:12Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1275, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fd58b5fe-bc56-45ab-9ec2-134dbb41c18e", "eventTime": "2018-04-17T07:24:12Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-14f2b3cc", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f9a4b0b4-8f4c-4dcd-9970-4df4eb8e54ef", "record_id": "flaws_cloudtrail:0000293:f9a4b0b4-8f4c-4dcd-9970-4df4eb8e54ef", "row_index": 293, "timestamp": "2018-04-17T07:24:12Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 911, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f9a4b0b4-8f4c-4dcd-9970-4df4eb8e54ef", "eventTime": "2018-04-17T07:24:12Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7cf91d92-baa5-4564-b7b9-9f9ff112fcda", "record_id": "flaws_cloudtrail:0000294:7cf91d92-baa5-4564-b7b9-9f9ff112fcda", "row_index": 294, "timestamp": "2018-04-17T07:24:14Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7cf91d92-baa5-4564-b7b9-9f9ff112fcda", "eventTime": "2018-04-17T07:24:14Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "15cb277f-0b91-44cc-8a31-e39ce2ddcc28", "record_id": "flaws_cloudtrail:0000295:15cb277f-0b91-44cc-8a31-e39ce2ddcc28", "row_index": 295, "timestamp": "2018-04-17T07:24:14Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "15cb277f-0b91-44cc-8a31-e39ce2ddcc28", "eventTime": "2018-04-17T07:24:14Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "34a650e4-82d2-4c67-9c20-e93e153025", "record_id": "flaws_cloudtrail:0000296:34a650e4-82d2-4c67-9c20-e93e153025", "row_index": 296, "timestamp": "2018-04-17T07:24:15Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1933, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "34a650e4-82d2-4c67-9c20-e93e153025", "eventTime": "2018-04-17T07:24:15Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: 1WiVfFwQIrDXBEX9mcjRYPhI0vPDZrMERayvF7NMZPIFubymv9Mo4wvl-YZ9T1Bp_nuFd4c259HSxITMqYF91gcz7mo2RIwhj5KVsj_1Xl3kVCoUuSAfSK6PUGRkFV-UgANzdpEzYCATv9ZlNql1eDn2BgATrbaFK6RUXejS1tTNn5XLjXUdt_5lS34lW6myEuDizaNemrVDyES5mKmrvWlqwtKvn7Wskj2u_g_qFD0bN3iYpunEXLHBd3DJsY1mf96ovA-jtAJseLdSAjc7OiyMCcoVzWlFusXJksKua-loezUYoOHc3sAGCgv1NM2ZIlnqf_etNiQmFjuB4wZ3PJIthX_wTQNpFl92csOC_46sXMZgPeb4ra6gqx-OjU2zbmIzYomeJQqkBT9x3DjsWz6y1XQBUNkqnHH4qnEVPHHLR3MiFpmmKMmihkri2wSEQwHYQqhtDWVOtpmPd5VLMAaPIa-V3KjQ6JdZ1J8lEEyQcwb6sjW_xMrakuxNvXHph6ienerBoqSMy-ex5iKKLap5FH_mAObmC4ldBADfC7m8vTn4TBsXwSd4riLNHO02GlFdfjUTmlQyf8tIXx78hHGNLYA0OqP4A3fOWPUMZz94TmxrWUTkZE5ukSIlLncD9fPgxKOjU_H6jOqQM42nlKF0ySiE9UMxF6C_-YI", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-14f2b3cc", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3344aa60-7cb3-4303-986a-7a94162d7a3c", "record_id": "flaws_cloudtrail:0000297:3344aa60-7cb3-4303-986a-7a94162d7a3c", "row_index": 297, "timestamp": "2018-04-17T07:24:16Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3344aa60-7cb3-4303-986a-7a94162d7a3c", "eventTime": "2018-04-17T07:24:16Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "85cf9f06-2ff2-4a9c-a34d-5f274c597bf7", "record_id": "flaws_cloudtrail:0000298:85cf9f06-2ff2-4a9c-a34d-5f274c597bf7", "row_index": 298, "timestamp": "2018-04-17T07:24:16Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 806, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "85cf9f06-2ff2-4a9c-a34d-5f274c597bf7", "eventTime": "2018-04-17T07:24:16Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "20aa5f1e-cea1-4a44-8497-94b0a6d99163", "record_id": "flaws_cloudtrail:0000299:20aa5f1e-cea1-4a44-8497-94b0a6d99163", "row_index": 299, "timestamp": "2018-04-17T07:24:16Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1270, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "20aa5f1e-cea1-4a44-8497-94b0a6d99163", "eventTime": "2018-04-17T07:24:16Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-dc82b8b9", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a3eb92cb-c424-4a5f-bf7f-3f8e370d1509", "record_id": "flaws_cloudtrail:0000300:a3eb92cb-c424-4a5f-bf7f-3f8e370d1509", "row_index": 300, "timestamp": "2018-04-17T07:24:17Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 913, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a3eb92cb-c424-4a5f-bf7f-3f8e370d1509", "eventTime": "2018-04-17T07:24:17Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d708e933-23f2-426e-979a-01e83bf22b7c", "record_id": "flaws_cloudtrail:0000301:d708e933-23f2-426e-979a-01e83bf22b7c", "row_index": 301, "timestamp": "2018-04-17T07:24:18Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1382, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d708e933-23f2-426e-979a-01e83bf22b7c", "eventTime": "2018-04-17T07:24:18Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-546ae567", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "94aba2d9-858f-4b62-953f-9d3eb4af73a4", "record_id": "flaws_cloudtrail:0000302:94aba2d9-858f-4b62-953f-9d3eb4af73a4", "row_index": 302, "timestamp": "2018-04-17T07:24:18Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 806, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "94aba2d9-858f-4b62-953f-9d3eb4af73a4", "eventTime": "2018-04-17T07:24:18Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "35199-a1e6-422d-989e-972694f2a0e6", "record_id": "flaws_cloudtrail:0000303:35199-a1e6-422d-989e-972694f2a0e6", "row_index": 303, "timestamp": "2018-04-17T07:24:19Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1379, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "35199-a1e6-422d-989e-972694f2a0e6", "eventTime": "2018-04-17T07:24:19Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ca57294", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4c3fbf25-de88-4a75-90a0-fa362c65e96f", "record_id": "flaws_cloudtrail:0000304:4c3fbf25-de88-4a75-90a0-fa362c65e96f", "row_index": 304, "timestamp": "2018-04-17T07:24:19Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1381, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4c3fbf25-de88-4a75-90a0-fa362c65e96f", "eventTime": "2018-04-17T07:24:19Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-546ae567", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1a3c05d1-4e01-4294-8546-4b44f087f83b", "record_id": "flaws_cloudtrail:0000305:1a3c05d1-4e01-4294-8546-4b44f087f83b", "row_index": 305, "timestamp": "2018-04-17T07:24:19Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 806, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1a3c05d1-4e01-4294-8546-4b44f087f83b", "eventTime": "2018-04-17T07:24:19Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8e86d6d6-9d78-4f03-a8e7-6d43da78b077", "record_id": "flaws_cloudtrail:0000306:8e86d6d6-9d78-4f03-a8e7-6d43da78b077", "row_index": 306, "timestamp": "2018-04-17T07:24:19Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1331, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8e86d6d6-9d78-4f03-a8e7-6d43da78b077", "eventTime": "2018-04-17T07:24:19Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Server.InsufficientInstanceCapacity", "errorMessage": "We currently do not have sufficient c5.18xlarge capacity in zones with support for 'gp2' volumes. Our system will be working on provisioning additional capacity.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-dc82b8b9", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7528a360-99ff-41ce-b52e-c81d25069d14", "record_id": "flaws_cloudtrail:0000307:7528a360-99ff-41ce-b52e-c81d25069d14", "row_index": 307, "timestamp": "2018-04-17T07:24:20Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1382, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7528a360-99ff-41ce-b52e-c81d25069d14", "eventTime": "2018-04-17T07:24:20Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ca57294", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5767c6dd-5daf-4d55-a2fd-113f558889bd", "record_id": "flaws_cloudtrail:0000308:5767c6dd-5daf-4d55-a2fd-113f558889bd", "row_index": 308, "timestamp": "2018-04-17T07:24:20Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1275, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5767c6dd-5daf-4d55-a2fd-113f558889bd", "eventTime": "2018-04-17T07:24:20Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-546ae567", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3bc43538-5ccf-45bc-8901-d4aa12114", "record_id": "flaws_cloudtrail:0000309:3bc43538-5ccf-45bc-8901-d4aa12114", "row_index": 309, "timestamp": "2018-04-17T07:24:20Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1376, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3bc43538-5ccf-45bc-8901-d4aa12114", "eventTime": "2018-04-17T07:24:20Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-bbcb674a", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "be774405c-c907-4469-8b44-1b92ff237209e", "record_id": "flaws_cloudtrail:0000310:be774405c-c907-4469-8b44-1b92ff237209e", "row_index": 310, "timestamp": "2018-04-17T07:24:21Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 810, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "be774405c-c907-4469-8b44-1b92ff237209e", "eventTime": "2018-04-17T07:24:21Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7f965215-9a52-4e2e-a7ec-80950771c209", "record_id": "flaws_cloudtrail:0000311:7f965215-9a52-4e2e-a7ec-80950771c209", "row_index": 311, "timestamp": "2018-04-17T07:24:21Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1379, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7f965215-9a52-4e2e-a7ec-80950771c209", "eventTime": "2018-04-17T07:24:21Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-bbcb674a", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f39eb19a-fe38-4737-adbb-3fc59c436a8f", "record_id": "flaws_cloudtrail:0000312:f39eb19a-fe38-4737-adbb-3fc59c436a8f", "row_index": 312, "timestamp": "2018-04-17T07:24:21Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1330, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f39eb19a-fe38-4737-adbb-3fc59c436a8f", "eventTime": "2018-04-17T07:24:21Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Server.InsufficientInstanceCapacity", "errorMessage": "We currently do not have sufficient c5.18xlarge capacity in zones with support for 'gp2' volumes. Our system will be working on provisioning additional capacity.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-dc82b8b9", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "594cad04-a460-47d0-b2da-6de3cd36af68", "record_id": "flaws_cloudtrail:0000313:594cad04-a460-47d0-b2da-6de3cd36af68", "row_index": 313, "timestamp": "2018-04-17T07:24:22Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1274, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "594cad04-a460-47d0-b2da-6de3cd36af68", "eventTime": "2018-04-17T07:24:22Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-bbcb674a", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d9c3dd86-701e-4c83-aaf2-4826cc685002e", "record_id": "flaws_cloudtrail:0000314:d9c3dd86-701e-4c83-aaf2-4826cc685002e", "row_index": 314, "timestamp": "2018-04-17T07:24:23Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1936, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d9c3dd86-701e-4c83-aaf2-4826cc685002e", "eventTime": "2018-04-17T07:24:23Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: cphBj2cOx3oUBy0i-qIS8FDvtWfbdx13_O0Kv_KUXHS6OW50ZDfMvCuDzuwGeXzHUxs4PI2K3I2TF0khYH19zPuzLo1JzSeFveB8T067EN8Xp7jbnUV6DegaduJQQZGqjUTTMPrXtg_TL1nwpqs8cAX7YTQgNyTFEoxJMzy44HB0QLZqzhgJMreWeOmKg4kYBn3QKEhxXvybiWr5jLSqzIxvPmnYaL8ZI8IHBeBToXm1QMg7tOKR-gtppQM-_uAKaEli-ozDrNVo-VRDEWTrPn9B6I5iRH5-UKJdKU-Bx-0q-vXFQU_YZ6xC-Qbl3Fup3yzAimQqE9S9XoN8d4MFTZafUCB42HRzxj6aPxrAjPibc-wRTfUG5M1jy-_dOfPUf33Xs64QniJRBxA2lK3H2sYtHSz80A4lgFM7tv_71EWo1X8UiTFmyf755yWYioIkqbwBFNXM-VWX8TlHfz9FpGQtHrRfgjZlfYzKQyn2Qg_teTTbBiIF9xGfyusl-sgi44v3xi792nyUc2C1bYI43TfqacJIMl09g4oYFCzXR3_Y98i7P7oAt8f2GQRvDCwc7Utk2LtQNa2X53BSWWA3aybZ0J7dRw3cYvMSjhfPt07KJb_taHKpkN6qbGky1cqu5MU_rGg_qPbct4hPigy83VKBpwjnDsHVlV5sTuw", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-546ae567", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "681b3071-6959-4662-ac32-672eaf92a55d", "record_id": "flaws_cloudtrail:0000315:681b3071-6959-4662-ac32-672eaf92a55d", "row_index": 315, "timestamp": "2018-04-17T07:24:23Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1331, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "681b3071-6959-4662-ac32-672eaf92a55d", "eventTime": "2018-04-17T07:24:23Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Server.InsufficientInstanceCapacity", "errorMessage": "We currently do not have sufficient c5.18xlarge capacity in zones with support for 'gp2' volumes. Our system will be working on provisioning additional capacity.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-dc82b8b9", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0d53df83-17fb-4a3c-9501-13211d70c34a", "record_id": "flaws_cloudtrail:0000316:0d53df83-17fb-4a3c-9501-13211d70c34a", "row_index": 316, "timestamp": "2018-04-17T07:24:24Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0d53df83-17fb-4a3c-9501-13211d70c34a", "eventTime": "2018-04-17T07:24:24Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d42086f2-26b1-4fcb-a5e7-d109f77a7875", "record_id": "flaws_cloudtrail:0000317:d42086f2-26b1-4fcb-a5e7-d109f77a7875", "row_index": 317, "timestamp": "2018-04-17T07:24:24Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1931, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d42086f2-26b1-4fcb-a5e7-d109f77a7875", "eventTime": "2018-04-17T07:24:24Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: Q1YUWeH8XYL2OGwR9rPtHtR3I5kdqFQBwE5jeCbfz-4deBdGMm4-VmuFPbgg6ohiBB58PyuqztTawV-938kvg-XsK5N0V9643eupnezvIrAjBCsp11REBD9h5dFViOWPjdJ8gAMkbLlvjtJwhP5Nzm5ESa_GFw-tDMgMH0U_MRXIrtAz2A1n7qnyGjyZvPRBz9ti3M3hn9Pliyp7WxsyHjrk1MgkTug9jNr-FwMRZyYv3_Rcz40sBGzkRdGTa-oKvaUyiOnJnKSRZ5pviW_ym4BWEW3Mq_AQZknSdA5Rqqzu1KJJy2_P2UybMsG-TvydovRbep6r_gq6hsY0U9NNInLmQe4oPxbOeNZSwfr_noRimHZ52447fw3XaDUJY1HB7blwEpFnvuPwOea6_Y89mUaHOYoNwgHj8Dwn9VD7qFoz0k_2-7uSRLCcAIkOYrTVC1txxJgzH_2udpepW-H3a6CtIiLkee4z0r78EB45M1Dz5odFReXVE71P5Oqu_h23XmIDyVVm7GPXdwqjh4xZIiYgEyaPV3EZY5_4qUmVixp9Td_7WiF0CxseoI_x7eFebzVrWc-LrKU5Ewbaw_HIFVzV1H_Y4E3ccyo864B7K5incWTRH-mCQEDQEbTHZNFf8Tn4urr4nHa0F2LTrZg8UUPKw7FIslQgyVV9", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-bbcb674a", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "344e71f7-d68d-4aa9-bd0a-b2d3f942c148", "record_id": "flaws_cloudtrail:0000318:344e71f7-d68d-4aa9-bd0a-b2d3f942c148", "row_index": 318, "timestamp": "2018-04-17T07:24:24Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 908, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "344e71f7-d68d-4aa9-bd0a-b2d3f942c148", "eventTime": "2018-04-17T07:24:24Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7ce27cce-6392-4308-ac51-5deeccdb3834", "record_id": "flaws_cloudtrail:0000319:7ce27cce-6392-4308-ac51-5deeccdb3834", "row_index": 319, "timestamp": "2018-04-17T07:24:25Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1937, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7ce27cce-6392-4308-ac51-5deeccdb3834", "eventTime": "2018-04-17T07:24:25Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: 8GWVZoQQ_E4b7h2B83uSqG6-qzSi52_MTUsbYWuPQfvP6GoiknF6C2uLsImc_1PoAY6ZnhoXNVVPu24rStvro_IAWETnitipkcgOo8t89cIoHPkTeu1tQaGFoOvE9ZS_qr2RWRxUg50TwHGaPrWS80-Y5EPwrFK9FZQKiEV69Y8dFnODQ1oMl5YZbgN3zFCymE2wpj-sm6jKRNGWytMzmwyqD9x2PDlq0ekUIq0QfA4US7uJ_8orFcZTeHWjujcbjb3Zvohd_F4vWwOtYiIMj2C8qTRbUqe4KsvadzMq1uFVTQhJGzXlPz8GpwsqbwZTAfofSHhaKyY6nwkpSN5jrSM8QGb5SS0GfcTXKVYs75ouJp1SulYVv9MKFUt3M_2ah_dbskKZaw6uUAd6tBC-Q6DLCO_0OkfVMWUGflw6QnoEjiP_UoBSHP2DeY44XvWuJo6Yn7vQ1_FUao2XvkJtK-ZEeQiPHVVhiv8ydXk19eogbys2DcbVV6fFulcBswMkzABcwtaLC3xsT5v31vV-hNlOtZhQTBin-SZ5-i4-YVjGbJv9IbLnLuJvtlnAI4sX7XG0cQ3PirAdOmq6DRs_3n24x0kIQ49B4q0v2s-ZufOswcUq1rsnqFK-lvAtf-EtzJIP6C7W0MJt-TsSlk6S3lcsjKQ6xXwdrkPneHML", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ca57294", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d5c067db-733b-4279-948a-d2191c93d979", "record_id": "flaws_cloudtrail:0000320:d5c067db-733b-4279-948a-d2191c93d979", "row_index": 320, "timestamp": "2018-04-17T07:24:25Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d5c067db-733b-4279-948a-d2191c93d979", "eventTime": "2018-04-17T07:24:25Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fc17567-c9ca-49a4-a5fd-4640dd7a3ee7", "record_id": "flaws_cloudtrail:0000321:fc17567-c9ca-49a4-a5fd-4640dd7a3ee7", "row_index": 321, "timestamp": "2018-04-17T07:24:25Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 906, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fc17567-c9ca-49a4-a5fd-4640dd7a3ee7", "eventTime": "2018-04-17T07:24:25Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "756990c7-6ea7-4014-b188-fd0c2c176bbf", "record_id": "flaws_cloudtrail:0000322:756990c7-6ea7-4014-b188-fd0c2c176bbf", "row_index": 322, "timestamp": "2018-04-17T07:24:26Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "756990c7-6ea7-4014-b188-fd0c2c176bbf", "eventTime": "2018-04-17T07:24:26Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d4c93d07-986c-4ffe-bc2a-ef990a441518", "record_id": "flaws_cloudtrail:0000323:d4c93d07-986c-4ffe-bc2a-ef990a441518", "row_index": 323, "timestamp": "2018-04-17T07:24:27Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d4c93d07-986c-4ffe-bc2a-ef990a441518", "eventTime": "2018-04-17T07:24:27Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d9a6b72d-3ee3-41c2-a818-f5fc8aa31778", "record_id": "flaws_cloudtrail:0000324:d9a6b72d-3ee3-41c2-a818-f5fc8aa31778", "row_index": 324, "timestamp": "2018-04-17T07:24:28Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1381, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d9a6b72d-3ee3-41c2-a818-f5fc8aa31778", "eventTime": "2018-04-17T07:24:28Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-02d34bac", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "277deeb5-4c2f-478c-adad-902a43bf94ef", "record_id": "flaws_cloudtrail:0000325:277deeb5-4c2f-478c-adad-902a43bf94ef", "row_index": 325, "timestamp": "2018-04-17T07:24:28Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1330, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "277deeb5-4c2f-478c-adad-902a43bf94ef", "eventTime": "2018-04-17T07:24:28Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Server.InsufficientInstanceCapacity", "errorMessage": "We currently do not have sufficient c5.18xlarge capacity in zones with support for 'gp2' volumes. Our system will be working on provisioning additional capacity.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-dc82b8b9", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "16883fcd-1357-458f-aa31-03c8833aaa61", "record_id": "flaws_cloudtrail:0000326:16883fcd-1357-458f-aa31-03c8833aaa61", "row_index": 326, "timestamp": "2018-04-17T07:24:28Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "16883fcd-1357-458f-aa31-03c8833aaa61", "eventTime": "2018-04-17T07:24:28Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4d4fc004-57f4-4be9-b790-dd090c3d7c2a", "record_id": "flaws_cloudtrail:0000327:4d4fc004-57f4-4be9-b790-dd090c3d7c2a", "row_index": 327, "timestamp": "2018-04-17T07:24:29Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4d4fc004-57f4-4be9-b790-dd090c3d7c2a", "eventTime": "2018-04-17T07:24:29Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "00b10382-3021-4339-a077-1c3604bdaa0e", "record_id": "flaws_cloudtrail:0000328:00b10382-3021-4339-a077-1c3604bdaa0e", "row_index": 328, "timestamp": "2018-04-17T07:24:29Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "00b10382-3021-4339-a077-1c3604bdaa0e", "eventTime": "2018-04-17T07:24:29Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ed5936e2-754c-46d3-a1f6-d713c2f0eb78", "record_id": "flaws_cloudtrail:0000329:ed5936e2-754c-46d3-a1f6-d713c2f0eb78", "row_index": 329, "timestamp": "2018-04-17T07:24:30Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1381, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ed5936e2-754c-46d3-a1f6-d713c2f0eb78", "eventTime": "2018-04-17T07:24:30Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-02d34bac", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "901f8565-c45a-4feb-a6b3-ef2fdd9e0ed3", "record_id": "flaws_cloudtrail:0000330:901f8565-c45a-4feb-a6b3-ef2fdd9e0ed3", "row_index": 330, "timestamp": "2018-04-17T07:24:30Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 802, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "901f8565-c45a-4feb-a6b3-ef2fdd9e0ed3", "eventTime": "2018-04-17T07:24:30Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1c1f6806-187c-426f-a4b0-0c5f8eede575", "record_id": "flaws_cloudtrail:0000331:1c1f6806-187c-426f-a4b0-0c5f8eede575", "row_index": 331, "timestamp": "2018-04-17T07:24:30Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1376, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1c1f6806-187c-426f-a4b0-0c5f8eede575", "eventTime": "2018-04-17T07:24:30Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-009dc204", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c665561-eae3-44d2-becf-dd7abaee63be", "record_id": "flaws_cloudtrail:0000332:c665561-eae3-44d2-becf-dd7abaee63be", "row_index": 332, "timestamp": "2018-04-17T07:24:31Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 802, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c665561-eae3-44d2-becf-dd7abaee63be", "eventTime": "2018-04-17T07:24:31Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "455edeb2-2426-4233-92e7-a7b2c4dacfc8", "record_id": "flaws_cloudtrail:0000333:455edeb2-2426-4233-92e7-a7b2c4dacfc8", "row_index": 333, "timestamp": "2018-04-17T07:24:31Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1382, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "455edeb2-2426-4233-92e7-a7b2c4dacfc8", "eventTime": "2018-04-17T07:24:31Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-02d34bac", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ade9cda0-b0e9-4749-97e6-cc4c2b95f7fc", "record_id": "flaws_cloudtrail:0000334:ade9cda0-b0e9-4749-97e6-cc4c2b95f7fc", "row_index": 334, "timestamp": "2018-04-17T07:24:31Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 802, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ade9cda0-b0e9-4749-97e6-cc4c2b95f7fc", "eventTime": "2018-04-17T07:24:31Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "19c54f45-6e0e-42e4-adb0-e043628", "record_id": "flaws_cloudtrail:0000335:19c54f45-6e0e-42e4-adb0-e043628", "row_index": 335, "timestamp": "2018-04-17T07:24:31Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1371, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "19c54f45-6e0e-42e4-adb0-e043628", "eventTime": "2018-04-17T07:24:31Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-009dc204", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f87f4bf0-60b1-4378-92b5-dacd141af13a", "record_id": "flaws_cloudtrail:0000336:f87f4bf0-60b1-4378-92b5-dacd141af13a", "row_index": 336, "timestamp": "2018-04-17T07:24:32Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 804, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f87f4bf0-60b1-4378-92b5-dacd141af13a", "eventTime": "2018-04-17T07:24:32Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8e942ff9-e6b3-4b83-a3fb-88baccf8c8f4", "record_id": "flaws_cloudtrail:0000337:8e942ff9-e6b3-4b83-a3fb-88baccf8c8f4", "row_index": 337, "timestamp": "2018-04-17T07:24:32Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1937, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8e942ff9-e6b3-4b83-a3fb-88baccf8c8f4", "eventTime": "2018-04-17T07:24:32Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: 10hJCVwWf_0r2MJpQWw0NdeF9nVmatu89aZkYInXau8L4teJlHsl7z3qoZJqzCZV7LYDQWNUc4GkZsckEDXX9qYWNbnmu9h56MrS0_ZzpE8FRIv4tXRXfF6M6MeMbBA8TYA12jI7JOrSfHY_GVA8AYAgopKoQpDvQKkxgTgBfCRmWw7lqaRptYCH9AL5t7tJrtl_6fN5ZuU33MuoqLYuKlirlHQ6FRHoOcdrWFO_OCMyjHFzVG6B7JrZ1A-ZGRHrKO2OFQ9VLk3eP2iSHte2nfyqxEfwqD44xLzX-xp1OmMBw6-XbeGWzF9v9A9mX0aPDV8a6NyYT9OslKIHfiY2WN-0077Gk-DZfXaSqMD8vvslsTJHPIOvtGZ0lNVTjW_WlH0WiQUchPPD9Kj9KEpYuamK5v4txdrJdMwzqLYwzb9tX0bdLYkH_9tUwm1VFGNR21LSL9qBcfb00CKPR2-2nv43s6teYsEnoB2xNddrFDvR-yQU7Urb15YuD_RShSXZHMM_-A8-4-iPlIxjJ-ee4PHsIKTbOkg0Oh-5ShLk5tZu1HHgQs28aGCuwAv_nceOfdjEnJ_juAEkuFtP4HhHh2uA9qJoJMm7SSW_o9lQl6re0_VHNFdsxZyTjQ0CNfjdXj5CvCEUSZRLjV8Z_aPB6jFvlD0wHIPvSdqOB0Q", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-02d34bac", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "375500-a1eb-43db-bf6f-9f684f88fc1a", "record_id": "flaws_cloudtrail:0000338:375500-a1eb-43db-bf6f-9f684f88fc1a", "row_index": 338, "timestamp": "2018-04-17T07:24:32Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1329, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "375500-a1eb-43db-bf6f-9f684f88fc1a", "eventTime": "2018-04-17T07:24:32Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Server.InsufficientInstanceCapacity", "errorMessage": "We currently do not have sufficient c5.18xlarge capacity in zones with support for 'gp2' volumes. Our system will be working on provisioning additional capacity.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-dc82b8b9", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f25f4d57-6131-4295-8872-8c46c30787", "record_id": "flaws_cloudtrail:0000339:f25f4d57-6131-4295-8872-8c46c30787", "row_index": 339, "timestamp": "2018-04-17T07:24:32Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1374, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f25f4d57-6131-4295-8872-8c46c30787", "eventTime": "2018-04-17T07:24:32Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-71cdc376", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3fa42e24-f928-4f0e-b51e-6b6b9d008804", "record_id": "flaws_cloudtrail:0000340:3fa42e24-f928-4f0e-b51e-6b6b9d008804", "row_index": 340, "timestamp": "2018-04-17T07:24:32Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1378, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3fa42e24-f928-4f0e-b51e-6b6b9d008804", "eventTime": "2018-04-17T07:24:32Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-009dc204", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1a0a6cf8-5f23-4cee-8d75-88ff988311", "record_id": "flaws_cloudtrail:0000341:1a0a6cf8-5f23-4cee-8d75-88ff988311", "row_index": 341, "timestamp": "2018-04-17T07:24:33Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 801, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1a0a6cf8-5f23-4cee-8d75-88ff988311", "eventTime": "2018-04-17T07:24:33Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5e73826-04de-4849-a621-189266f794e15", "record_id": "flaws_cloudtrail:0000342:5e73826-04de-4849-a621-189266f794e15", "row_index": 342, "timestamp": "2018-04-17T07:24:33Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 911, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5e73826-04de-4849-a621-189266f794e15", "eventTime": "2018-04-17T07:24:33Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bff812cd-0656-4ba0-a994-cac6c8e1ef6a", "record_id": "flaws_cloudtrail:0000343:bff812cd-0656-4ba0-a994-cac6c8e1ef6a", "row_index": 343, "timestamp": "2018-04-17T07:24:33Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1287, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bff812cd-0656-4ba0-a994-cac6c8e1ef6a", "eventTime": "2018-04-17T07:24:33Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Server.InsufficientInstanceCapacity", "errorMessage": "Insufficient capacity.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-dc82b8b9", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2f16b14f-0913-40e6-a23b-fd822fd4ba89", "record_id": "flaws_cloudtrail:0000344:2f16b14f-0913-40e6-a23b-fd822fd4ba89", "row_index": 344, "timestamp": "2018-04-17T07:24:33Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1374, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2f16b14f-0913-40e6-a23b-fd822fd4ba89", "eventTime": "2018-04-17T07:24:33Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-71cdc376", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bd289b43-d6b7-4aac-ae37-c5742f9d2c61", "record_id": "flaws_cloudtrail:0000345:bd289b43-d6b7-4aac-ae37-c5742f9d2c61", "row_index": 345, "timestamp": "2018-04-17T07:24:34Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1270, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bd289b43-d6b7-4aac-ae37-c5742f9d2c61", "eventTime": "2018-04-17T07:24:34Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-71cdc376", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "89e9f22f-9b5a-434e-ab8f-c6b831ffa6a5", "record_id": "flaws_cloudtrail:0000346:89e9f22f-9b5a-434e-ab8f-c6b831ffa6a5", "row_index": 346, "timestamp": "2018-04-17T07:24:34Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1926, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "89e9f22f-9b5a-434e-ab8f-c6b831ffa6a5", "eventTime": "2018-04-17T07:24:34Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: c_KeW7yunOjB8tWa71Kc41FxozZXtrnRHH-URD0l8J_8xTzr5-jl6AOHwPztg8cgBn81vuCJhpqzdXVVbTnNtj1eSCMxJd6TUCChb-r9F3FLxBme9mLhP0z-9EPUpWppyK22nQN75sXKJF4yqHS0eI1shGdTKWEMzXy6sfy8ZRaRmFd1p8ViFTbs41Mn_GcnnuFvcE5gqetn-x7cMYe4GfQRSgSV5Vj4rEQdp9bSrUZoH0FZt-5U_hTdxzrWm9rz93bWi8b_5efpkEZoAy2P7L0xrLDNtVo_Db1hGu3PPqlGY5W8rAmI6JSOzurGbEB_sykPPXigzzRZVx7_PyYIPu9H_OqaNgW9Xu-YXBQEa6ftb055N8BC1xn7tNw6tH6oE4NV2sMhEezzPJaCyF_JmPn8eP6cAr-aMQwLFm_uByZoa7nARdM04kUZohasE1E2TUVILfNz-UrxnlW1xvqFBpxMzwF3kET_lYx1s4GHvDQYe-SFBpivBe3up1QQCzl1DsLxoo-kyEkR08Z4O2zvBiHMA19WoQt1Kd4Z3YP4VhLJ7Q0SIJaJZp1eKr5Bl8Laj9Ddy5AprObvVuaOa5rAsP8-nYPR4tSCORm4w9G46NW3Ai5u8HKAKHZyXP2sSJlYm7fATq0ze36Aa3bvlBfD4rLLdqjUl3QSwQ", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-009dc204", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bdd9cc0a-1dbb-41d7-922d-60f609a782b4", "record_id": "flaws_cloudtrail:0000347:bdd9cc0a-1dbb-41d7-922d-60f609a782b4", "row_index": 347, "timestamp": "2018-04-17T07:24:35Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 1377, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bdd9cc0a-1dbb-41d7-922d-60f609a782b4", "eventTime": "2018-04-17T07:24:35Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-8c971d21", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "336ba911-9dd9-4b89-8034-6f04e1c498275", "record_id": "flaws_cloudtrail:0000348:336ba911-9dd9-4b89-8034-6f04e1c498275", "row_index": 348, "timestamp": "2018-04-17T07:24:35Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "336ba911-9dd9-4b89-8034-6f04e1c498275", "eventTime": "2018-04-17T07:24:35Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4b035e41-acde-4e74-b54e-a0bc72d67d12", "record_id": "flaws_cloudtrail:0000349:4b035e41-acde-4e74-b54e-a0bc72d67d12", "row_index": 349, "timestamp": "2018-04-17T07:24:35Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1926, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4b035e41-acde-4e74-b54e-a0bc72d67d12", "eventTime": "2018-04-17T07:24:35Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: fae35MXuwqhoKB3WpzciNSdRPLoQZ7OPn_xrvClrdb9ieAfQj3X0hBB8t1QytihdrkL7AL1d9_t3Lifb9Yu51OZfRbrV585q6WnWmB8f37eZZKjc17DyLIH8c0VkA8KFMFjjpcBD5luRGwgccubDrUPWt47_a24RXi2FLULpxFeZ3Tk8WjSG0UYxUJ6Htf9VexNxpmHrLGV_9hskZsFa7c644yMWoT4KRRpAv87HGBPLYzNXujhILVs4RruTyXZ8ngSmXSydBc_NlIgVhF_e72FX8Ku_-FNb85lR0SIpKAPHsgzAqbnWm3o2J1YWy6MhDuSOQwBXfDhhSbnWXo5QBfxTrzOa0L6h4Tqa1Hr49jjEEoiSAP-uNm0jTAFnyA1V57g6UFWwB_Q0Eg9HnXLPncvHYbM2lx18hbJ-E_zPnFLtya9ybW3QcpQmsNOHCgNdlEOEMP1RKBH6iyWNhFRwJu0WePp1wFX5ePdCkjhf-IAoFYIrUE275Pj3LJ_1U70umvTVDyHOvZAPPRmSMlRQcf52rxdxhBN1kwh-J2D9vi76EHuIZcSEgf0EVUVvZTGE5pfTfPTgzFviPpCBtdyloJRuVsQ-yQ1V1xl8bbIQbK4emoIukMEqlCrdu9VjAEAmuEBk8QcsClAl_JtJPYa7xaLLNylExsiCUg", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-71cdc376", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b52a35ae-d67f-49d6-86fa-13b50a38885a", "record_id": "flaws_cloudtrail:0000350:b52a35ae-d67f-49d6-86fa-13b50a38885a", "row_index": 350, "timestamp": "2018-04-17T07:24:36Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 1377, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b52a35ae-d67f-49d6-86fa-13b50a38885a", "eventTime": "2018-04-17T07:24:36Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-8c971d21", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "202580de-a87e-411c-b43f-6723bd49b68a", "record_id": "flaws_cloudtrail:0000351:202580de-a87e-411c-b43f-6723bd49b68a", "row_index": 351, "timestamp": "2018-04-17T07:24:36Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 908, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "202580de-a87e-411c-b43f-6723bd49b68a", "eventTime": "2018-04-17T07:24:36Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7486a896-9c07-44a8-8d57-ec3d99d3b9aa", "record_id": "flaws_cloudtrail:0000352:7486a896-9c07-44a8-8d57-ec3d99d3b9aa", "row_index": 352, "timestamp": "2018-04-17T07:24:36Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1287, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7486a896-9c07-44a8-8d57-ec3d99d3b9aa", "eventTime": "2018-04-17T07:24:36Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Server.InsufficientInstanceCapacity", "errorMessage": "Insufficient capacity.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-dc82b8b9", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c04607e-1553-43fb-8875-7d282cc0e700", "record_id": "flaws_cloudtrail:0000353:c04607e-1553-43fb-8875-7d282cc0e700", "row_index": 353, "timestamp": "2018-04-17T07:24:37Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 804, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c04607e-1553-43fb-8875-7d282cc0e700", "eventTime": "2018-04-17T07:24:37Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ba7a9331-3944-4f48-9abe-2292c9a4bdc0", "record_id": "flaws_cloudtrail:0000354:ba7a9331-3944-4f48-9abe-2292c9a4bdc0", "row_index": 354, "timestamp": "2018-04-17T07:24:38Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 1271, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ba7a9331-3944-4f48-9abe-2292c9a4bdc0", "eventTime": "2018-04-17T07:24:38Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-8c971d21", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "24926-6e6a-427e-bd96-7a12262", "record_id": "flaws_cloudtrail:0000355:24926-6e6a-427e-bd96-7a12262", "row_index": 355, "timestamp": "2018-04-17T07:24:38Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 799, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "24926-6e6a-427e-bd96-7a12262", "eventTime": "2018-04-17T07:24:38Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6ef5fceb-444e-4960-9c64-a52e6f09431b", "record_id": "flaws_cloudtrail:0000356:6ef5fceb-444e-4960-9c64-a52e6f09431b", "row_index": 356, "timestamp": "2018-04-17T07:24:39Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6ef5fceb-444e-4960-9c64-a52e6f09431b", "eventTime": "2018-04-17T07:24:39Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "be1e856a-4201-477e-9aa9-6073ab614757e", "record_id": "flaws_cloudtrail:0000357:be1e856a-4201-477e-9aa9-6073ab614757e", "row_index": 357, "timestamp": "2018-04-17T07:24:39Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1288, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "be1e856a-4201-477e-9aa9-6073ab614757e", "eventTime": "2018-04-17T07:24:39Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Server.InsufficientInstanceCapacity", "errorMessage": "Insufficient capacity.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-dc82b8b9", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "65e963065-f593-4526-9b32-35f60307a0a", "record_id": "flaws_cloudtrail:0000358:65e963065-f593-4526-9b32-35f60307a0a", "row_index": 358, "timestamp": "2018-04-17T07:24:40Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 1930, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "65e963065-f593-4526-9b32-35f60307a0a", "eventTime": "2018-04-17T07:24:40Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: oYODqYwox24DEY6T-sH2Bjb7eaBghy6_Aw9tD5QJiWw5_KKTxWCOKMjRaXvCYP415sm9aSvswj1TxjCuJINUrqf1Ly85L6JFsFvIFU-7EN3gw4RYcO5JvRX_bRHDxM2wn-yKB_Uc29jdSkOlRZpqUCMjRUSVg2-bhcg48OxIMzN0qym_lcly9ni-J-h6Q2sbcfoLFOei1Tu9WAwaFyi1G6cC0aFSUlk7MgV9cGazFKwYgNPdX6nK0fuZwfw67ZitrlrFvalDSkD2u047svQceS1yBZseZr9zxgj54SDcVr8Tr8PmlsANQ32L9NSpw7kxdgOZ4t3LkVEFYMsQIV2L_jGAxTo0NN50J9k_FhPtQeAWb30QLY8qfX_CvceL6yaGjGnLODkqvfUtrHhH7O14ICew6SMT8m_mnyMsO2i-QNQpB3krbPOfCYdRvGEzPBIQC41fPams8E7tzc1agKRFW_ZtdSeQ6tJwCHrcqUSNnViDmiaFLChpw3esHlX7zJfWohyTy_i4UIXAFnioRIflckgyIeYjgmFme9dl03yUjkDuvDq2WE8jbuZ80cf1u_JsHlheQNyca-7Rlf-DbtmMZSPREp5Vkrq3u2i1WU39XHb3TB27BRZCRfC8hUhEL6l2IiMpkOy9_SFZj_k9hlY-QXlpPO5qPT937Km9", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-8c971d21", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4034cff7-68fc-481f-b2e3-54bdab804dbb", "record_id": "flaws_cloudtrail:0000359:4034cff7-68fc-481f-b2e3-54bdab804dbb", "row_index": 359, "timestamp": "2018-04-17T07:24:40Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 805, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4034cff7-68fc-481f-b2e3-54bdab804dbb", "eventTime": "2018-04-17T07:24:40Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a588a2a7-e075-43fe-ba35-174617d278", "record_id": "flaws_cloudtrail:0000360:a588a2a7-e075-43fe-ba35-174617d278", "row_index": 360, "timestamp": "2018-04-17T07:24:40Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 801, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a588a2a7-e075-43fe-ba35-174617d278", "eventTime": "2018-04-17T07:24:40Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e02a52d9-27db-40b3-999f-0d979d8457cb", "record_id": "flaws_cloudtrail:0000361:e02a52d9-27db-40b3-999f-0d979d8457cb", "row_index": 361, "timestamp": "2018-04-17T07:24:41Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1379, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e02a52d9-27db-40b3-999f-0d979d8457cb", "eventTime": "2018-04-17T07:24:41Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-d10c94e9", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "231b6954-9121-43d8-903a-a43b3f1f38bf", "record_id": "flaws_cloudtrail:0000362:231b6954-9121-43d8-903a-a43b3f1f38bf", "row_index": 362, "timestamp": "2018-04-17T07:24:41Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 801, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "231b6954-9121-43d8-903a-a43b3f1f38bf", "eventTime": "2018-04-17T07:24:41Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9b65abf5-ab54-4fe6-807b-d25c1f44dc76", "record_id": "flaws_cloudtrail:0000363:9b65abf5-ab54-4fe6-807b-d25c1f44dc76", "row_index": 363, "timestamp": "2018-04-17T07:24:41Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 798, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9b65abf5-ab54-4fe6-807b-d25c1f44dc76", "eventTime": "2018-04-17T07:24:41Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "166003-5b15-43bc-ad5b-be2e27b24c47", "record_id": "flaws_cloudtrail:0000364:166003-5b15-43bc-ad5b-be2e27b24c47", "row_index": 364, "timestamp": "2018-04-17T07:24:41Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 905, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "166003-5b15-43bc-ad5b-be2e27b24c47", "eventTime": "2018-04-17T07:24:41Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "db7307e8-5a29-4144-9e30-4c0c6abf3fa9", "record_id": "flaws_cloudtrail:0000365:db7307e8-5a29-4144-9e30-4c0c6abf3fa9", "row_index": 365, "timestamp": "2018-04-17T07:24:42Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1379, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "db7307e8-5a29-4144-9e30-4c0c6abf3fa9", "eventTime": "2018-04-17T07:24:42Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-d10c94e9", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0b58bb32-1bb9-4be0-ae78-d4fe1da9de70", "record_id": "flaws_cloudtrail:0000366:0b58bb32-1bb9-4be0-ae78-d4fe1da9de70", "row_index": 366, "timestamp": "2018-04-17T07:24:42Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1376, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0b58bb32-1bb9-4be0-ae78-d4fe1da9de70", "eventTime": "2018-04-17T07:24:42Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-2b129c1b", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fcdde1dd-5748-4781-b6e0-29e5a97e71e0", "record_id": "flaws_cloudtrail:0000367:fcdde1dd-5748-4781-b6e0-29e5a97e71e0", "row_index": 367, "timestamp": "2018-04-17T07:24:42Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fcdde1dd-5748-4781-b6e0-29e5a97e71e0", "eventTime": "2018-04-17T07:24:42Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "82a44b74-35a3-4b95-b01a-3438ccebcd82", "record_id": "flaws_cloudtrail:0000368:82a44b74-35a3-4b95-b01a-3438ccebcd82", "row_index": 368, "timestamp": "2018-04-17T07:24:43Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1273, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "82a44b74-35a3-4b95-b01a-3438ccebcd82", "eventTime": "2018-04-17T07:24:43Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-d10c94e9", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "27b016e5-ae2b-46f1-8f57-eac9d4cdd6ca", "record_id": "flaws_cloudtrail:0000369:27b016e5-ae2b-46f1-8f57-eac9d4cdd6ca", "row_index": 369, "timestamp": "2018-04-17T07:24:43Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1376, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "27b016e5-ae2b-46f1-8f57-eac9d4cdd6ca", "eventTime": "2018-04-17T07:24:43Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-2b129c1b", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6f62ed90-a0be-462a-8501-ade9ad4a02b3", "record_id": "flaws_cloudtrail:0000370:6f62ed90-a0be-462a-8501-ade9ad4a02b3", "row_index": 370, "timestamp": "2018-04-17T07:24:43Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 800, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6f62ed90-a0be-462a-8501-ade9ad4a02b3", "eventTime": "2018-04-17T07:24:43Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f00ca43d-ff9c-4970-99ae-fcb9e1af4bb9", "record_id": "flaws_cloudtrail:0000371:f00ca43d-ff9c-4970-99ae-fcb9e1af4bb9", "row_index": 371, "timestamp": "2018-04-17T07:24:43Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1287, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f00ca43d-ff9c-4970-99ae-fcb9e1af4bb9", "eventTime": "2018-04-17T07:24:43Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Server.InsufficientInstanceCapacity", "errorMessage": "Insufficient capacity.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-dc82b8b9", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e03540d-5814-4b11-bc3c-5720925d40ab", "record_id": "flaws_cloudtrail:0000372:e03540d-5814-4b11-bc3c-5720925d40ab", "row_index": 372, "timestamp": "2018-04-17T07:24:44Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1377, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e03540d-5814-4b11-bc3c-5720925d40ab", "eventTime": "2018-04-17T07:24:44Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-2b129c1b", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d3e078be-f948-4971-9c91-78055f0", "record_id": "flaws_cloudtrail:0000373:d3e078be-f948-4971-9c91-78055f0", "row_index": 373, "timestamp": "2018-04-17T07:24:44Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1371, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d3e078be-f948-4971-9c91-78055f0", "eventTime": "2018-04-17T07:24:44Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-63f71193", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "95ce618c-b518-4b1b-aa61-1120cccae7de", "record_id": "flaws_cloudtrail:0000374:95ce618c-b518-4b1b-aa61-1120cccae7de", "row_index": 374, "timestamp": "2018-04-17T07:24:45Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1930, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "95ce618c-b518-4b1b-aa61-1120cccae7de", "eventTime": "2018-04-17T07:24:45Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: T6gO9Joe-WMdOGQpQ2f9KjGh1iTcTxGPV8V37Tvy7X9lnjzM8ZXfCZRKnoHVTItLrDE-mHaMKw0hjj_7ce2ND9PCAdoH4RS21ZuUqJGM0vOx5_Q-eSgNGt0xdQ8tgLMUPl1uE6iAJyyNNGj-WR6V6Uf2u0Ll_-XlS7SPHL7xChQUFu-23_KKmHFyyYN-X4F007A3PHIaHXfYyeoJ4gMu3I9dbVhYtxdKaVDwjt24Fwn-aiwV2BK79wD_r6PX5E0c2lyhRYTGYDsgLrKzJN6ZOTvj78EHOguRUe07jzYWK9MkzN9j8fgC0PrxmvUVF4OJkHjP5SO6HdG1ksLpBcSd_QJGFGhVvAQjjaPRkaJ0wGdPEvGbCjRHrMUagM9NmVHK6zHPzK1XZKrmvFoVVLCYRPE84pn1Q39uSzGZ701vMLihlb_BgdmrlOy4FG9WlryKVGMIkchkDqi4JkqO3eWePGY29-_UNcApxwQuy-7GojxkHO_OhfIo3mpqMsaCFx4hBImL_ulv4q4qMN802QBR8uIhtA0M3hyvTgn_lqY8ansm53zkfQ9rnZuv06VfVqTGhzm6FqbQMXn25r8EU_JmjSAUuQo_HsQFZ-83fMmOFyD-YAp5d5lo_N5BEZINmVoMxJcSJx_eZl4zI_wV8DGBB841DTBZ4d9i26E", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-d10c94e9", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "73b703779-21b9-422b-add2-a35330a43001", "record_id": "flaws_cloudtrail:0000375:73b703779-21b9-422b-add2-a35330a43001", "row_index": 375, "timestamp": "2018-04-17T07:24:45Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1927, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "73b703779-21b9-422b-add2-a35330a43001", "eventTime": "2018-04-17T07:24:45Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: WYiEAWJtNXh4Z4glz1hQNkmYPDLqwoppj4u5MeCzqTNTrH051SXmvEUjqk9L-zYFqiUdxnl06Mt_Ih9ZQlfgiRoDkxuPs3eoakhZHr2HW6ip8g1vm1HdgvYZc-9XUYhxIOQuvgcS4kCd6xJYpu4VsSSeq3MjWFT5LPyD5wwUaJOjrcMXo7YpbQpPmNZXUmA02YwYgsP-1FOh1frerxg4xJLDRvG7Rt4Mz7SeX6LCVy-su3gLpHdEIE5WsSR4DY-NLKvinWN8afusKgQhh1m6sb-lu-Agfe8hf9lbK3BDE6cdORJlhKBfQKDvGugIDT2J2gqFE0gxJw_oR1Hv4B4KhSs6oS048UhDWECCtQhkAm83Vk0CaVm7Riy7B3Tj7ciKU0GlMQqucoAtPJmfd-28EIxBxMRMWAVS2cWBAGzBUWxrgM_uoHvUFpmk9CntEKtbRQlsM0oRwEWjzfC9YpOGwQdu035BMIE4cc5Jkq1B4_GZ8dybI-GviJkqPt2SLyxTqrRFhUtkKOuRuMKPsx7qvoW7FG37GNCTYRNU0ueqqLPKGnlOrodtGjCXZie-xweY_Bt5dLgkaFmctV7Ur5jShExLYYfCjzmG_vnF43onqthSF0lvAfUuK3dae7nE36qTCexrnh0ms3d-YYbwH-0Y9hAJJ7wWGdAY7Q", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-2b129c1b", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "331462cc3-dcee-46f8-b2e3-9fd1e7a88ef1", "record_id": "flaws_cloudtrail:0000376:331462cc3-dcee-46f8-b2e3-9fd1e7a88ef1", "row_index": 376, "timestamp": "2018-04-17T07:24:45Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "331462cc3-dcee-46f8-b2e3-9fd1e7a88ef1", "eventTime": "2018-04-17T07:24:45Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f62b56f9-9927-48fc-8701-18ada02d3467", "record_id": "flaws_cloudtrail:0000377:f62b56f9-9927-48fc-8701-18ada02d3467", "row_index": 377, "timestamp": "2018-04-17T07:24:46Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1376, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f62b56f9-9927-48fc-8701-18ada02d3467", "eventTime": "2018-04-17T07:24:46Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-63f71193", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0ee8eb68-e3bf-47ed-82b8-b8f3d60cde7a", "record_id": "flaws_cloudtrail:0000378:0ee8eb68-e3bf-47ed-82b8-b8f3d60cde7a", "row_index": 378, "timestamp": "2018-04-17T07:24:46Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0ee8eb68-e3bf-47ed-82b8-b8f3d60cde7a", "eventTime": "2018-04-17T07:24:46Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0958d271-68f7-41f4-aa36-70eee51be6f8", "record_id": "flaws_cloudtrail:0000379:0958d271-68f7-41f4-aa36-70eee51be6f8", "row_index": 379, "timestamp": "2018-04-17T07:24:47Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1270, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0958d271-68f7-41f4-aa36-70eee51be6f8", "eventTime": "2018-04-17T07:24:47Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-63f71193", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d65775-3a6e-476d-9674-8e7699f27e3e", "record_id": "flaws_cloudtrail:0000380:d65775-3a6e-476d-9674-8e7699f27e3e", "row_index": 380, "timestamp": "2018-04-17T07:24:47Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 801, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d65775-3a6e-476d-9674-8e7699f27e3e", "eventTime": "2018-04-17T07:24:47Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "87a37042-47cb-4cb5-bf9f-62b0827bffb4", "record_id": "flaws_cloudtrail:0000381:87a37042-47cb-4cb5-bf9f-62b0827bffb4", "row_index": 381, "timestamp": "2018-04-17T07:24:49Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1926, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "87a37042-47cb-4cb5-bf9f-62b0827bffb4", "eventTime": "2018-04-17T07:24:49Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: Ox_VTtrRPR-yPODHRDhptZQnLXfAZ-SU_c46Egd9s937Z2DzspC4FcwkCxDJmOWEMDVuzzqrsOExIMDUVqsEBTmC0dqTY_z17Vy3tNygTIJyH6Vb40BbDjRvMVigBVCITOOedAbWHG_S76smIIckDW3WWJsJxOiq6u-kw74Ty_4BQB0rf7yuJ992FWilI09PYgL5uAxewaHKlLPTpA-doMnYzNNX8DL-A8VFwLVxBjd_fxJIihyKwWneDrtxiGSKLThGo58k4oWJ3--4CX_MprgBaW1w1RRKyZJ63H5qdZbL0KlPAo8g5Y9XYX_tDUm5dvtzkJWYYhfDCGx_9OVGXZJwtjx8HnYn-kbsXJeJcLXQGWAthR08n_B7ws6ZcAduFFxqPOkwNDzWT7c6DobfnwasBMyDep5d8Sq8iD_32M4CXkh520blklg7erX4lyARDtvJ3M5b04SFTF59pS33pzFw4PEGQoh5DYwhWUZM8XCDECDVQm88sW8BdQNLw394bN4WhFthRLxz8wmaaCaW715Ipjhdm9xMCGqBJHlZ37p4owVq32Pe5JuoT3R71z7i4GgUvEeI7rLsMVWPI2hQDomZDyLsfUwqZF2JSU65BNJkpRkuW2Vs_olJMDtJOCUDYIBRLx3MP9mEbMoMG5UfawOsfH5ZO47cFA", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-63f71193", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "60e5360f-85d6-4567-8165-786c31e1586e", "record_id": "flaws_cloudtrail:0000382:60e5360f-85d6-4567-8165-786c31e1586e", "row_index": 382, "timestamp": "2018-04-17T07:24:49Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 1376, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "60e5360f-85d6-4567-8165-786c31e1586e", "eventTime": "2018-04-17T07:24:49Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-3a3a9be3", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6ec97b59-7459-4de0-b26b-30a9d03b40e4", "record_id": "flaws_cloudtrail:0000383:6ec97b59-7459-4de0-b26b-30a9d03b40e4", "row_index": 383, "timestamp": "2018-04-17T07:24:50Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 1376, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6ec97b59-7459-4de0-b26b-30a9d03b40e4", "eventTime": "2018-04-17T07:24:50Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-3a3a9be3", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f86f6a06-4263-4101-9c34-b81288af0537", "record_id": "flaws_cloudtrail:0000384:f86f6a06-4263-4101-9c34-b81288af0537", "row_index": 384, "timestamp": "2018-04-17T07:24:50Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 2021, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f86f6a06-4263-4101-9c34-b81288af0537", "eventTime": "2018-04-17T07:24:50Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: mVGT95bwvs2jsHdtYpb2A905Nq1mPMzS4DOBxwfaxY7bjtG3xYelU5xp6tq-uqWcDH2rNH8gSE7D4ohXwyp9Ay336iFSTqN81OGIGKFWAu-aMMEj-NP-FgNgVfGkdiPerzSiYHXdpkUnBt1p2CA9t_Znon65pBlAG7pmtI63PYlhVsWUU9yZuyumR_40ciM0vEvqF-F6SPsP76rVTC7DQj2A1QzabMj5ciskMbTI0m7yIhcsN0UDskACv6SfGzK1pj8zqbwzLBQ5Fyr53P9J5T0DsbSrAI_hwajoWe31paZUqeBU2qxUxRik5f3LVcIxQ3zYdblSCS9XcIepiYZ7bvJfrSxlyCwYQBOZLvUcl8dTGiY3SwZEmkmTtqV7EMsRB5YTP3FTp97Fo6HIftv9j6UbXBrcJdBF16kHfTkF891OwX5DrWr5wGhcA1jpLBENL_YSUOB3datKuetZNn6Uequ44q9F-HROpXeQieY3ufK9B-oJa9wL7Bi_wKcNl93Mti-2EEMr0b9ToyXPMudOaiQMt2jfss1kDxHoDxEsMfw95QWRmSSgytJp-gBGMaka1TE1vRm2WrsLm3lefEyTBBU6jzWWWvPaS4sZvxpk5YheQ9-I32t77abYwRcf2p172N95jsxdMNcEB6zUx7TZkX5P_2h-gPdtNQ", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-dc82b8b9", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "14c84f50-caef-4205-bc9f-ac6c2fbc7f90", "record_id": "flaws_cloudtrail:0000385:14c84f50-caef-4205-bc9f-ac6c2fbc7f90", "row_index": 385, "timestamp": "2018-04-17T07:24:51Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 1270, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "14c84f50-caef-4205-bc9f-ac6c2fbc7f90", "eventTime": "2018-04-17T07:24:51Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-3a3a9be3", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "597ce6cb-e204-47ac-816c-c4729b810583", "record_id": "flaws_cloudtrail:0000386:597ce6cb-e204-47ac-816c-c4729b810583", "row_index": 386, "timestamp": "2018-04-17T07:24:53Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 1927, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "597ce6cb-e204-47ac-816c-c4729b810583", "eventTime": "2018-04-17T07:24:53Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: wKbdk76RHh02_b-5BPjKVEV6fAm1Bmu6dTxOFXcFxTEKS49ZW6C9WtZPJ4n8W3GC_wvs4XqCEkW9GmP_bx-tcTYQBhw1iarmtlrIOpc3K96aUMxuF8CnRzuT4OR9J3B1LKLRbVwKQsfq_vK1R0ljrJK6KdRdHvhs4g9yKt9sfjWYkD7e5v1xvF4xGttizp3ew_ubqSweTwDZOe1xQ2m4zxU1rRk1_8lQc3YqCQsmbwM3MSKeKRejqPXX4pFYpw3IelZnjsO6WgeEYCCw8fUipl8lB5Au1wawNroc434JBZKBrkvhy15o295SbI4-Pu_ifJlyEApaw0dSKiTDfI4aHfS2lAqek9OmxU47AQXxo0lzUhwmzA9d3ASnUFoo2xBqnkbY-zQJJ-ksarZL5AoYulWvFscwGkWkwYVYbbLwveQrZX5GNmAVYu9njWkWvl530tBUN0eqXT-abKDd4QOEG3Qf8D0CxUzpZgrK5skwRpP1rpYlAFaJg9rJyukB_oBvkBSDZTUhjs0JelM_uxz98uwxjruXULE6hDeXlKNBW1YSB6Cugj7mt4sqrLcSRZpLbOpCzgtIu8gplh7uDj5bm0Z6r7FUsRG4wy1S9SyT3iMzzyo_PX4vd5fpydv61Pd_oNGU6h86WdwUafcGDhvgfL76ib904dlNLT0", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-3a3a9be3", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5f5aebb0-be3b-4c55-8fe0-c8c921412e3", "record_id": "flaws_cloudtrail:0000387:5f5aebb0-be3b-4c55-8fe0-c8c921412e3", "row_index": 387, "timestamp": "2018-04-17T07:24:54Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 772, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5f5aebb0-be3b-4c55-8fe0-c8c921412e3", "eventTime": "2018-04-17T07:24:54Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0b83dd0d-7c4a-4148-a954-cddc3723b6d0", "record_id": "flaws_cloudtrail:0000388:0b83dd0d-7c4a-4148-a954-cddc3723b6d0", "row_index": 388, "timestamp": "2018-04-17T07:49:05Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 873, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0b83dd0d-7c4a-4148-a954-cddc3723b6d0", "eventTime": "2018-04-17T07:49:05Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5c1a4c6e-4d40-43d4-9769-2f8bab2ba03c", "record_id": "flaws_cloudtrail:0000389:5c1a4c6e-4d40-43d4-9769-2f8bab2ba03c", "row_index": 389, "timestamp": "2018-04-17T07:49:06Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5c1a4c6e-4d40-43d4-9769-2f8bab2ba03c", "eventTime": "2018-04-17T07:49:06Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e608da1f-4e2c-4629-8da2-6737c6db5596", "record_id": "flaws_cloudtrail:0000390:e608da1f-4e2c-4629-8da2-6737c6db5596", "row_index": 390, "timestamp": "2018-04-17T07:49:07Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 913, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e608da1f-4e2c-4629-8da2-6737c6db5596", "eventTime": "2018-04-17T07:49:07Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ce7dba62-87d1-4cd8-8b00-f177421d5978", "record_id": "flaws_cloudtrail:0000391:ce7dba62-87d1-4cd8-8b00-f177421d5978", "row_index": 391, "timestamp": "2018-04-17T07:49:07Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 913, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ce7dba62-87d1-4cd8-8b00-f177421d5978", "eventTime": "2018-04-17T07:49:07Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2100d549-0a3b-43a9-ad9d-f1f81e19e309", "record_id": "flaws_cloudtrail:0000392:2100d549-0a3b-43a9-ad9d-f1f81e19e309", "row_index": 392, "timestamp": "2018-04-17T07:49:07Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 904, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2100d549-0a3b-43a9-ad9d-f1f81e19e309", "eventTime": "2018-04-17T07:49:07Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1acea3d9-5122-4614-9205-e23684a8c39", "record_id": "flaws_cloudtrail:0000393:1acea3d9-5122-4614-9205-e23684a8c39", "row_index": 393, "timestamp": "2018-04-17T07:49:07Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 906, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1acea3d9-5122-4614-9205-e23684a8c39", "eventTime": "2018-04-17T07:49:07Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "25d1e319-c2fe-477b-85e2-2eef01ffaee5", "record_id": "flaws_cloudtrail:0000394:25d1e319-c2fe-477b-85e2-2eef01ffaee5", "row_index": 394, "timestamp": "2018-04-17T07:49:09Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 908, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "25d1e319-c2fe-477b-85e2-2eef01ffaee5", "eventTime": "2018-04-17T07:49:09Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ee4450fb-2e91-44e3-bef8-3dc9e0ffa67c", "record_id": "flaws_cloudtrail:0000395:ee4450fb-2e91-44e3-bef8-3dc9e0ffa67c", "row_index": 395, "timestamp": "2018-04-17T07:49:11Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ee4450fb-2e91-44e3-bef8-3dc9e0ffa67c", "eventTime": "2018-04-17T07:49:11Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "df368443-809a-4295-ac12-e0e91bfca682", "record_id": "flaws_cloudtrail:0000396:df368443-809a-4295-ac12-e0e91bfca682", "row_index": 396, "timestamp": "2018-04-17T07:49:12Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "df368443-809a-4295-ac12-e0e91bfca682", "eventTime": "2018-04-17T07:49:12Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "282a1e50-32bf-42e3-bfe6-9939c307227", "record_id": "flaws_cloudtrail:0000397:282a1e50-32bf-42e3-bfe6-9939c307227", "row_index": 397, "timestamp": "2018-04-17T07:49:12Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 802, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "282a1e50-32bf-42e3-bfe6-9939c307227", "eventTime": "2018-04-17T07:49:12Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9f5b1846-6610-4fce-80e8-0e2c801460e", "record_id": "flaws_cloudtrail:0000398:9f5b1846-6610-4fce-80e8-0e2c801460e", "row_index": 398, "timestamp": "2018-04-17T07:49:12Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 802, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9f5b1846-6610-4fce-80e8-0e2c801460e", "eventTime": "2018-04-17T07:49:12Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "75e958cc-59c2-41a6-a2f2-cf1c1d2a5e8a", "record_id": "flaws_cloudtrail:0000399:75e958cc-59c2-41a6-a2f2-cf1c1d2a5e8a", "row_index": 399, "timestamp": "2018-04-17T07:49:13Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "75e958cc-59c2-41a6-a2f2-cf1c1d2a5e8a", "eventTime": "2018-04-17T07:49:13Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "53fe74d2-8a77-49c6-b4a3-3449c2f769111", "record_id": "flaws_cloudtrail:0000400:53fe74d2-8a77-49c6-b4a3-3449c2f769111", "row_index": 400, "timestamp": "2018-04-17T07:49:13Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 809, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "53fe74d2-8a77-49c6-b4a3-3449c2f769111", "eventTime": "2018-04-17T07:49:13Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9f2c5443-8aec-46ee-ac0d-7c7d0b5c6995", "record_id": "flaws_cloudtrail:0000401:9f2c5443-8aec-46ee-ac0d-7c7d0b5c6995", "row_index": 401, "timestamp": "2018-04-17T07:49:13Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9f2c5443-8aec-46ee-ac0d-7c7d0b5c6995", "eventTime": "2018-04-17T07:49:13Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "79384f4-3ae3-418d-bb6f-dd45524869b3", "record_id": "flaws_cloudtrail:0000402:79384f4-3ae3-418d-bb6f-dd45524869b3", "row_index": 402, "timestamp": "2018-04-17T07:49:13Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 802, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "79384f4-3ae3-418d-bb6f-dd45524869b3", "eventTime": "2018-04-17T07:49:13Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3cf15000-1a92-4733-9a21-d4d67f363c59", "record_id": "flaws_cloudtrail:0000403:3cf15000-1a92-4733-9a21-d4d67f363c59", "row_index": 403, "timestamp": "2018-04-17T07:49:14Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3cf15000-1a92-4733-9a21-d4d67f363c59", "eventTime": "2018-04-17T07:49:14Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "05c29cc3-16a5-4ac8-be4d-de8cc713c6bb", "record_id": "flaws_cloudtrail:0000404:05c29cc3-16a5-4ac8-be4d-de8cc713c6bb", "row_index": 404, "timestamp": "2018-04-17T07:49:14Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 806, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "05c29cc3-16a5-4ac8-be4d-de8cc713c6bb", "eventTime": "2018-04-17T07:49:14Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3f59031e-3bdb-4a36-9080-a4dbb7bbfd50", "record_id": "flaws_cloudtrail:0000405:3f59031e-3bdb-4a36-9080-a4dbb7bbfd50", "row_index": 405, "timestamp": "2018-04-17T07:49:14Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3f59031e-3bdb-4a36-9080-a4dbb7bbfd50", "eventTime": "2018-04-17T07:49:14Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "494cf76a-e433-4420-8f4a-04a375d438d6", "record_id": "flaws_cloudtrail:0000406:494cf76a-e433-4420-8f4a-04a375d438d6", "row_index": 406, "timestamp": "2018-04-17T07:49:14Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1268, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "494cf76a-e433-4420-8f4a-04a375d438d6", "eventTime": "2018-04-17T07:49:14Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-f5710223", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "43c4dfe2-9cd0-44ee-a3a2-9efe6b545f3d", "record_id": "flaws_cloudtrail:0000407:43c4dfe2-9cd0-44ee-a3a2-9efe6b545f3d", "row_index": 407, "timestamp": "2018-04-17T07:49:15Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "43c4dfe2-9cd0-44ee-a3a2-9efe6b545f3d", "eventTime": "2018-04-17T07:49:15Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "70488a2a-dd0a-4c9d-8ec2-b8e2c13cdce6", "record_id": "flaws_cloudtrail:0000408:70488a2a-dd0a-4c9d-8ec2-b8e2c13cdce6", "row_index": 408, "timestamp": "2018-04-17T07:49:15Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "70488a2a-dd0a-4c9d-8ec2-b8e2c13cdce6", "eventTime": "2018-04-17T07:49:15Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "deae7e66-61e4-43e0-815f-2147c821fee9", "record_id": "flaws_cloudtrail:0000409:deae7e66-61e4-43e0-815f-2147c821fee9", "row_index": 409, "timestamp": "2018-04-17T07:49:15Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1376, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "deae7e66-61e4-43e0-815f-2147c821fee9", "eventTime": "2018-04-17T07:49:15Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ef6f0d3", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "48eb1365-c4c3-4e28-82f0-db62a429534", "record_id": "flaws_cloudtrail:0000410:48eb1365-c4c3-4e28-82f0-db62a429534", "row_index": 410, "timestamp": "2018-04-17T07:49:15Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1373, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "48eb1365-c4c3-4e28-82f0-db62a429534", "eventTime": "2018-04-17T07:49:15Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-f5710223", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4d1c2724-443b-4dd7-bfa9-0ae954e737033", "record_id": "flaws_cloudtrail:0000411:4d1c2724-443b-4dd7-bfa9-0ae954e737033", "row_index": 411, "timestamp": "2018-04-17T07:49:16Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1380, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4d1c2724-443b-4dd7-bfa9-0ae954e737033", "eventTime": "2018-04-17T07:49:16Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ca57294", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1f2b78e3-b92c-4144-8db3-8f30108ac5", "record_id": "flaws_cloudtrail:0000412:1f2b78e3-b92c-4144-8db3-8f30108ac5", "row_index": 412, "timestamp": "2018-04-17T07:49:16Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1374, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1f2b78e3-b92c-4144-8db3-8f30108ac5", "eventTime": "2018-04-17T07:49:16Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ef6f0d3", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a2cb43f9-e464-4c61-839a-36e382d4dd90", "record_id": "flaws_cloudtrail:0000413:a2cb43f9-e464-4c61-839a-36e382d4dd90", "row_index": 413, "timestamp": "2018-04-17T07:49:16Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1270, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a2cb43f9-e464-4c61-839a-36e382d4dd90", "eventTime": "2018-04-17T07:49:16Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-f5710223", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "868f38fd-18e5-451f-a2f5-bc1dd433f181", "record_id": "flaws_cloudtrail:0000414:868f38fd-18e5-451f-a2f5-bc1dd433f181", "row_index": 414, "timestamp": "2018-04-17T07:49:17Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1381, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "868f38fd-18e5-451f-a2f5-bc1dd433f181", "eventTime": "2018-04-17T07:49:17Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-14f2b3cc", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "036f6d92-3523-46fb-a4a6-b7effc650dc5", "record_id": "flaws_cloudtrail:0000415:036f6d92-3523-46fb-a4a6-b7effc650dc5", "row_index": 415, "timestamp": "2018-04-17T07:49:17Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1925, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "036f6d92-3523-46fb-a4a6-b7effc650dc5", "eventTime": "2018-04-17T07:49:17Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: YcQ33zSJnAbSUi_xzmoESoQcKP_3oH5PONSuTxhFrpZxUP_KdCvnK_2jH9zQn6symlnfKVTtkGocsRqA1F-f3Adv-dxJPGY0__vUWeWerh8WFlbbkZEvjYIO4JtHabzFUM6GyD1oZtvEXDO-WbNjefeSfelB6R5Sx_mkynomyCIpaVPMNB5YOhb2ZX1j5ikCaxQh06YSzvJ3On7nwLdEi7_mOQwwhdjyBw_TBokZd7pELhOQNiYh6Pp1kFD2NfLUMEdTlS5nInKiDWtkZKdUjfaRV9p8RI7IL69hFsbchnGV9y-1HhbsCQUnF-bjeGBVlyd9Rft0rs6RPped1_5HvOESKwrvRm2ChBNvixqibsev6Gx4r2nGyjuvABL809RgyEXsB5ptmBcsEfYPj_KvEME2PWuFHqzf8s-ZYytXCZ6K4So0V5dJob1y5TYBMuEXLlQiPCH2zETVFVrxx6Zkke5-9Howw4uQEMJpAh4LHxfzAAJnCV8cM-mTJKkdDeBgZjlc7g04ATMqz6qa6eB8sXpuVmEUZXf63V2rKIjf_RWEXs0j1iycVUyZONHocuxORscJT-gXWM3_xSDMJsdTu1LXvVqF68tWhv5GWcrYV6tTE2gXNwC3Kw1yl3gNeX_wwJMd1ehAlD1Rj43NijVYGV_mS6UwZOHjFg", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-f5710223", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1ed598680-a253-4660-8cb7-cf45c3db9be9", "record_id": "flaws_cloudtrail:0000416:1ed598680-a253-4660-8cb7-cf45c3db9be9", "row_index": 416, "timestamp": "2018-04-17T07:49:18Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 915, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1ed598680-a253-4660-8cb7-cf45c3db9be9", "eventTime": "2018-04-17T07:49:18Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f3ac3ff7-a701-4456-be05-85a5ae3c200d", "record_id": "flaws_cloudtrail:0000417:f3ac3ff7-a701-4456-be05-85a5ae3c200d", "row_index": 417, "timestamp": "2018-04-17T07:49:18Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 801, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f3ac3ff7-a701-4456-be05-85a5ae3c200d", "eventTime": "2018-04-17T07:49:18Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5c6f3f70-31c8-4e01-9a26-011eef67bae5", "record_id": "flaws_cloudtrail:0000418:5c6f3f70-31c8-4e01-9a26-011eef67bae5", "row_index": 418, "timestamp": "2018-04-17T07:49:18Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1377, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5c6f3f70-31c8-4e01-9a26-011eef67bae5", "eventTime": "2018-04-17T07:49:18Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ef6f0d3", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e236bc00-c62d-4f6e-8802-708622aa57c4", "record_id": "flaws_cloudtrail:0000419:e236bc00-c62d-4f6e-8802-708622aa57c4", "row_index": 419, "timestamp": "2018-04-17T07:49:20Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e236bc00-c62d-4f6e-8802-708622aa57c4", "eventTime": "2018-04-17T07:49:20Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "807734e78-5a0b-4a5b-8849-2ef43fcf99ab", "record_id": "flaws_cloudtrail:0000420:807734e78-5a0b-4a5b-8849-2ef43fcf99ab", "row_index": 420, "timestamp": "2018-04-17T07:49:20Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1927, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "807734e78-5a0b-4a5b-8849-2ef43fcf99ab", "eventTime": "2018-04-17T07:49:20Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: T-IWY_BJBzitpqSAcLY78HpM9tsQfJKwVMd47vGvmpAQk2WkGj2_WN25lmi1D6K-MPoiNLgtA84whVMOxv-4en4W5xdNYkWl_kf6gaB2klVYnm6Lo3djVdD7ed2PYn5fLG7wNfxi0Dsx2_iumIkc852eFIKhArmcaVN8hAYdxfxo2G2uF9XFALZ2rsI6iHwl2s6zdvM0THsBDbHDFUqFMKsqNcShuhdX6clIbBAC3sy73nJD5_pjCp5gC3kseyuP_w8bSkkeqE0qm4Y7Qwhe8TaJRfDtSF4QZG1R76DCw_x44qrEZudzxspVa2DViFjSu55JkcqLwhOdox-vHvXL19Key2Bvpz2yNJTiIdavjWQW0vHiJykqsNxxoZ-siDDGYiLrIv15Ka46euLiap-EGCu3Rbb_WEYPPjC-0BGn4f9oCybK8J5oVbPktpWuiMz4n6cZviq3-UMq0n7kYScs7q8IPy4rA0n6CmP2gFmcTGSG77cs7oCb5iSZf9tLUveq1lIlL1tE-UnMOvlWZ30UohJsH1FyT36nhq2CSHpMP-HcMhI2-R5FpMwq2i28aNO5ND18choAEaAg0k8B6PqzveoNUeAST3jfcM-SyVmdceILy1rp8koYM_LKrtamK8_nI6HlHLNJfz2Y4JVNCg53I_29aS_4iTkGzw", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ef6f0d3", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3ee4969f-96cc-4040-9393-e051e2c8f4d8", "record_id": "flaws_cloudtrail:0000421:3ee4969f-96cc-4040-9393-e051e2c8f4d8", "row_index": 421, "timestamp": "2018-04-17T07:49:21Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1377, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3ee4969f-96cc-4040-9393-e051e2c8f4d8", "eventTime": "2018-04-17T07:49:21Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ca57294", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fe85f719-49f2-4db3-882a-6efb4f07b09a", "record_id": "flaws_cloudtrail:0000422:fe85f719-49f2-4db3-882a-6efb4f07b09a", "row_index": 422, "timestamp": "2018-04-17T07:49:21Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1381, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fe85f719-49f2-4db3-882a-6efb4f07b09a", "eventTime": "2018-04-17T07:49:21Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-14f2b3cc", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dfdbc6b5-327b-4489-b77b-9bdec0adb450", "record_id": "flaws_cloudtrail:0000423:dfdbc6b5-327b-4489-b77b-9bdec0adb450", "row_index": 423, "timestamp": "2018-04-17T07:49:22Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dfdbc6b5-327b-4489-b77b-9bdec0adb450", "eventTime": "2018-04-17T07:49:22Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ef0584a3-8ef0-4876-8eb8-338c0561d144", "record_id": "flaws_cloudtrail:0000424:ef0584a3-8ef0-4876-8eb8-338c0561d144", "row_index": 424, "timestamp": "2018-04-17T07:49:22Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 911, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ef0584a3-8ef0-4876-8eb8-338c0561d144", "eventTime": "2018-04-17T07:49:22Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8088e9b3-f967-457e-a55f-01455ccff90b", "record_id": "flaws_cloudtrail:0000425:8088e9b3-f967-457e-a55f-01455ccff90b", "row_index": 425, "timestamp": "2018-04-17T07:49:23Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8088e9b3-f967-457e-a55f-01455ccff90b", "eventTime": "2018-04-17T07:49:23Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ee081cb8-3d71-4642-9438-fb98f9e8296d", "record_id": "flaws_cloudtrail:0000426:ee081cb8-3d71-4642-9438-fb98f9e8296d", "row_index": 426, "timestamp": "2018-04-17T07:49:23Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1376, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ee081cb8-3d71-4642-9438-fb98f9e8296d", "eventTime": "2018-04-17T07:49:23Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-dc82b8b9", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f7a8a328-87d4-41d9-9bbb-0c292a92d915", "record_id": "flaws_cloudtrail:0000427:f7a8a328-87d4-41d9-9bbb-0c292a92d915", "row_index": 427, "timestamp": "2018-04-17T07:49:25Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1275, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f7a8a328-87d4-41d9-9bbb-0c292a92d915", "eventTime": "2018-04-17T07:49:25Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-14f2b3cc", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "229fc61b-91e5-4070-99c3-c00bf1c16c9f", "record_id": "flaws_cloudtrail:0000428:229fc61b-91e5-4070-99c3-c00bf1c16c9f", "row_index": 428, "timestamp": "2018-04-17T07:49:25Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "229fc61b-91e5-4070-99c3-c00bf1c16c9f", "eventTime": "2018-04-17T07:49:25Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6333f54d-3749-4306-9ab0-7a8de82474", "record_id": "flaws_cloudtrail:0000429:6333f54d-3749-4306-9ab0-7a8de82474", "row_index": 429, "timestamp": "2018-04-17T07:49:25Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1374, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6333f54d-3749-4306-9ab0-7a8de82474", "eventTime": "2018-04-17T07:49:25Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-dc82b8b9", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "000912-b8ae-4c29-9cf3-0349f7a2f130", "record_id": "flaws_cloudtrail:0000430:000912-b8ae-4c29-9cf3-0349f7a2f130", "row_index": 430, "timestamp": "2018-04-17T07:49:26Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1380, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "000912-b8ae-4c29-9cf3-0349f7a2f130", "eventTime": "2018-04-17T07:49:26Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ca57294", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "df97a59e-a4e0-4c08-89c0-918197e98cf85", "record_id": "flaws_cloudtrail:0000431:df97a59e-a4e0-4c08-89c0-918197e98cf85", "row_index": 431, "timestamp": "2018-04-17T07:49:26Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1382, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "df97a59e-a4e0-4c08-89c0-918197e98cf85", "eventTime": "2018-04-17T07:49:26Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-546ae567", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3bf082b0-d5d8-4fc7-93c5-6dfee21d4e5f", "record_id": "flaws_cloudtrail:0000432:3bf082b0-d5d8-4fc7-93c5-6dfee21d4e5f", "row_index": 432, "timestamp": "2018-04-17T07:49:27Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1936, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3bf082b0-d5d8-4fc7-93c5-6dfee21d4e5f", "eventTime": "2018-04-17T07:49:27Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: K4RKfi1a401mLIeBqtsZam2DlwD9qVaSFcz6dDgDDaXaQcrAcHOdJ_vOMleklsl8AHnBh2FYEVLheKJLR36p2ErzZz5_14-flcP-CJP9lCTPdLooi7xAABoYl-XbVnccEH71z1T0RXIcALFvoqulOMguVP1uDWEZXCEYd9P1TVusXCctfFIZe_UiFvUU52SIMwzG3PrNQM7fawXTjNIEafDgeRA5uA6XPQm4lPXb8ixM2sbmW2Or8moLUY28CZddzm9IUdvHBkYDtMSvl0wUFUb5HLdmNyGOTcrb3ZeXmS2vI3CLJ3grFrufFwOQcQFoxaoJw4qoO9csTN5fa0Duc7fpHimBuvRRizZzvsC5b0Obd7B5uHmV1fRewWhQH6P7YCUQ4K95DQjkore1Dsbzfyo9YC2C5c5thH_JNuL7TZTe9xi8n9LqacsQDAeycwIMPe8JCinbNYbIawTZzGyAHlliYpBxsz13-0fnjSgyiRcj4MdwDhAvwHtje3kuwdIwEfEBd6ECcVo7mDgKyY2Bi1MVY8WCz37YIvkwQQRS2Y7eH3Jzoae1xXQv_hLBqRqu4eoh4pbhiCnbG2E_fZEcpYVE6aH6lky6e1LI8-67kbC-GHFZuc0sxNx_mdMAPokRL17d884FFUmP80j2YNdON99Xqgrx81jlBOIPHKi4", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ca57294", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cfb36268-d43c-416c-bc72-7bbb43ad3bb0", "record_id": "flaws_cloudtrail:0000433:cfb36268-d43c-416c-bc72-7bbb43ad3bb0", "row_index": 433, "timestamp": "2018-04-17T07:49:27Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1381, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cfb36268-d43c-416c-bc72-7bbb43ad3bb0", "eventTime": "2018-04-17T07:49:27Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-546ae567", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "126aaacc-0e95-4bd6-a62c-4f5cb7708edb", "record_id": "flaws_cloudtrail:0000434:126aaacc-0e95-4bd6-a62c-4f5cb7708edb", "row_index": 434, "timestamp": "2018-04-17T07:49:29Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1936, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "126aaacc-0e95-4bd6-a62c-4f5cb7708edb", "eventTime": "2018-04-17T07:49:29Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: _UOk-qlytFr2tgrw8EtrVvFyAI0yMn6mP7Vr-pfW21jLX6B1Q1BMBv3MLW-7Nmu0dwQ0VW0EQbHNJsFAHsOKs92NI-WonCRRC_cGLTPLTtqlgfXAEknruj2iTfN3p7KeV-JRuZbA8ZaaKoFbkFv-ALMIdTqtqHNnvJM8biMCM56j4Yq4bzvTdDC_I1GnfSGlE8PloK6gt9zgejZVbVqnBq3MoN8KlwFdho_BBEVVFxcYopgVO_I0V2g4RKJJ0U7binrW51C6e-0qJQ3W0haL7ni6r8dF_LyLDp1ePF9l9dGRpB__GyX4hUqLYjU0nOOoLyKzO6iK8GbgKBkSyR6qOVGGpTEhM6JmpRxVN7rNg1kIsgdhnL5mTYbol1qhQ9k3HQL0fjwbB01NuTN8bx9VpWVGVOVy4Sco1YYGFSrAMtjLbeocLOPo3GOgP6rZWQ3e774HflxO_kLvEf8VNi4KZIMYQdTg_gTdCPYLaV3C0k_2uzoUaT1eFuL1AMmlVHqt_IeTtKxClGzVEg9053Kk1ziP3QfKghwdW-vFLauikfwWmiMZEMwWGEYdnM-rHh_8RVHPyqSJBYrF0QBdx_Pj5AKG2hmHOFVpbv6_WD2sY9i4Qq_IoYRn5MJx_UjCoE9YMFA9VSGjoTP4fCUYpoyDqAb13PsHdyt9Z-cUOpM", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-14f2b3cc", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3bd926f7-b3ff-4981-b45b-2b953f45b106", "record_id": "flaws_cloudtrail:0000435:3bd926f7-b3ff-4981-b45b-2b953f45b106", "row_index": 435, "timestamp": "2018-04-17T07:49:29Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1275, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3bd926f7-b3ff-4981-b45b-2b953f45b106", "eventTime": "2018-04-17T07:49:29Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-546ae567", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "076d837b-025f-40b5-99e9-d6bd36f207290", "record_id": "flaws_cloudtrail:0000436:076d837b-025f-40b5-99e9-d6bd36f207290", "row_index": 436, "timestamp": "2018-04-17T07:49:29Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 915, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "076d837b-025f-40b5-99e9-d6bd36f207290", "eventTime": "2018-04-17T07:49:29Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "db8c80d6-67ea-4399-95b1-9e39ce98537", "record_id": "flaws_cloudtrail:0000437:db8c80d6-67ea-4399-95b1-9e39ce98537", "row_index": 437, "timestamp": "2018-04-17T07:49:29Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1269, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "db8c80d6-67ea-4399-95b1-9e39ce98537", "eventTime": "2018-04-17T07:49:29Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-dc82b8b9", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a1f91b9f-e59a-44a1-b5bc-6e15627a8693", "record_id": "flaws_cloudtrail:0000438:a1f91b9f-e59a-44a1-b5bc-6e15627a8693", "row_index": 438, "timestamp": "2018-04-17T07:49:30Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 908, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a1f91b9f-e59a-44a1-b5bc-6e15627a8693", "eventTime": "2018-04-17T07:49:30Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1de0eaf6-b0eb-4d51-bc1b-2681ea10094d", "record_id": "flaws_cloudtrail:0000439:1de0eaf6-b0eb-4d51-bc1b-2681ea10094d", "row_index": 439, "timestamp": "2018-04-17T07:49:31Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 806, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1de0eaf6-b0eb-4d51-bc1b-2681ea10094d", "eventTime": "2018-04-17T07:49:31Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "714645-cb8a-4c94-aa7d-209fba6d1c19", "record_id": "flaws_cloudtrail:0000440:714645-cb8a-4c94-aa7d-209fba6d1c19", "row_index": 440, "timestamp": "2018-04-17T07:49:33Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1934, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "714645-cb8a-4c94-aa7d-209fba6d1c19", "eventTime": "2018-04-17T07:49:33Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: cphUwVd3BBOxZxupiskFVJCyDyO1x_6UtD7RJfpRy9XxtEuPZOC0ADNJiC60OwhUkpjpJsIfhi1bEAkQ2vj_TlMoJwYSqjIoaBMFyGl-1p3e33PHE-gcE4eC_SW4rezK2aWLh6QRS-nUEr1wAa2SiGiDxlLyd3pX93JfgE3dtpvViugjgr8iS3IzIbNuszO_8V5wY6xoraJVi3S23uMeIRFrPGph_zCDjJZ4gbhrtiCedvuPeqFWRBX5ZFi4tvV-onU7SzXTZLSXZRbOnfVF1gCK7mjB-Pvb4X1u8TbyhL3fVCSxuZeai8TC7duGzf8IDsPDGDQ9WK3xYVdzRdOcQT17YR94NBh1-Sgj8tQ0cSe9uHcCObR3bVbSISaop5WzWG6uh-x9OMa1NlutXNIe7cBIIgf1YkfDa_8F7L8k6xfAk6CBsgVtu23pKgdaYuH15u1UVahO8eOTixDFTE_fP_z_tbpu7VjWnfY2RdMMGWzcqwz7WcPwuMsY8nAa92bwlseGLIwJGcDJVsRhHNYTCbLenkyOXnG-L65-ynT1riydlzLNPP5vndmMgvdivO0Ldo5yTfvRMS5eR7lEN-YkCsRGCO9D3dgvbFpXfS7r_G8KU2mMkW-Gz8zlzyJ3B7fuP6ezzINj878Yb9EbjsymzD2Bf5N1slHvaV1ZLRE", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-546ae567", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "265397-13b6-4c6f-9d33-a4e351697", "record_id": "flaws_cloudtrail:0000441:265397-13b6-4c6f-9d33-a4e351697", "row_index": 441, "timestamp": "2018-04-17T07:49:33Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "265397-13b6-4c6f-9d33-a4e351697", "eventTime": "2018-04-17T07:49:33Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "86e36a46-d968-48ec-acd9-4e35b973070", "record_id": "flaws_cloudtrail:0000442:86e36a46-d968-48ec-acd9-4e35b973070", "row_index": 442, "timestamp": "2018-04-17T07:49:33Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "86e36a46-d968-48ec-acd9-4e35b973070", "eventTime": "2018-04-17T07:49:33Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d8f715b9-9531-47bd-8b6a-5cedc90e041e", "record_id": "flaws_cloudtrail:0000443:d8f715b9-9531-47bd-8b6a-5cedc90e041e", "row_index": 443, "timestamp": "2018-04-17T07:49:34Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d8f715b9-9531-47bd-8b6a-5cedc90e041e", "eventTime": "2018-04-17T07:49:34Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9ad3e085-1c45-42ac-85d3-ddf3f14ea4cb", "record_id": "flaws_cloudtrail:0000444:9ad3e085-1c45-42ac-85d3-ddf3f14ea4cb", "row_index": 444, "timestamp": "2018-04-17T07:49:34Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1926, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9ad3e085-1c45-42ac-85d3-ddf3f14ea4cb", "eventTime": "2018-04-17T07:49:34Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: E91sSIaX1hogITqGe42N4--p4Y1PQjUoZ8ufstMqCKaw7I_w2JbHD7tpAMJp1mWlb-XpTgrN6KMhSAnuAV9tKkBZWuy3USd4SnxCR1i7gNIeyCW5qt4xi8NnAl4LnoJFHIA5Fp1E-zQuHifKPV7zI_CeH5EIL329I8_8iwdRBZyg4nD9nJzioEr7XQZeRIthYghMBrS5IkvASGEaxS1xQSxK39y59Dor5FSKhGHcRss28kz56HFlvokeXZzSa0Uq01OOggrCtZkkot3HksHgQwh3v26AacE42k9ROYSBcMe1blJrg2XORMVjh4MFqkTqtxJXOrIIhqNMZ5qiYlrbXjRkxSTokIkfYZMYlwl4AoMUN9pjrVkdIFHkrrIkZ27Qp8zbkxxFcNHGUblZo4za62Flm61t0fdiF6gC4-zg_lbeVt7dzTV22bTR8zv--ZJK0F0vrc7N7uqv5ky1Fbil7wZd6nc-tIYCpxCVEFMwKZAPGkl50sF0Sjeuz4-XAUHaNTi9HY9VMeKU1VTUtTSkpGf9pzdHQT1LDu2CwYSrMpJm6rUo8SegFbw9WTqEuGpChp5wV0fopp7zI_ZE6j2ZcKfFZnKupIHg_bLZpQ1kgu6LVgRNmaOK62xY0NOCLi_lZ9cPmSAYRMaB3xKhW6y6_X8BIyn7-53Mrg", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-dc82b8b9", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d3056eda-525a-4cc5-875a-b1b9982e09f1", "record_id": "flaws_cloudtrail:0000445:d3056eda-525a-4cc5-875a-b1b9982e09f1", "row_index": 445, "timestamp": "2018-04-17T07:49:34Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d3056eda-525a-4cc5-875a-b1b9982e09f1", "eventTime": "2018-04-17T07:49:34Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7b2683a2-11dc-4fda-9ab9-bb595b36965e", "record_id": "flaws_cloudtrail:0000446:7b2683a2-11dc-4fda-9ab9-bb595b36965e", "row_index": 446, "timestamp": "2018-04-17T07:49:35Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7b2683a2-11dc-4fda-9ab9-bb595b36965e", "eventTime": "2018-04-17T07:49:35Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b2c44fdd-4416-4683-ac2a-7e610b6df028", "record_id": "flaws_cloudtrail:0000447:b2c44fdd-4416-4683-ac2a-7e610b6df028", "row_index": 447, "timestamp": "2018-04-17T07:49:35Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 806, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b2c44fdd-4416-4683-ac2a-7e610b6df028", "eventTime": "2018-04-17T07:49:35Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3483dc1b-26ee-47ed-8bcb-7bed5d673bb9", "record_id": "flaws_cloudtrail:0000448:3483dc1b-26ee-47ed-8bcb-7bed5d673bb9", "row_index": 448, "timestamp": "2018-04-17T07:49:35Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3483dc1b-26ee-47ed-8bcb-7bed5d673bb9", "eventTime": "2018-04-17T07:49:35Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c2d9b5e9-a5f0-4fe6-b2d7-5c384931e0aee", "record_id": "flaws_cloudtrail:0000449:c2d9b5e9-a5f0-4fe6-b2d7-5c384931e0aee", "row_index": 449, "timestamp": "2018-04-17T07:49:35Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 804, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c2d9b5e9-a5f0-4fe6-b2d7-5c384931e0aee", "eventTime": "2018-04-17T07:49:35Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "377183f29-2c49-496d-82a4-c5b6921a166c", "record_id": "flaws_cloudtrail:0000450:377183f29-2c49-496d-82a4-c5b6921a166c", "row_index": 450, "timestamp": "2018-04-17T07:49:36Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 910, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "377183f29-2c49-496d-82a4-c5b6921a166c", "eventTime": "2018-04-17T07:49:36Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6140ccb6-9e84-4a9e-b735-393e48c921f7", "record_id": "flaws_cloudtrail:0000451:6140ccb6-9e84-4a9e-b735-393e48c921f7", "row_index": 451, "timestamp": "2018-04-17T07:49:37Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1381, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6140ccb6-9e84-4a9e-b735-393e48c921f7", "eventTime": "2018-04-17T07:49:37Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-02d34bac", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "72559dfb-da4e-4a4e-9242-54ee62b7987e", "record_id": "flaws_cloudtrail:0000452:72559dfb-da4e-4a4e-9242-54ee62b7987e", "row_index": 452, "timestamp": "2018-04-17T07:49:37Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 807, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "72559dfb-da4e-4a4e-9242-54ee62b7987e", "eventTime": "2018-04-17T07:49:37Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c6741c96-8463-422e-9238-16b33d78ca6b", "record_id": "flaws_cloudtrail:0000453:c6741c96-8463-422e-9238-16b33d78ca6b", "row_index": 453, "timestamp": "2018-04-17T07:49:37Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 802, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c6741c96-8463-422e-9238-16b33d78ca6b", "eventTime": "2018-04-17T07:49:37Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2ba6b724-cbc2-4d05-9add-4d482695ed01", "record_id": "flaws_cloudtrail:0000454:2ba6b724-cbc2-4d05-9add-4d482695ed01", "row_index": 454, "timestamp": "2018-04-17T07:49:37Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1376, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2ba6b724-cbc2-4d05-9add-4d482695ed01", "eventTime": "2018-04-17T07:49:37Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-009dc204", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e8c3e54d-5eda-4d88-a125-0e6425bb6768", "record_id": "flaws_cloudtrail:0000455:e8c3e54d-5eda-4d88-a125-0e6425bb6768", "row_index": 455, "timestamp": "2018-04-17T07:49:38Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1381, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e8c3e54d-5eda-4d88-a125-0e6425bb6768", "eventTime": "2018-04-17T07:49:38Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-02d34bac", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c87bf25b-1f80-43ee-852c-6f4957fde2ea", "record_id": "flaws_cloudtrail:0000456:c87bf25b-1f80-43ee-852c-6f4957fde2ea", "row_index": 456, "timestamp": "2018-04-17T07:49:38Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1378, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c87bf25b-1f80-43ee-852c-6f4957fde2ea", "eventTime": "2018-04-17T07:49:38Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-bbcb674a", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8e477788d-9dcd-4e9c-9488-658c50ad64f6", "record_id": "flaws_cloudtrail:0000457:8e477788d-9dcd-4e9c-9488-658c50ad64f6", "row_index": 457, "timestamp": "2018-04-17T07:49:38Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 804, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8e477788d-9dcd-4e9c-9488-658c50ad64f6", "eventTime": "2018-04-17T07:49:38Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b5db584b-26b6-477e-831e-0bcc750fef6b", "record_id": "flaws_cloudtrail:0000458:b5db584b-26b6-477e-831e-0bcc750fef6b", "row_index": 458, "timestamp": "2018-04-17T07:49:38Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1376, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b5db584b-26b6-477e-831e-0bcc750fef6b", "eventTime": "2018-04-17T07:49:38Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-009dc204", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b5a0bd98-d53a-43a0-86e3-36a6d87415c4", "record_id": "flaws_cloudtrail:0000459:b5a0bd98-d53a-43a0-86e3-36a6d87415c4", "row_index": 459, "timestamp": "2018-04-17T07:49:39Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b5a0bd98-d53a-43a0-86e3-36a6d87415c4", "eventTime": "2018-04-17T07:49:39Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6ad004e5-b8c0-46ea-a5bf-729946d795cd", "record_id": "flaws_cloudtrail:0000460:6ad004e5-b8c0-46ea-a5bf-729946d795cd", "row_index": 460, "timestamp": "2018-04-17T07:49:39Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1376, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6ad004e5-b8c0-46ea-a5bf-729946d795cd", "eventTime": "2018-04-17T07:49:39Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-009dc204", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2d37b753-54f9-4bc6-a0a7-61edb3ad29d0", "record_id": "flaws_cloudtrail:0000461:2d37b753-54f9-4bc6-a0a7-61edb3ad29d0", "row_index": 461, "timestamp": "2018-04-17T07:49:40Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 805, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2d37b753-54f9-4bc6-a0a7-61edb3ad29d0", "eventTime": "2018-04-17T07:49:40Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "187b241e-17a3-47a3-8d24-44060b0db5", "record_id": "flaws_cloudtrail:0000462:187b241e-17a3-47a3-8d24-44060b0db5", "row_index": 462, "timestamp": "2018-04-17T07:49:40Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1381, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "187b241e-17a3-47a3-8d24-44060b0db5", "eventTime": "2018-04-17T07:49:40Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-02d34bac", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "692c20fe-d17c-415c-a652-4fde341d08a7", "record_id": "flaws_cloudtrail:0000463:692c20fe-d17c-415c-a652-4fde341d08a7", "row_index": 463, "timestamp": "2018-04-17T07:49:40Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1379, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "692c20fe-d17c-415c-a652-4fde341d08a7", "eventTime": "2018-04-17T07:49:40Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-bbcb674a", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cfd726ae-b687-4196-98eb-f024f62b9ffd", "record_id": "flaws_cloudtrail:0000464:cfd726ae-b687-4196-98eb-f024f62b9ffd", "row_index": 464, "timestamp": "2018-04-17T07:49:40Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1376, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cfd726ae-b687-4196-98eb-f024f62b9ffd", "eventTime": "2018-04-17T07:49:40Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-71cdc376", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "07bc19f6-aa60-4d94-aca4-5b6c003a7b37", "record_id": "flaws_cloudtrail:0000465:07bc19f6-aa60-4d94-aca4-5b6c003a7b37", "row_index": 465, "timestamp": "2018-04-17T07:49:40Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1927, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "07bc19f6-aa60-4d94-aca4-5b6c003a7b37", "eventTime": "2018-04-17T07:49:40Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: dafdvyRfZAgDlgvcoxo29KCV-k42X0tUauriFgPqA9jqqZGtwe9kFmUa4kB26B-7428rgf1RgurvGBqZ8BkqQ7LAkVLYIXP49UCivURQ5cDAbueQnZPHVSyKbhufLbILa0gCiuB2G32Zrl99LQOj4rcKBTQtGY-7y5uon5CmHPFwMtwOQcbh25kZ5U62y89CkAL8N2leaw-L3dOSGkIfk1t3NFyb-myN6RFe7TtNW9Kg0wGMvJAbKHwVOYLXoY1j_A1Nm7NZrCzLgmJzW2N-26p-7Uoji_SjMbFU3QKN8nmK7uID9zkTbqlszmrVySMHsc8qz7fULRJKOosdeQnjTUg3wkuTlbgCemD8vYvyRgbE5oaSgquFwErbc8C2iUe7rgK2FwOn0wWlUl93FNYPbBOi0wieE5A2mj4_UGKy45ez_os-w_2tJbbbxyIMY1e7rhcqbkW3v7G9FdnrNPstFYWYgg8Bk0jowkxV2bby-uSngwrsH8gUeDUvH57mGnVI_2Wnf5ERVx12idD4okB7cKm0TgDrif4TAZR46h1CFKP00dSH65UKoIzaGCmTLF-1KUpXX-1MrZbaf0IUrK_cYjDPaQw8yZ7ao-PRitD1C4qru-0BlbbjC7IYMPYpPm_1-NitUk7nezbueg93DACX9rF8LhroRzoUTgk", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-009dc204", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d2038d94-5bf1-4000-83dd-f47f78a95ffc", "record_id": "flaws_cloudtrail:0000466:d2038d94-5bf1-4000-83dd-f47f78a95ffc", "row_index": 466, "timestamp": "2018-04-17T07:49:41Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1938, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d2038d94-5bf1-4000-83dd-f47f78a95ffc", "eventTime": "2018-04-17T07:49:41Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: OMLvcwhc_B4gbmdQc9f8c-BzW9YLSDU2eHVw41D0CEY8sUjBqAVEBVLCuHZVolgSiws5sqrKwoDZpXMki9ixq-vKQV0pTHH2OaafQg2PVp5TKAkhTVAfS_A0mbPZDDWP1Yi4gHzFvtgK61oWN8M36is-5Onx1HUcnC5icmxBhvRZbFj6GpImU6LFx5fNTmwAKpyMqwePSO1_6Lo4GdcwX9_43iX1gftlTUjUwi6YGet5i3ERD_oDKKVCUnKAdQS2ijmSTJ4FIwup-f6og_T6eIsBJzwwbjy5_c5HGPT6yF0WlcLIYZ5mlgZTC1OvXZC1AqLQ2dP8JnPennfzBwS9ZYQO4NjKUMVIPU7S_WWR1Iw_wlF1hdB1llbeIAiwUEJAQpnJelPYamQk-4xptuiFQ0PJdfBhs0EG5p2ETj3BVwVDoN35U5v8QvjbKZILvoUF3r0toKov-CozleE6vpm6HS3XKICrzJ2JGx7a3LImThrrv8OdaEc2Z6fKYIeAkDbqk5w8cyQkSWzY2xt_VbVmiKwwZS2ZFipw4heNCKOcKboKRoWXdSSYfMhxejf4h1FGFPr6zM2omKwI3atAVXMwDmevzNVqpu11tWp3Q8nwtfz0K4uMOvAle8QP5XcZomHxEwsPli1QtpkfWK9ztqQy3Uay0NHtxsfY_8uz7a9b", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-02d34bac", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "af7f3d3e-bfe8-4f53-9a77-64c9b5101b4e", "record_id": "flaws_cloudtrail:0000467:af7f3d3e-bfe8-4f53-9a77-64c9b5101b4e", "row_index": 467, "timestamp": "2018-04-17T07:49:41Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1273, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "af7f3d3e-bfe8-4f53-9a77-64c9b5101b4e", "eventTime": "2018-04-17T07:49:41Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-bbcb674a", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1abea1e2-3862-46a9-9138-d6cfa21ed7df", "record_id": "flaws_cloudtrail:0000468:1abea1e2-3862-46a9-9138-d6cfa21ed7df", "row_index": 468, "timestamp": "2018-04-17T07:49:41Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 911, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1abea1e2-3862-46a9-9138-d6cfa21ed7df", "eventTime": "2018-04-17T07:49:41Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ac96d816-5090-43ea-a372-d3fffedad106", "record_id": "flaws_cloudtrail:0000469:ac96d816-5090-43ea-a372-d3fffedad106", "row_index": 469, "timestamp": "2018-04-17T07:49:41Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1376, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ac96d816-5090-43ea-a372-d3fffedad106", "eventTime": "2018-04-17T07:49:41Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-71cdc376", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2a6688cb-d13c-437b-a089-747be7c16481", "record_id": "flaws_cloudtrail:0000470:2a6688cb-d13c-437b-a089-747be7c16481", "row_index": 470, "timestamp": "2018-04-17T07:49:42Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 804, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2a6688cb-d13c-437b-a089-747be7c16481", "eventTime": "2018-04-17T07:49:42Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b962c490-662e-45be-ac62-9e442e643e7c", "record_id": "flaws_cloudtrail:0000471:b962c490-662e-45be-ac62-9e442e643e7c", "row_index": 471, "timestamp": "2018-04-17T07:49:42Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 908, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b962c490-662e-45be-ac62-9e442e643e7c", "eventTime": "2018-04-17T07:49:42Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "78fa828c-47fa-4d16-85a3-255165ab179ac", "record_id": "flaws_cloudtrail:0000472:78fa828c-47fa-4d16-85a3-255165ab179ac", "row_index": 472, "timestamp": "2018-04-17T07:49:42Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1270, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "78fa828c-47fa-4d16-85a3-255165ab179ac", "eventTime": "2018-04-17T07:49:42Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-71cdc376", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b1246aac-fb2f-4008-8550-87b14aafef93", "record_id": "flaws_cloudtrail:0000473:b1246aac-fb2f-4008-8550-87b14aafef93", "row_index": 473, "timestamp": "2018-04-17T07:49:43Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1926, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b1246aac-fb2f-4008-8550-87b14aafef93", "eventTime": "2018-04-17T07:49:43Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: xDkgJ9-8t7m-G1LBJtfWQ_-5e1ayv8xAo2i_kEtVDY9jrUsjmGoKG4cK5gO0pej7lfiUD-XUQwZhQo4tNCZmTyuai5N82kTk6MM0CNkNrPCxAz9lMNTjaM82QBfpJjQlyM5TxgAMAbnKUIFMf1APtkl78q2a5n-FYzptBRNdGiSNnXUTWfrEcXedQ38h33RTG8-l55nHg5w2efFUR7ynJycg4GFo1pDaQUZkL5cKyGtjOkOoPZD-pDrH_whOecFYe5D0uYThdfY4go1ji96xYR9-8G0P30lLOEQviZO4KiYtusLwLVW4T3RyMveIwMjgZXt1l9vIpiagQ9y6-rtbG85IT_kb8r9IYwFJ-gx7kx4YdVMpP8NIl5cBnWL9Ui7F9Ua8EDQnOvhuZo83bTpLC6NUiTKr4gl64TwwLY1oJrlPsa5ZIua12BKwLk1t4JB4f9m81Wj_YuKyExF6yeT8Y0JfIW5ixK7dp7Qhdb9qb0D6LUwhx0eTeUCBXAccvpEhVMaSMlW6gQ6Fqo9OQblxGbpr3B-HFsnjeC6qU4o13FgTVLbFOj9TB_crSpgAixuFnd-9VSh9p_xDJPQxKStCj2-2BViHTKVZHm59-FDF_4lz_-FzyeMo6b3_c8HH62w4F8cif7_6XnaF2axLDGQAC4GPpFagyIAuQA", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-71cdc376", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9c01dae2-4f1e-4850-a8ae-e736094f5184", "record_id": "flaws_cloudtrail:0000474:9c01dae2-4f1e-4850-a8ae-e736094f5184", "row_index": 474, "timestamp": "2018-04-17T07:49:44Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 804, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9c01dae2-4f1e-4850-a8ae-e736094f5184", "eventTime": "2018-04-17T07:49:44Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "da425fa8-5f2d-49b0-938b-9dc8caf9b72d", "record_id": "flaws_cloudtrail:0000475:da425fa8-5f2d-49b0-938b-9dc8caf9b72d", "row_index": 475, "timestamp": "2018-04-17T07:49:44Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1931, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "da425fa8-5f2d-49b0-938b-9dc8caf9b72d", "eventTime": "2018-04-17T07:49:44Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: 3_-M3Cj5Aw9LiA91APKswhV5c7VcYyVtOabV5W9ejIVsEd_FFtBUiDCoTMVjr0vHYsHwPKBSHAl9D4xSRnIM_72pwdqgWr_6HSfIObg_Zo60-c1QRrWBVLXSklH47tgBxqHIm-zGgKBhK6ItF6c62RuSA8nxpBlwLjeBToVyw2x6syGJOaaDlSOZ6J5Bzz9FjDEApx0vA2-eLfPuGFw6dsQ_6gCpSXVpVz6Cp-WWogYDzvytQ34vQoNaXtauRoJjsw2_rPe1fRNNaee6ZBjno6PW6yGDkbQ97RLnDg2M4lCDDkJwfDxTQ2m9MUDE7WB2R3_ksceZlcsxtZUSXDvelHRb34lZ4a9814-xv4NSM3SUdjNke3_0tORpMOQwInk2SUALArQILPIVBaT3KB9TmpCHxrnFMg3zfdhoIg3Q8Iu5qYVgl4cg8_0aJkBKXxQofeuWlMKaouaTscshGuyYiHh9wSakuQ2j8T-tbMnOr0ssiIs1OAuj-EUOY1BHMK5htcVjHRUMBClFVU0kEiByu1pNtQAgbT3kHYl-Yval-DVja3Bh3JLtxGU_OOLs1-2YAhbZO5_T4kB7UnODDs1naT9pqJe4gowHx2uUHndl4NfS-V8gWzSyQLXqigJWDzZpfb1lm6h2ZPq32b_4K1hcoeNxWrEzH1Abbd4C", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-bbcb674a", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "19a5194a-1466-4f3c-af53-98f579ca21a9", "record_id": "flaws_cloudtrail:0000476:19a5194a-1466-4f3c-af53-98f579ca21a9", "row_index": 476, "timestamp": "2018-04-17T07:49:45Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 904, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "19a5194a-1466-4f3c-af53-98f579ca21a9", "eventTime": "2018-04-17T07:49:45Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4f0ed66f-ee63-4f3e-ae94-282ae702aaf5", "record_id": "flaws_cloudtrail:0000477:4f0ed66f-ee63-4f3e-ae94-282ae702aaf5", "row_index": 477, "timestamp": "2018-04-17T07:49:46Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 1374, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4f0ed66f-ee63-4f3e-ae94-282ae702aaf5", "eventTime": "2018-04-17T07:49:46Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-8c971d21", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4d20563-e68e-43a1-9415-307798a3bc3", "record_id": "flaws_cloudtrail:0000478:4d20563-e68e-43a1-9415-307798a3bc3", "row_index": 478, "timestamp": "2018-04-17T07:49:46Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 804, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4d20563-e68e-43a1-9415-307798a3bc3", "eventTime": "2018-04-17T07:49:46Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2b2aa8a5-ff26-47c0-9bde-587934300b7b", "record_id": "flaws_cloudtrail:0000479:2b2aa8a5-ff26-47c0-9bde-587934300b7b", "row_index": 479, "timestamp": "2018-04-17T07:49:46Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2b2aa8a5-ff26-47c0-9bde-587934300b7b", "eventTime": "2018-04-17T07:49:46Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1c29b6fb-38f2-4519-bcbc-2938ed31fa1d", "record_id": "flaws_cloudtrail:0000480:1c29b6fb-38f2-4519-bcbc-2938ed31fa1d", "row_index": 480, "timestamp": "2018-04-17T07:49:46Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 908, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1c29b6fb-38f2-4519-bcbc-2938ed31fa1d", "eventTime": "2018-04-17T07:49:46Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "656a5882-2d79-4150-ab93-114b2ed1846a", "record_id": "flaws_cloudtrail:0000481:656a5882-2d79-4150-ab93-114b2ed1846a", "row_index": 481, "timestamp": "2018-04-17T07:49:47Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 806, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "656a5882-2d79-4150-ab93-114b2ed1846a", "eventTime": "2018-04-17T07:49:47Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a7ea2393-2671-4fbd-9b56-ecfb5999ce27", "record_id": "flaws_cloudtrail:0000482:a7ea2393-2671-4fbd-9b56-ecfb5999ce27", "row_index": 482, "timestamp": "2018-04-17T07:49:47Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 804, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a7ea2393-2671-4fbd-9b56-ecfb5999ce27", "eventTime": "2018-04-17T07:49:47Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e7b22261-289c-48b9-ba65-c499a19dd1fa", "record_id": "flaws_cloudtrail:0000483:e7b22261-289c-48b9-ba65-c499a19dd1fa", "row_index": 483, "timestamp": "2018-04-17T07:49:48Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 1377, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e7b22261-289c-48b9-ba65-c499a19dd1fa", "eventTime": "2018-04-17T07:49:48Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-8c971d21", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "384571c-7873-4366-964a-2e51434dc3e4", "record_id": "flaws_cloudtrail:0000484:384571c-7873-4366-964a-2e51434dc3e4", "row_index": 484, "timestamp": "2018-04-17T07:49:48Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 802, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "384571c-7873-4366-964a-2e51434dc3e4", "eventTime": "2018-04-17T07:49:48Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cef77db2-9e6d-443a-946c-539d471fadcd", "record_id": "flaws_cloudtrail:0000485:cef77db2-9e6d-443a-946c-539d471fadcd", "row_index": 485, "timestamp": "2018-04-17T07:49:49Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 806, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cef77db2-9e6d-443a-946c-539d471fadcd", "eventTime": "2018-04-17T07:49:49Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a8b9322f-77e0-4cf2-a3c2-ec34096f259", "record_id": "flaws_cloudtrail:0000486:a8b9322f-77e0-4cf2-a3c2-ec34096f259", "row_index": 486, "timestamp": "2018-04-17T07:49:49Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1375, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a8b9322f-77e0-4cf2-a3c2-ec34096f259", "eventTime": "2018-04-17T07:49:49Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-2b129c1b", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "42a37b58-fc80-488d-b03c-0b2242c3f027", "record_id": "flaws_cloudtrail:0000487:42a37b58-fc80-488d-b03c-0b2242c3f027", "row_index": 487, "timestamp": "2018-04-17T07:49:49Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "42a37b58-fc80-488d-b03c-0b2242c3f027", "eventTime": "2018-04-17T07:49:49Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7c2c6ff1-0c0d-4517-97fb-786249ca9fdd", "record_id": "flaws_cloudtrail:0000488:7c2c6ff1-0c0d-4517-97fb-786249ca9fdd", "row_index": 488, "timestamp": "2018-04-17T07:49:50Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 1271, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7c2c6ff1-0c0d-4517-97fb-786249ca9fdd", "eventTime": "2018-04-17T07:49:50Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-8c971d21", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5d172e36-cf7f-4a12-99f0-59661c265", "record_id": "flaws_cloudtrail:0000489:5d172e36-cf7f-4a12-99f0-59661c265", "row_index": 489, "timestamp": "2018-04-17T07:49:50Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1376, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5d172e36-cf7f-4a12-99f0-59661c265", "eventTime": "2018-04-17T07:49:50Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-d10c94e9", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b9f56ecc-2155-4ac1-90d5-b7f09d727f18", "record_id": "flaws_cloudtrail:0000490:b9f56ecc-2155-4ac1-90d5-b7f09d727f18", "row_index": 490, "timestamp": "2018-04-17T07:49:50Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1371, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b9f56ecc-2155-4ac1-90d5-b7f09d727f18", "eventTime": "2018-04-17T07:49:50Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-2b129c1b", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0f1e5064-16a2-4d49-af02-375512eb9a47", "record_id": "flaws_cloudtrail:0000491:0f1e5064-16a2-4d49-af02-375512eb9a47", "row_index": 491, "timestamp": "2018-04-17T07:49:50Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0f1e5064-16a2-4d49-af02-375512eb9a47", "eventTime": "2018-04-17T07:49:50Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "02b570c9-1aa8-4595-8fa0-a7e5e21c29e4", "record_id": "flaws_cloudtrail:0000492:02b570c9-1aa8-4595-8fa0-a7e5e21c29e4", "row_index": 492, "timestamp": "2018-04-17T07:49:51Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1377, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "02b570c9-1aa8-4595-8fa0-a7e5e21c29e4", "eventTime": "2018-04-17T07:49:51Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-2b129c1b", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "213603b3c-720e-4b7d-a977-b92317f20", "record_id": "flaws_cloudtrail:0000493:213603b3c-720e-4b7d-a977-b92317f20", "row_index": 493, "timestamp": "2018-04-17T07:49:51Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 801, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "213603b3c-720e-4b7d-a977-b92317f20", "eventTime": "2018-04-17T07:49:51Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0516ba00-0a1e-4e86-8438-3582bae8fb0e", "record_id": "flaws_cloudtrail:0000494:0516ba00-0a1e-4e86-8438-3582bae8fb0e", "row_index": 494, "timestamp": "2018-04-17T07:49:51Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0516ba00-0a1e-4e86-8438-3582bae8fb0e", "eventTime": "2018-04-17T07:49:51Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a65f08bd-8efe-42b6-b75a-cdfde00c7467", "record_id": "flaws_cloudtrail:0000495:a65f08bd-8efe-42b6-b75a-cdfde00c7467", "row_index": 495, "timestamp": "2018-04-17T07:49:52Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 1929, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a65f08bd-8efe-42b6-b75a-cdfde00c7467", "eventTime": "2018-04-17T07:49:52Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: -7te4ELY3J7xA3FI1ClKAXwo_jOzsoeECSplyme0xOdqmV7OuewwGhvv9biMwXcwXyvsTDaszr6vufw7_y9p0ntE5uEHtkgl2K0x4BM5nv7bjRGvCnMRn5cvmH_Ok5URR-sgR7ViCk5u3yYABSCHknGL14Bq9Jf8kAoqIdq33CAjBGElHsEcH9O1ZsxDWFvqjQt06cPoZDv8v3ALPScTTljSqNqUu_IrPTIgYVDdnjO3Q0GSIfqAUByU4MFvDABcZfwk_7BdAPMzyqIdnEaSlam_oNwcv8S-tU0R5m9jJutaUCZEo_ZzpfPIibIogmaLYA-zptLV8GTIGy15yV-E668542ZqXRh9F_uA25hA-_YWwz0YL2nWzRYNHBLrtao6kkk05LRGMRfI7VHum0Bvp9QtDmCyZRBXlCA4idY9ePSPZDR4tjWIE_JQkLxbpnxHmmsFZF5b7OV_k4YzsBlf9mw11bHp77WD_SBJwSVxu8L7U8qRbZs3xsK8uPpd1n6he51sntErcQbuKFJsO-QQ-_kVpt-IPP_Tfp_CShWOomEIBXj0vl4Eo-ESg9g73bF8ndyeI-xHdcnT7YDA8ckzfjEeHLji9bg7hXfm6wUiFt8StAwpzyaz39CumMx5rJXOXOMYkdS3aeL2YcHEM-_bfZILhSwoVX5-e8aE", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-8c971d21", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bb1b55a0-213b-415b-8e27-16c438d7a637", "record_id": "flaws_cloudtrail:0000496:bb1b55a0-213b-415b-8e27-16c438d7a637", "row_index": 496, "timestamp": "2018-04-17T07:49:52Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1379, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bb1b55a0-213b-415b-8e27-16c438d7a637", "eventTime": "2018-04-17T07:49:52Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-d10c94e9", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "995641e-078c-4280-9a03-9e52e1440a10", "record_id": "flaws_cloudtrail:0000497:995641e-078c-4280-9a03-9e52e1440a10", "row_index": 497, "timestamp": "2018-04-17T07:49:52Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1925, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "995641e-078c-4280-9a03-9e52e1440a10", "eventTime": "2018-04-17T07:49:52Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: 56RnSGQJR2q1PxFqSVzglhV1OndynNT8XIz0Z-wVsixay3NKzzcAsIgl3yFxYFKGeVt58iuQw7ZJq4vlJAZO5vmaRZD5L8DRMQIJgESz0lKFQdscUFuzi4W4CB-Z_KvpsmL_EKUgi6M0f-YvXEqbHo25rO_l1gfBRs5f053T8s860028DxnNFF2K4Qc0mHyg-P7JoUL8NTV096ChVPtvRJeiNzm1ZGpOHlz0L1LM__ep0c3o3r2l8_waKyT_FfLRq-T_upa4zn2Qq-KchfSTCtHXEUBET3FtYSZaHvgIn0VH2pZuPlbUpzKbKsZXwPX9WQ67EEZPg9nwAsX9otSZrxo2eLxWpLcrLoymLVrwFRLegIoVZg2uYevUwEYvXEVn256VFdYhecHm88D3GvBIHw06LqjvOTER96SWdRQVKYfmmdk1ckiQfECpXB0pqUsBn-l1rKxiZtfG4G13CwUGMLEUfD9Gnk8-ZB_PKiPiyQinAwOzEjZ17qobHdMLUa3Jfh-vZrcJYuKDuhJZqPymM8UO2wFZXaL7A6LKvyi48Ge-6x1mbxFdbDx5DzKMqCmg3zQ2zb3rTwQFvEOD9hknhiTrG1mklUeTWpsLl9Nxgo0oKEgsRbu_4CQD7suBS3A3n6t8yd_x7-meeIariFS40oWUw7sxsIjFrA", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-2b129c1b", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0da260043-353d-4b0e-8386-956bf4b37c33", "record_id": "flaws_cloudtrail:0000498:0da260043-353d-4b0e-8386-956bf4b37c33", "row_index": 498, "timestamp": "2018-04-17T07:49:53Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 804, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0da260043-353d-4b0e-8386-956bf4b37c33", "eventTime": "2018-04-17T07:49:53Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "60abec1a-b82b-4f2a-83d6-ca6d65ad2fff", "record_id": "flaws_cloudtrail:0000499:60abec1a-b82b-4f2a-83d6-ca6d65ad2fff", "row_index": 499, "timestamp": "2018-04-17T07:49:53Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "60abec1a-b82b-4f2a-83d6-ca6d65ad2fff", "eventTime": "2018-04-17T07:49:53Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e97290-0051-442a-9996-8ba3d04afe2a", "record_id": "flaws_cloudtrail:0000500:e97290-0051-442a-9996-8ba3d04afe2a", "row_index": 500, "timestamp": "2018-04-17T07:49:54Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1271, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e97290-0051-442a-9996-8ba3d04afe2a", "eventTime": "2018-04-17T07:49:54Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-d10c94e9", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ec71408-5c4f-469a-a94e-b9200c6c3c7c", "record_id": "flaws_cloudtrail:0000501:ec71408-5c4f-469a-a94e-b9200c6c3c7c", "row_index": 501, "timestamp": "2018-04-17T07:49:54Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 1375, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ec71408-5c4f-469a-a94e-b9200c6c3c7c", "eventTime": "2018-04-17T07:49:54Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-3a3a9be3", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "24332beb-3bc4-437e-ba1c-a6e2ab46ce75", "record_id": "flaws_cloudtrail:0000502:24332beb-3bc4-437e-ba1c-a6e2ab46ce75", "row_index": 502, "timestamp": "2018-04-17T07:49:55Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1373, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "24332beb-3bc4-437e-ba1c-a6e2ab46ce75", "eventTime": "2018-04-17T07:49:55Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-63f71193", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cf6796a5-dd8b-4fc5-886b-91edf231b0df", "record_id": "flaws_cloudtrail:0000503:cf6796a5-dd8b-4fc5-886b-91edf231b0df", "row_index": 503, "timestamp": "2018-04-17T07:49:56Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1930, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cf6796a5-dd8b-4fc5-886b-91edf231b0df", "eventTime": "2018-04-17T07:49:56Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: hb0mncgZO1OLVq_E_WyLX0xZEgZ3bh8WY6aC7yVM8_qwAbZ3IRQfU0TVZWsKu8xCg886nHum6AOQvALE6v0qjS7xJPjo615WgojIBatfyj5cd7wX16wndKfKOi3987_5kLrkoIYNrJzR7t4Bm03w1TAC1SvAJDM6ojNy7R_c2r7ExIejvLV2nq62k_aJ86FIQg7I7G7hMkMRGrK4InukAFzzM_QUGX75AeTX2DfgEfkTdF_-SdkC1ejEEqs0GZSPjaH_vak4neNQU0gsa6VlcD500dsSuKTuqT_IyChJIR6NipG678zpMvf1IOFljlHxbCwcXd9wSA0vLR0j_Uaj-7lPwkVI-fYuD4GZP32He9pyxKNU16xuFqRfxj68s1SnF3R7-N4StMiqNVR_pmyBBTWhfOiDTeKCH1hNLdFYQ9voF_nMr8aBIJdUaTcazp0T9t0Rvr302QXlwNbGxQFoqAKfUdwLLDYbzWPd3b710N-3T1C9PdXQ-K9UYUdAdrG5O7DrfxoE9WaIvZ-FqXehu0M3svZOPmu0Hi20fz_P7L7eRE1v7opEsn7jA2-onkZqlWZ3GRklGP3OlOEKduFsrH-6LCzlEEiPcw1FadoHHkUaOhIvda_6l92SD1kLng-FaQzQ7ZAIQw9ThDCnTQKNcDmCC745QlDPa8iB", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-d10c94e9", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "206682a-2d6c-40d0-b997-0c5647e62f8e", "record_id": "flaws_cloudtrail:0000504:206682a-2d6c-40d0-b997-0c5647e62f8e", "row_index": 504, "timestamp": "2018-04-17T07:49:56Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1375, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "206682a-2d6c-40d0-b997-0c5647e62f8e", "eventTime": "2018-04-17T07:49:56Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-63f71193", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0daee561-343e-4b42-b611-e9e099730b10c", "record_id": "flaws_cloudtrail:0000505:0daee561-343e-4b42-b611-e9e099730b10c", "row_index": 505, "timestamp": "2018-04-17T07:49:56Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 1378, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0daee561-343e-4b42-b611-e9e099730b10c", "eventTime": "2018-04-17T07:49:56Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-3a3a9be3", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6e12ee64-cf0f-4dc8-9abc-21562eb23865", "record_id": "flaws_cloudtrail:0000506:6e12ee64-cf0f-4dc8-9abc-21562eb23865", "row_index": 506, "timestamp": "2018-04-17T07:49:57Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 1266, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6e12ee64-cf0f-4dc8-9abc-21562eb23865", "eventTime": "2018-04-17T07:49:57Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-3a3a9be3", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b5bd0664-867e-4dc2-9af2-65c403645", "record_id": "flaws_cloudtrail:0000507:b5bd0664-867e-4dc2-9af2-65c403645", "row_index": 507, "timestamp": "2018-04-17T07:49:58Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1267, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b5bd0664-867e-4dc2-9af2-65c403645", "eventTime": "2018-04-17T07:49:58Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-63f71193", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f589491-7381-46f8-aafe-6b719b639814", "record_id": "flaws_cloudtrail:0000508:f589491-7381-46f8-aafe-6b719b639814", "row_index": 508, "timestamp": "2018-04-17T07:49:59Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1925, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f589491-7381-46f8-aafe-6b719b639814", "eventTime": "2018-04-17T07:49:59Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: N2TvwHsulUS0X-YtKv5XcP3ibsxJfiFyBxXHVL3js2I2qgxw5yFTfkbw-DtNG5pB_5vn4NTGk94NCVY1MrdSwHnp0gABEGu7k0lQRfrvW1waEJjw81wc88SnLc3sCflGd5dDf8dyaAW014S7qgu993-II89MfpYiYEtXMGgBN0X4Ep5W0Gkcdr5EYuO5aFOLAHvf829zn_CbRrH9zTk3U4zPKwob4zi3_re5F1PEZpOKCRjFg_4gxqOF92tFY6XEQO2uBpMVhgEyl-6i0cRA18pSLLdapfR-C04RVNa63QpHOhfqogYcrqhJskjjKKr8UPAv1atY0ZoNrMwHF1PrfxINdtemab-NRpJKnBbgmcucjhiGAS8hoT5xwXOvURtuS2vFIWt5yJ4oJHreazQ5DeT_9aJ0ZfuG6dSSCmWkLZlDHeV3gUyEsThoIz3AmH_8PdEdXwOyS-MmxJQshX6cEtJHmeIQ7TBlKNVSM26BeexjQmhqvo3dYQ5Gt9JhLYW52C-N01wr4sP1MG7VM20OaQE15enwA3-ECmmp3zX0Jts1S09r8Iy_8fN2BP3m2ZkaNbZr06z8IT6XqWOQw947_vrX1vPWKxnLZnwO4R83HxoXjIlWMA-JVgd6sOOUMLUuvJ_i5vkov-43G2Ro12g1WJvbcsAXntQ_jQ", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-63f71193", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b66d6568-aa03-44f9-b523-844206e82190", "record_id": "flaws_cloudtrail:0000509:b66d6568-aa03-44f9-b523-844206e82190", "row_index": 509, "timestamp": "2018-04-17T07:49:59Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 1927, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b66d6568-aa03-44f9-b523-844206e82190", "eventTime": "2018-04-17T07:49:59Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: Ea1qHyhwF50GipyHAqy93AMkPu5TJEJypKlw_K65xeyk9cOzTp7OSaOnq1TJfSA4yJTnVoWTmhyiu0f4WxdYA0Tt8yIhoH_N-YSWKh8U4Osfl8V3PtYRfMnb-Ez4QkZSK2pHfx18qdW5Nz8KZnNbzFg6B7qo9e96slxFkvuhuZb0YKjfwv2OUiH7mjapI69kjQ55De0jB4rijzfX8l5kKCJUx9nCPhjKZ04hLRKOFQ-lhUbxRHFgBvjptYaJMpx5pKd8Unfrdg8VwBjO6v7M2HJQVRW9nypIdHyGWOJZNNxajR1g1vazu6UNmXAzXEAOJjf_NcPfqhO4tyVe-dku6_WO5QGKBlYJuu5vRHp2eBiakTIl7mQeCf35yNsGnjKFw4tAgQNptkDy2AV8yD4BnHyJ5-3Tcl3W_B3qH_PTQmhxVFM4FXek2edSrDgWx84_0lpM4vlaIi79QuFqRG2zyEgxWAtyIuRUMrVkRcpWBIPeAw5IU-ss3K1Q_pMdfgoJAen16EDgU6eBqMQzEdA3gZWmmfYNzvriGmX4uJBUv4YGshgWc7rec49x9y77Bk4vA8yQooA6AGkhlJ1dsQdWODz9TLeUYJTmznxc7sDDMzJEYrFIkHEwAGyfzP3kuuFmLWHIQ7yx235KHmxd8bdmhyTeKOfa3zbUNuk", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-3a3a9be3", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ca3db3e5-9a18-4b6e-b57c-10f99558a4bc", "record_id": "flaws_cloudtrail:0000510:ca3db3e5-9a18-4b6e-b57c-10f99558a4bc", "row_index": 510, "timestamp": "2018-04-17T07:50:02Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 775, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ca3db3e5-9a18-4b6e-b57c-10f99558a4bc", "eventTime": "2018-04-17T07:50:02Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c58f2e28-93b4-40f8-ad54-ee4e7f6ebe1e", "record_id": "flaws_cloudtrail:0000511:c58f2e28-93b4-40f8-ad54-ee4e7f6ebe1e", "row_index": 511, "timestamp": "2018-04-17T07:50:31Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1488, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c58f2e28-93b4-40f8-ad54-ee4e7f6ebe1e", "eventTime": "2018-04-17T07:50:31Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIAVFS9YOB4PHTQWJ8X", "expiration": "Apr 17, 2018 2:07:46 PM", "sessionToken": "FQoDYXdzEKH//////////wEaDPiYsY5oxQLz/ttAyCK3Ayz+bkZNyjrxNl5vAJ6k23vTDnl79q52EtRly2JlUbAdvew/uUqndGsa9c6aF3Pipa/IolcLyWixXEZ1SlwiyvzkO2Do0lck+/GNCTfr3GcIGen2KSU2tDWbd60DZWnQzFF1ikJq6sr/o6eq6RFnhfpCRiMOj3flQu7ObslM28YKhsaX7irJCua+5biPimzAbNNEwPFXQCE86Oaw6IFinWd1NrniXlqxfK0r0ZqEeiZkfNCNniDoK2w2cf3RXxShaU2Pz9mZGbGQFipJUM0MKWwj2BVfJEYQXPRe8UUjKG+TIo8UzeFmCtC9GJ0xePffpK+WdRtEgIZR5pvBhILnc2aO/4NFBN3NV5yb7/uu5FleNyb6JDR6ROm7B3+kb///BsMYJIDnTsBR69b/VyOfEiySTVTExv1UExz9UxmoYZBYks+/8Zt+GlLesg3maXmfbFb2EAlANcYYBzoUDV4zcteljeola+kAUJZxQz4DtapHOSbcDuDsRbFZUWqKKtR91udHX/mLPHkNgJ2rci79M+0ja4/JuPSv+HfvRZWypogo/JkMwUlUOnrAfHvtvR30R6ykEl21owMox87W1gU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d76bd766-9fcc-4df8-9a4e-535399b617ce", "record_id": "flaws_cloudtrail:0000512:d76bd766-9fcc-4df8-9a4e-535399b617ce", "row_index": 512, "timestamp": "2018-04-17T07:55:33Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIAYJ08URZ7AGPIONWH", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "58.77.23.150", "user_agent": "Boto3/1.16.51 Python/3.7.10 Linux/4.14.225 Botocore/1.19.51", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 509, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d76bd766-9fcc-4df8-9a4e-535399b617ce", "eventTime": "2018-04-17T07:55:33Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "58.77.23.150", "userAgent": "Boto3/1.16.51 Python/3.7.10 Linux/4.14.225 Botocore/1.19.51", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIAYJ08URZ7AGPIONWH", "userName": "backup"}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d7dc8c09-1f83-4fc2-97b8-d9ebbda70e1b", "record_id": "flaws_cloudtrail:0000513:d7dc8c09-1f83-4fc2-97b8-d9ebbda70e1b", "row_index": 513, "timestamp": "2018-04-17T07:56:39Z", "event_type": "ListUsers", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIAYJ08URZ7AGPIONWH", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "58.77.23.150", "user_agent": "Boto3/1.16.51 Python/3.7.10 Linux/4.14.225 Botocore/1.19.51", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 538, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d7dc8c09-1f83-4fc2-97b8-d9ebbda70e1b", "eventTime": "2018-04-17T07:56:39Z", "eventName": "ListUsers", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "58.77.23.150", "userAgent": "Boto3/1.16.51 Python/3.7.10 Linux/4.14.225 Botocore/1.19.51", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIAYJ08URZ7AGPIONWH", "userName": "backup"}, "requestParameters": {"maxItems": 100}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e59b721a-a398-4694-958d-43d4909a52d6", "record_id": "flaws_cloudtrail:0000514:e59b721a-a398-4694-958d-43d4909a52d6", "row_index": 514, "timestamp": "2018-04-17T07:58:23Z", "event_type": "ListAccessKeys", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIAYJ08URZ7AGPIONWH", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "58.77.23.150", "user_agent": "Boto3/1.16.51 Python/3.7.10 Linux/4.14.225 Botocore/1.19.51", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 548, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e59b721a-a398-4694-958d-43d4909a52d6", "eventTime": "2018-04-17T07:58:23Z", "eventName": "ListAccessKeys", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "58.77.23.150", "userAgent": "Boto3/1.16.51 Python/3.7.10 Linux/4.14.225 Botocore/1.19.51", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIAYJ08URZ7AGPIONWH", "userName": "backup"}, "requestParameters": {"userName": "backup"}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1b385feb-a5c4-41fa-8fd7-94457c74132c", "record_id": "flaws_cloudtrail:0000515:1b385feb-a5c4-41fa-8fd7-94457c74132c", "row_index": 515, "timestamp": "2018-04-17T08:01:03Z", "event_type": "CreateUser", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIAYJ08URZ7AGPIONWH", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "58.77.23.150", "user_agent": "Boto3/1.16.51 Python/3.7.10 Linux/4.14.225 Botocore/1.19.51", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:user/backup-bot-547"], "raw_record_size_bytes": 622, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "resources", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1b385feb-a5c4-41fa-8fd7-94457c74132c", "eventTime": "2018-04-17T08:01:03Z", "eventName": "CreateUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "58.77.23.150", "userAgent": "Boto3/1.16.51 Python/3.7.10 Linux/4.14.225 Botocore/1.19.51", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIAYJ08URZ7AGPIONWH", "userName": "backup"}, "requestParameters": {"userName": "backup-bot-547"}, "resources": [{"ARN": "arn:aws:iam::811596193553:user/backup-bot-547"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1cc3083c-400b-4864-83f1-addcde14e813", "record_id": "flaws_cloudtrail:0000516:1cc3083c-400b-4864-83f1-addcde14e813", "row_index": 516, "timestamp": "2018-04-17T08:01:56Z", "event_type": "CreateAccessKey", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIAYJ08URZ7AGPIONWH", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "58.77.23.150", "user_agent": "Boto3/1.16.51 Python/3.7.10 Linux/4.14.225 Botocore/1.19.51", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:user/backup-bot-547"], "raw_record_size_bytes": 627, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "resources", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1cc3083c-400b-4864-83f1-addcde14e813", "eventTime": "2018-04-17T08:01:56Z", "eventName": "CreateAccessKey", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "58.77.23.150", "userAgent": "Boto3/1.16.51 Python/3.7.10 Linux/4.14.225 Botocore/1.19.51", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIAYJ08URZ7AGPIONWH", "userName": "backup"}, "requestParameters": {"userName": "backup-bot-547"}, "resources": [{"ARN": "arn:aws:iam::811596193553:user/backup-bot-547"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "038939fb-4093-465c-8855-383519525b67", "record_id": "flaws_cloudtrail:0000517:038939fb-4093-465c-8855-383519525b67", "row_index": 517, "timestamp": "2018-04-17T08:02:24Z", "event_type": "AttachUserPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIAYJ08URZ7AGPIONWH", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "58.77.23.150", "user_agent": "Boto3/1.16.51 Python/3.7.10 Linux/4.14.225 Botocore/1.19.51", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:user/backup-bot-547", "arn:aws:iam::aws:policy/AmazonS3FullAccess"], "raw_record_size_bytes": 738, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "resources", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "038939fb-4093-465c-8855-383519525b67", "eventTime": "2018-04-17T08:02:24Z", "eventName": "AttachUserPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "58.77.23.150", "userAgent": "Boto3/1.16.51 Python/3.7.10 Linux/4.14.225 Botocore/1.19.51", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIAYJ08URZ7AGPIONWH", "userName": "backup"}, "requestParameters": {"userName": "backup-bot-547", "policyArn": "arn:aws:iam::aws:policy/AmazonS3FullAccess"}, "resources": [{"ARN": "arn:aws:iam::811596193553:user/backup-bot-547"}, {"ARN": "arn:aws:iam::aws:policy/AmazonS3FullAccess"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "46352ed-78b4-4b24-903f-6b1fc4adc2da", "record_id": "flaws_cloudtrail:0000518:46352ed-78b4-4b24-903f-6b1fc4adc2da", "row_index": 518, "timestamp": "2018-04-17T08:15:33Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 873, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "46352ed-78b4-4b24-903f-6b1fc4adc2da", "eventTime": "2018-04-17T08:15:33Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "02bea894-de26-48c7-bac3-013a20d33be8", "record_id": "flaws_cloudtrail:0000519:02bea894-de26-48c7-bac3-013a20d33be8", "row_index": 519, "timestamp": "2018-04-17T08:15:36Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 804, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "02bea894-de26-48c7-bac3-013a20d33be8", "eventTime": "2018-04-17T08:15:36Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "79aff9ab-90ae-44c9-97b7-8d9faa8eb11c", "record_id": "flaws_cloudtrail:0000520:79aff9ab-90ae-44c9-97b7-8d9faa8eb11c", "row_index": 520, "timestamp": "2018-04-17T08:15:38Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 913, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "79aff9ab-90ae-44c9-97b7-8d9faa8eb11c", "eventTime": "2018-04-17T08:15:38Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8ecee39c-4cdd-404e-a6ba-65d2e5c2a6d3", "record_id": "flaws_cloudtrail:0000521:8ecee39c-4cdd-404e-a6ba-65d2e5c2a6d3", "row_index": 521, "timestamp": "2018-04-17T08:15:38Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 913, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8ecee39c-4cdd-404e-a6ba-65d2e5c2a6d3", "eventTime": "2018-04-17T08:15:38Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b298a0bd-66d4-4d69-b24c-0f6e309f4d47", "record_id": "flaws_cloudtrail:0000522:b298a0bd-66d4-4d69-b24c-0f6e309f4d47", "row_index": 522, "timestamp": "2018-04-17T08:15:38Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 908, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b298a0bd-66d4-4d69-b24c-0f6e309f4d47", "eventTime": "2018-04-17T08:15:38Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "79e27e8f-7ee8-4d4f-a85f-99032e4abf75", "record_id": "flaws_cloudtrail:0000523:79e27e8f-7ee8-4d4f-a85f-99032e4abf75", "row_index": 523, "timestamp": "2018-04-17T08:15:38Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 908, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "79e27e8f-7ee8-4d4f-a85f-99032e4abf75", "eventTime": "2018-04-17T08:15:38Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "98ece823-3f97-4982-a509-bfdbb3bab92c", "record_id": "flaws_cloudtrail:0000524:98ece823-3f97-4982-a509-bfdbb3bab92c", "row_index": 524, "timestamp": "2018-04-17T08:15:41Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "98ece823-3f97-4982-a509-bfdbb3bab92c", "eventTime": "2018-04-17T08:15:41Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f01c3311-ee75-4d62-b7bb-e43b8f67dd04", "record_id": "flaws_cloudtrail:0000525:f01c3311-ee75-4d62-b7bb-e43b8f67dd04", "row_index": 525, "timestamp": "2018-04-17T08:15:41Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f01c3311-ee75-4d62-b7bb-e43b8f67dd04", "eventTime": "2018-04-17T08:15:41Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c1e390ec-2022-4345-956a-eda67c1e2bb1", "record_id": "flaws_cloudtrail:0000526:c1e390ec-2022-4345-956a-eda67c1e2bb1", "row_index": 526, "timestamp": "2018-04-17T08:15:41Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 802, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c1e390ec-2022-4345-956a-eda67c1e2bb1", "eventTime": "2018-04-17T08:15:41Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "68fd425c-26e3-4c34-9f00-dcf675f2491b", "record_id": "flaws_cloudtrail:0000527:68fd425c-26e3-4c34-9f00-dcf675f2491b", "row_index": 527, "timestamp": "2018-04-17T08:15:42Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "68fd425c-26e3-4c34-9f00-dcf675f2491b", "eventTime": "2018-04-17T08:15:42Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c658c9ed-22f2-4c4d-ab76-f068757d1dca7", "record_id": "flaws_cloudtrail:0000528:c658c9ed-22f2-4c4d-ab76-f068757d1dca7", "row_index": 528, "timestamp": "2018-04-17T08:15:42Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 804, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c658c9ed-22f2-4c4d-ab76-f068757d1dca7", "eventTime": "2018-04-17T08:15:42Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "827f8d35-ebf5-4256-ab2f-caf08a9f333e", "record_id": "flaws_cloudtrail:0000529:827f8d35-ebf5-4256-ab2f-caf08a9f333e", "row_index": 529, "timestamp": "2018-04-17T08:15:42Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "827f8d35-ebf5-4256-ab2f-caf08a9f333e", "eventTime": "2018-04-17T08:15:42Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fb266e63-53e0-4cff-9c82-422dc10e052a", "record_id": "flaws_cloudtrail:0000530:fb266e63-53e0-4cff-9c82-422dc10e052a", "row_index": 530, "timestamp": "2018-04-17T08:15:43Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fb266e63-53e0-4cff-9c82-422dc10e052a", "eventTime": "2018-04-17T08:15:43Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d7e33ca0-64c7-4ff7-84a0-f62d6717f95c", "record_id": "flaws_cloudtrail:0000531:d7e33ca0-64c7-4ff7-84a0-f62d6717f95c", "row_index": 531, "timestamp": "2018-04-17T08:15:43Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 802, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d7e33ca0-64c7-4ff7-84a0-f62d6717f95c", "eventTime": "2018-04-17T08:15:43Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2342ab44-4fda-433d-b3d5-359aebb95834", "record_id": "flaws_cloudtrail:0000532:2342ab44-4fda-433d-b3d5-359aebb95834", "row_index": 532, "timestamp": "2018-04-17T08:15:43Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2342ab44-4fda-433d-b3d5-359aebb95834", "eventTime": "2018-04-17T08:15:43Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "481413d-b58a-4766-9076-6b1645f70080", "record_id": "flaws_cloudtrail:0000533:481413d-b58a-4766-9076-6b1645f70080", "row_index": 533, "timestamp": "2018-04-17T08:15:44Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 807, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "481413d-b58a-4766-9076-6b1645f70080", "eventTime": "2018-04-17T08:15:44Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "52329-b514-4ab2-80d8-25dd1b5d748d", "record_id": "flaws_cloudtrail:0000534:52329-b514-4ab2-80d8-25dd1b5d748d", "row_index": 534, "timestamp": "2018-04-17T08:15:44Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 805, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "52329-b514-4ab2-80d8-25dd1b5d748d", "eventTime": "2018-04-17T08:15:44Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "23eb1239-1d99-436b-a8ed-f27f395cfcaf", "record_id": "flaws_cloudtrail:0000535:23eb1239-1d99-436b-a8ed-f27f395cfcaf", "row_index": 535, "timestamp": "2018-04-17T08:15:44Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "23eb1239-1d99-436b-a8ed-f27f395cfcaf", "eventTime": "2018-04-17T08:15:44Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2e7ac5c9-a010-4011-8186-c45d121f7698", "record_id": "flaws_cloudtrail:0000536:2e7ac5c9-a010-4011-8186-c45d121f7698", "row_index": 536, "timestamp": "2018-04-17T08:15:44Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1268, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2e7ac5c9-a010-4011-8186-c45d121f7698", "eventTime": "2018-04-17T08:15:44Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-f5710223", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c69718-a7ea-4993-b23c-58a4d815fb22", "record_id": "flaws_cloudtrail:0000537:c69718-a7ea-4993-b23c-58a4d815fb22", "row_index": 537, "timestamp": "2018-04-17T08:15:45Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1374, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c69718-a7ea-4993-b23c-58a4d815fb22", "eventTime": "2018-04-17T08:15:45Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ef6f0d3", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "932a5d6c-9975-41a8-a777-9636a1f003c1", "record_id": "flaws_cloudtrail:0000538:932a5d6c-9975-41a8-a777-9636a1f003c1", "row_index": 538, "timestamp": "2018-04-17T08:15:45Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1376, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "932a5d6c-9975-41a8-a777-9636a1f003c1", "eventTime": "2018-04-17T08:15:45Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-f5710223", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "db32d562-1de6-48fa-978a-682f703036c7", "record_id": "flaws_cloudtrail:0000539:db32d562-1de6-48fa-978a-682f703036c7", "row_index": 539, "timestamp": "2018-04-17T08:15:46Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1381, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "db32d562-1de6-48fa-978a-682f703036c7", "eventTime": "2018-04-17T08:15:46Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ca57294", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "81297-1c93-482e-8f3b-cf3b7578bd06", "record_id": "flaws_cloudtrail:0000540:81297-1c93-482e-8f3b-cf3b7578bd06", "row_index": 540, "timestamp": "2018-04-17T08:15:46Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1378, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "81297-1c93-482e-8f3b-cf3b7578bd06", "eventTime": "2018-04-17T08:15:46Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-14f2b3cc", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8df248816-650b-4be3-8ba0-b3b4f4e693dd", "record_id": "flaws_cloudtrail:0000541:8df248816-650b-4be3-8ba0-b3b4f4e693dd", "row_index": 541, "timestamp": "2018-04-17T08:15:46Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1271, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8df248816-650b-4be3-8ba0-b3b4f4e693dd", "eventTime": "2018-04-17T08:15:46Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-f5710223", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b6d2d31b-5070-44fc-9a06-8d1a6edc1f05", "record_id": "flaws_cloudtrail:0000542:b6d2d31b-5070-44fc-9a06-8d1a6edc1f05", "row_index": 542, "timestamp": "2018-04-17T08:15:47Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1381, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b6d2d31b-5070-44fc-9a06-8d1a6edc1f05", "eventTime": "2018-04-17T08:15:47Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-14f2b3cc", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cfaf74d8-14dc-47a6-a0cc-293bac4abf9e", "record_id": "flaws_cloudtrail:0000543:cfaf74d8-14dc-47a6-a0cc-293bac4abf9e", "row_index": 543, "timestamp": "2018-04-17T08:15:47Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1275, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cfaf74d8-14dc-47a6-a0cc-293bac4abf9e", "eventTime": "2018-04-17T08:15:47Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-14f2b3cc", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d71f1782-49ee-4a43-a87e-9218b7f86aa4", "record_id": "flaws_cloudtrail:0000544:d71f1782-49ee-4a43-a87e-9218b7f86aa4", "row_index": 544, "timestamp": "2018-04-17T08:15:47Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 908, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d71f1782-49ee-4a43-a87e-9218b7f86aa4", "eventTime": "2018-04-17T08:15:47Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "476fd92f-504e-4a1c-96a1-753648d557", "record_id": "flaws_cloudtrail:0000545:476fd92f-504e-4a1c-96a1-753648d557", "row_index": 545, "timestamp": "2018-04-17T08:15:47Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1374, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "476fd92f-504e-4a1c-96a1-753648d557", "eventTime": "2018-04-17T08:15:47Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ef6f0d3", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "df072fc4-17d8-42b4-9d56-27a85efa9a27", "record_id": "flaws_cloudtrail:0000546:df072fc4-17d8-42b4-9d56-27a85efa9a27", "row_index": 546, "timestamp": "2018-04-17T08:15:47Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1925, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "df072fc4-17d8-42b4-9d56-27a85efa9a27", "eventTime": "2018-04-17T08:15:47Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: PIvpFjAb4db-LuWrI_04Yn47xtlVBJNz3EehGfaDnxagj3nE1HcUZ__aThWDKMHJWYAa_8Klq0MY6wL_kQFtbU7E6codj84QpdG-g9DPdjTPVN_9QuOPO4q-w4iDPy9zNQnN0CWLCrKx6iuwe4LOEX8kI-Mhfo0Sv_lRjQTPs7N83WG7LQetqUZ7GrPEcjXk62cLSsU-2WKCZh7McrXPA5NZpjyERWl1Cy-hjAHUtB1BRkV8htzMXcuGoTNdptTYYzn5ROOP1k8-6YF5OlbCkbJIvPd4r_Uu-Ts3R1ha-ttbu6Ihel56fJqNBaE5Io_D8eOTj_1We8chN3vNAQGIfDy2DdSL-1zdfKslJAoac0eJGkLaa0R_qaMbgCzh04GBA6RJ6qhhTlVjDLl9cng9Oo9qtPIig0G4rCsPlegqHnVfPuhPX5OP0IWThdbwyUlEucLUs3_SYdfxqspMMoS3u1dPYkTWbf8srgOlHb9OhieIxv54ZyJkwZQsdJ44p5xtCeSBP5ExDFS_yxFa0DFHwE1fUytFeO9ZHabckFoksohx49Ap23_L7uDhfudbgH4dOt7fPJjwJCOAOwuinq3m7a5iwkhKjOVj_rQKIF2ir4yf_kiLGAe4qknWoZRRH0Os8M-yhVwG8HQ9-zM0i5wJVuvZu8XuJxhz-A", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-f5710223", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4e204be7-e37e-47fb-89c7-5b68f7fb8772", "record_id": "flaws_cloudtrail:0000547:4e204be7-e37e-47fb-89c7-5b68f7fb8772", "row_index": 547, "timestamp": "2018-04-17T08:15:48Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1381, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4e204be7-e37e-47fb-89c7-5b68f7fb8772", "eventTime": "2018-04-17T08:15:48Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ca57294", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c5a7dd05-b8b4-482e-942e-c7187b4d202a", "record_id": "flaws_cloudtrail:0000548:c5a7dd05-b8b4-482e-942e-c7187b4d202a", "row_index": 548, "timestamp": "2018-04-17T08:15:48Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1936, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c5a7dd05-b8b4-482e-942e-c7187b4d202a", "eventTime": "2018-04-17T08:15:48Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: y3tSqg2QsjW5OHYN5mJ387TPjjZr9dh6aGC0DqTMNb4U1Us07U6kmojif-nq0pqAsMAUlUpWQ8YLJbupK4PQHH1WwVIgXHuoan6ILO0h_byOqxzagI7k0A4U0KQif8dMQfr0DAAMtzg85o98ZAWJuzvYT4ZL_8qqYW9DYx0o2BiQiAkTO6CqLiNJ00PZFlv34Xg-9yCdb7F_Cncj_ZhH1bmphRfLdExvFqcFAY5qiQHDoL50Ej4EA93vZGCElXfBtnLu1jjivs_YZpK3vtdBGOXSSbURGiBUqzkbiw3Y319GgdmKTPuIXIRh2TVLRkH_7Ia_-mKmsN9QA0La_C-0yRmhCztMCMvcv6vIGCtSm5nIJ7t5KjKBl_psbS7bR7d-lJYUtzuVNF4K3jPFsSW2iA5Hi93hzSc43Bn-Fc25VYFV68MGMo53oktWz5ddLko1AyRhEiLyy7t88Z_mNr1pc4G7m6Y7zUTMXWlHNhtalJNq-UjAKuzsMLeTALnMIs00228E1in4q_gJw1dgY1yTdyOERekIbs4w-rJJCnEzbFMFcf2cR4mdRot9vj3Ok7bUAoeUSjbBhsG8iWCCPrWMQmOOAMyPA-GxFlDRtiuNpjXtsnLYRvgC8qyQEc062bT2PAlgao6eWI6syAERNvOzylNj6KqsCPbmBpu9_e4", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-14f2b3cc", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "148014f00-566e-421c-ab37-53d5d1d11fc7", "record_id": "flaws_cloudtrail:0000549:148014f00-566e-421c-ab37-53d5d1d11fc7", "row_index": 549, "timestamp": "2018-04-17T08:15:48Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 914, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "148014f00-566e-421c-ab37-53d5d1d11fc7", "eventTime": "2018-04-17T08:15:48Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3b306c66-7a89-4d59-9316-aec9be40d1c1", "record_id": "flaws_cloudtrail:0000550:3b306c66-7a89-4d59-9316-aec9be40d1c1", "row_index": 550, "timestamp": "2018-04-17T08:15:48Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1376, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3b306c66-7a89-4d59-9316-aec9be40d1c1", "eventTime": "2018-04-17T08:15:48Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ef6f0d3", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5c52c1a3-a8bd-43b1-affb-adc6d46f27c4", "record_id": "flaws_cloudtrail:0000551:5c52c1a3-a8bd-43b1-affb-adc6d46f27c4", "row_index": 551, "timestamp": "2018-04-17T08:15:49Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1382, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5c52c1a3-a8bd-43b1-affb-adc6d46f27c4", "eventTime": "2018-04-17T08:15:49Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ca57294", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "de9bcbd6-437c-4d77-8352-c00c38971de8", "record_id": "flaws_cloudtrail:0000552:de9bcbd6-437c-4d77-8352-c00c38971de8", "row_index": 552, "timestamp": "2018-04-17T08:15:50Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1937, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "de9bcbd6-437c-4d77-8352-c00c38971de8", "eventTime": "2018-04-17T08:15:50Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: iC1n-D40-O1m5c80ztYsFLKexz3NkaCIi4PjegFFji51_85GxPSnhximH_FRGCMwyxxgD3uVGAwzc6HQITb2DTozx4WfhxR1a1xYDc0p_WCKnCpbnNcxMQHxC8Es2sCtAG2FgiF8E895TgXZD4Q3RHQtPDly6bQwm_z-n0BILn3VHzpNyEh223iaGZlHI9jKKy0BjtY8T1ms6UuI4hNQ-8rGYj69fO1pAt_9iphseGjMMc-qaataJRGqTZn1TpMf7z7_gwdrOSWhDWZXRcv99npxnLjuCkRIN7-n0eLx9Fz0KtXICW4TZtHCBOxFsUJT-kQnT3ieGseHlRQsc8hvKDsIeeaiXXasz23lqRXemKQGwShZFrfkz-qlxX19SX0n1GI7QIsUstwdSMGoJ_5vm9t43nbYWyeSN1eF7AExoTNSUjr6VHUTxcNJTP3-ZzB5Mv-PGwfcOCOjyIcyE56zy_0V0BADc18FCtPi7nMS_7Utot6wDl1Sh3Jt34mBQInuaF1hpyT80dSxmjYCcd5TTUi2IIx5oefiNj25Sc_7Mxnj3dGCZPIX4ODuRwZ-WA_KVJJywy4SsSNmDFou6JdiVgabkMe4epeDh4Ky9nO2Kmv-N_j7HRbdHpjg8qbsFo70Zn6HmP1SQPfZ_dmbMcesp8aOXYtImGZujgZ7lSfM", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ca57294", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "245009-5b4a-421d-91a8-f4906a15647f", "record_id": "flaws_cloudtrail:0000553:245009-5b4a-421d-91a8-f4906a15647f", "row_index": 553, "timestamp": "2018-04-17T08:15:50Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 908, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "245009-5b4a-421d-91a8-f4906a15647f", "eventTime": "2018-04-17T08:15:50Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a54a1599-6e4f-4c25-9f44-f2346ec834e3", "record_id": "flaws_cloudtrail:0000554:a54a1599-6e4f-4c25-9f44-f2346ec834e3", "row_index": 554, "timestamp": "2018-04-17T08:15:50Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1926, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a54a1599-6e4f-4c25-9f44-f2346ec834e3", "eventTime": "2018-04-17T08:15:50Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: uYOSlD4G-BzS2Z-VNMZamLnY_k-2_r6w33G5IczFY90e783XtGnvE6iWHsnyjitQpLHljwAWnbSvTPVtIHdPTZIJK9RJBfhU5fG-U-L9edi3EgkZUXzAOLig7ExG6HHOcIHHoMMYrPs75CMudprH87gR2Dhw_OwIuSc-m1OhpWEkGG5D5dtb2jCeA9GrB9EnwKybJxxrC5Cwzlyip5Ur5X0p-WJaKXUPEL8QeA-79i-fdYzns5f8HGAcqvgG7dUTQ0ps-oQw_rK3Jt1QhvJigBPN79n2z9PDSbCxN3XVZ5cZBTj7jB8GZLK8u12P0pWAXQTYtNvCe67c6xdxIZruBW_dSKLESSdtHyOeEFMhSZy1H-w7OGqfEiaEr5oykVB5bSISUToXW1-FjRvZZOCMbWnFR2f5-3tgr489JjahBr44xjHxQHSOtwgBrfDdDHoR1cHZRXrhNfAVE3smQVvXTniYHaYJZQmf7whlOmLWnrgwuSMSlK3XZXdBbnGDbc_ImExejjnkMvJ6up-gDbab2622UDMTz2x4BoEngwFLhtubWkYpRza8OMF65Hjwjwk0kaVX41QwSxH0VtsUQxN4LoVSc72sD2C1XSdePbBr7RebPolP-_uAmAMxagZMVoRux_Lr1NysIbtcAkZhp0fWhhutsUadXKLmHw", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ef6f0d3", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "493917a-96c0-4658-a70a-5045b4489e58", "record_id": "flaws_cloudtrail:0000555:493917a-96c0-4658-a70a-5045b4489e58", "row_index": 555, "timestamp": "2018-04-17T08:15:51Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 908, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "493917a-96c0-4658-a70a-5045b4489e58", "eventTime": "2018-04-17T08:15:51Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b277df06-599d-4daf-a212-0fb80e8383f7", "record_id": "flaws_cloudtrail:0000556:b277df06-599d-4daf-a212-0fb80e8383f7", "row_index": 556, "timestamp": "2018-04-17T08:15:52Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b277df06-599d-4daf-a212-0fb80e8383f7", "eventTime": "2018-04-17T08:15:52Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7a3060f2-6d4e-4263-8f89-c2c5235d8e7a", "record_id": "flaws_cloudtrail:0000557:7a3060f2-6d4e-4263-8f89-c2c5235d8e7a", "row_index": 557, "timestamp": "2018-04-17T08:15:52Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 914, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7a3060f2-6d4e-4263-8f89-c2c5235d8e7a", "eventTime": "2018-04-17T08:15:52Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3604de51-aba4-4775-abf9-afe98f881f96", "record_id": "flaws_cloudtrail:0000558:3604de51-aba4-4775-abf9-afe98f881f96", "row_index": 558, "timestamp": "2018-04-17T08:15:53Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3604de51-aba4-4775-abf9-afe98f881f96", "eventTime": "2018-04-17T08:15:53Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6e929f5d-7970-4bdc-8787-630b121008", "record_id": "flaws_cloudtrail:0000559:6e929f5d-7970-4bdc-8787-630b121008", "row_index": 559, "timestamp": "2018-04-17T08:15:54Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 806, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6e929f5d-7970-4bdc-8787-630b121008", "eventTime": "2018-04-17T08:15:54Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b0f6499b-2b6a-4b5e-a448-34f039389b8", "record_id": "flaws_cloudtrail:0000560:b0f6499b-2b6a-4b5e-a448-34f039389b8", "row_index": 560, "timestamp": "2018-04-17T08:15:54Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 805, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b0f6499b-2b6a-4b5e-a448-34f039389b8", "eventTime": "2018-04-17T08:15:54Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "99676a0-7891-4021-a27a-e4e1d5d4d478", "record_id": "flaws_cloudtrail:0000561:99676a0-7891-4021-a27a-e4e1d5d4d478", "row_index": 561, "timestamp": "2018-04-17T08:15:54Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 802, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "99676a0-7891-4021-a27a-e4e1d5d4d478", "eventTime": "2018-04-17T08:15:54Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b6e63a2d-bc1b-4c0a-b278-03f609548", "record_id": "flaws_cloudtrail:0000562:b6e63a2d-bc1b-4c0a-b278-03f609548", "row_index": 562, "timestamp": "2018-04-17T08:15:55Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1379, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b6e63a2d-bc1b-4c0a-b278-03f609548", "eventTime": "2018-04-17T08:15:55Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-546ae567", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "56f64fea-a30d-43df-b1e7-585a307f0870", "record_id": "flaws_cloudtrail:0000563:56f64fea-a30d-43df-b1e7-585a307f0870", "row_index": 563, "timestamp": "2018-04-17T08:15:56Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1381, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "56f64fea-a30d-43df-b1e7-585a307f0870", "eventTime": "2018-04-17T08:15:56Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-546ae567", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b7cd925e-b3e0-4f66-874d-aa68771d321e", "record_id": "flaws_cloudtrail:0000564:b7cd925e-b3e0-4f66-874d-aa68771d321e", "row_index": 564, "timestamp": "2018-04-17T08:15:56Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 805, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b7cd925e-b3e0-4f66-874d-aa68771d321e", "eventTime": "2018-04-17T08:15:56Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0abbc997-10be-47b2-913c-428eb476352f", "record_id": "flaws_cloudtrail:0000565:0abbc997-10be-47b2-913c-428eb476352f", "row_index": 565, "timestamp": "2018-04-17T08:15:56Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 806, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0abbc997-10be-47b2-913c-428eb476352f", "eventTime": "2018-04-17T08:15:56Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d5135ae3-8728-4e13-9201-4971de6bfcd4", "record_id": "flaws_cloudtrail:0000566:d5135ae3-8728-4e13-9201-4971de6bfcd4", "row_index": 566, "timestamp": "2018-04-17T08:15:56Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d5135ae3-8728-4e13-9201-4971de6bfcd4", "eventTime": "2018-04-17T08:15:56Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bbb7c8fe-40b9-4dfd-93c8-c92545d01295", "record_id": "flaws_cloudtrail:0000567:bbb7c8fe-40b9-4dfd-93c8-c92545d01295", "row_index": 567, "timestamp": "2018-04-17T08:15:56Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bbb7c8fe-40b9-4dfd-93c8-c92545d01295", "eventTime": "2018-04-17T08:15:56Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a5ed5c65-3056-4272-bc03-6df69449a", "record_id": "flaws_cloudtrail:0000568:a5ed5c65-3056-4272-bc03-6df69449a", "row_index": 568, "timestamp": "2018-04-17T08:15:56Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 800, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a5ed5c65-3056-4272-bc03-6df69449a", "eventTime": "2018-04-17T08:15:56Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7f8cbaa9-68e4-4ae4-8a52-541244fe1327f", "record_id": "flaws_cloudtrail:0000569:7f8cbaa9-68e4-4ae4-8a52-541244fe1327f", "row_index": 569, "timestamp": "2018-04-17T08:15:57Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1276, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7f8cbaa9-68e4-4ae4-8a52-541244fe1327f", "eventTime": "2018-04-17T08:15:57Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-546ae567", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d6ca713e-5c3e-4966-a0e3-036ec53b76ab", "record_id": "flaws_cloudtrail:0000570:d6ca713e-5c3e-4966-a0e3-036ec53b76ab", "row_index": 570, "timestamp": "2018-04-17T08:15:57Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d6ca713e-5c3e-4966-a0e3-036ec53b76ab", "eventTime": "2018-04-17T08:15:57Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "31ea0256-8650-4aaf-b4ed-090d2ff7e1dd", "record_id": "flaws_cloudtrail:0000571:31ea0256-8650-4aaf-b4ed-090d2ff7e1dd", "row_index": 571, "timestamp": "2018-04-17T08:15:58Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1936, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "31ea0256-8650-4aaf-b4ed-090d2ff7e1dd", "eventTime": "2018-04-17T08:15:58Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: Wta2_7up6B2sir6YgTqlkeOsjyZqzbelce4c8n0lL-mjqVgnyvkEb1o38GxUsXiNn9r_M9IXkg-pyn0rToaBymk8myQKlFNequlYVWvvXcPIjXTFmrmgys52sfFvvRCV7NaOK1yyrh1MgV26w8PptConbyyCwm4_FCRhaap_hbo5e6_98jwlH2mnm5UaQCPVlstJT6ZnUF4Qg-3SoAgXUjaaO8VlkUdGKI9beQ5GR39FKUoGwc4E6Vq-ToD-e_WvLRQLjCpr2Y-BteOVZxJjQCnUjoW6_jKQqN2Blo8_Bjm4hQ5N-fgR6vQBMB1o1S6KeAbxtd4emeLv8WNiV8d7jW18_Q5J126wA8cqoHR7lJTAhoVRJRLw9DuioU4CKQnXwIS_2BxRbLW1aaSaQEqttqNgStFoKHs8j6aBiexc2bEIqwlsqGJPul-F224M490P4c9qet14tI_QrpW2a8gA02YEmC9gjnNSa6o3XjSO8k797EnKUaYtT2FP-HVaxvTbscWwtchoe0YD_BUVqSUOgfGco-eOpbKrj-Gewmmyq1EkdgwZx_HMx7xE9u0zJml_YkLpwD3lKDVS-IqOwYqiSes_caGW6ErPxX9fFs0NXdnkJqxq3D0tTNPAD4Gmqlu2ID_S6vKkaIzWr1pwC0mcjkudPOpiHC-UqHFZJ7g", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-546ae567", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "854db4e2-6bec-4ce5-bb02-79bfdec5c234", "record_id": "flaws_cloudtrail:0000572:854db4e2-6bec-4ce5-bb02-79bfdec5c234", "row_index": 572, "timestamp": "2018-04-17T08:15:58Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "854db4e2-6bec-4ce5-bb02-79bfdec5c234", "eventTime": "2018-04-17T08:15:58Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a0a489b3-9ec8-4478-8bf5-240b81dc44e8", "record_id": "flaws_cloudtrail:0000573:a0a489b3-9ec8-4478-8bf5-240b81dc44e8", "row_index": 573, "timestamp": "2018-04-17T08:15:58Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a0a489b3-9ec8-4478-8bf5-240b81dc44e8", "eventTime": "2018-04-17T08:15:58Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5d48604-4d90-459c-8cb6-c9f38f1a90a3", "record_id": "flaws_cloudtrail:0000574:5d48604-4d90-459c-8cb6-c9f38f1a90a3", "row_index": 574, "timestamp": "2018-04-17T08:15:58Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1375, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5d48604-4d90-459c-8cb6-c9f38f1a90a3", "eventTime": "2018-04-17T08:15:58Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-009dc204", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8019f3af-bdda-43b6-88a6-a064561ada484", "record_id": "flaws_cloudtrail:0000575:8019f3af-bdda-43b6-88a6-a064561ada484", "row_index": 575, "timestamp": "2018-04-17T08:15:59Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8019f3af-bdda-43b6-88a6-a064561ada484", "eventTime": "2018-04-17T08:15:59Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c390e2ae-7a11-46db-a923-09212e7966", "record_id": "flaws_cloudtrail:0000576:c390e2ae-7a11-46db-a923-09212e7966", "row_index": 576, "timestamp": "2018-04-17T08:15:59Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1374, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c390e2ae-7a11-46db-a923-09212e7966", "eventTime": "2018-04-17T08:15:59Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-009dc204", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4d8963fb-3185-4013-bd08-44e01acfac58", "record_id": "flaws_cloudtrail:0000577:4d8963fb-3185-4013-bd08-44e01acfac58", "row_index": 577, "timestamp": "2018-04-17T08:16:00Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1382, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4d8963fb-3185-4013-bd08-44e01acfac58", "eventTime": "2018-04-17T08:16:00Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-02d34bac", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "460beb2d-031f-4b1e-9318-13c46dbf68d4", "record_id": "flaws_cloudtrail:0000578:460beb2d-031f-4b1e-9318-13c46dbf68d4", "row_index": 578, "timestamp": "2018-04-17T08:16:00Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 806, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "460beb2d-031f-4b1e-9318-13c46dbf68d4", "eventTime": "2018-04-17T08:16:00Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9ff121b6-b386-42d0-9b63-67037cbc6e73", "record_id": "flaws_cloudtrail:0000579:9ff121b6-b386-42d0-9b63-67037cbc6e73", "row_index": 579, "timestamp": "2018-04-17T08:16:00Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1377, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9ff121b6-b386-42d0-9b63-67037cbc6e73", "eventTime": "2018-04-17T08:16:00Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-009dc204", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "636104bb9-109e-4a18-bed4-2a00b53401", "record_id": "flaws_cloudtrail:0000580:636104bb9-109e-4a18-bed4-2a00b53401", "row_index": 580, "timestamp": "2018-04-17T08:16:01Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1378, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "636104bb9-109e-4a18-bed4-2a00b53401", "eventTime": "2018-04-17T08:16:01Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-02d34bac", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "706186e2-9b6a-4aaa-8903-55e5e1a320f0", "record_id": "flaws_cloudtrail:0000581:706186e2-9b6a-4aaa-8903-55e5e1a320f0", "row_index": 581, "timestamp": "2018-04-17T08:16:01Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1926, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "706186e2-9b6a-4aaa-8903-55e5e1a320f0", "eventTime": "2018-04-17T08:16:01Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: Ny67BhdQ6P5rJ6C4WKgJGHR1Xgyv5hUE4zrPuh_sR9Wok80WPhHggg_j8gzcykfVSlLIUWH7h5O5cYdjUOx4EbMcl_GpGETTmWp6xXILM3oEEHkzmfdmwMmprmPXB0brMlEXluBI8Wg5QMyHf5lbhTmllWyswJ1_wdybum_R65Re29nHB2hipBfo8rUOEy2EyHvDaGvUn3z1n83Nf9PbKhgkBMLqPiudiQ1ifZCvONlZGrT-Ep1-rr9fVgjyRt8Pves81tQRy8gqygyRqG1uI72icJhZw1Z7UT663jI0LF3SpdQfFC-Mta-dA1mZvtopv8knN0mLvW0uFGXXXVQINwP1Yj_GAnw_EDrlSsyfZQ1NQ3hM0XqKoBZa1nPcdAuhozYRrkf1XWbt5LGh4KjBHrN_mxahXzAH21oEEvOyolajRC-XROz2KvZBD1hIhaF8Hpldm_sd8hSJHCA4SrxYCM_7t1Xn2pxwflli4eNpx75Lb_UVFPYGJoV2gO7vfvGBEiMx3UeSpL4cvxMbfjKrVnR1GCIA2Cu3pKLCL_VkVAgAdjPgOntqWKapVcHC8vfd4p-6K5mOp_smjE2er5acUWZvLjQtcM3bQ3oGxPQvwTgfQRRGUWc9HM_76WNSOndrbyIBRKpIior6WLVo9xChqKjf4CIz7czvzg", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-009dc204", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5d8c5c3c-78d3-455f-ad36-6ffab8b182ef", "record_id": "flaws_cloudtrail:0000582:5d8c5c3c-78d3-455f-ad36-6ffab8b182ef", "row_index": 582, "timestamp": "2018-04-17T08:16:02Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1383, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5d8c5c3c-78d3-455f-ad36-6ffab8b182ef", "eventTime": "2018-04-17T08:16:02Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-02d34bac", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "31f94d54-15a4-4fd0-9e0b-4304470b362d", "record_id": "flaws_cloudtrail:0000583:31f94d54-15a4-4fd0-9e0b-4304470b362d", "row_index": 583, "timestamp": "2018-04-17T08:16:03Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1379, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "31f94d54-15a4-4fd0-9e0b-4304470b362d", "eventTime": "2018-04-17T08:16:03Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-bbcb674a", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c8e31a38-0969-4bb2-ba17-e49fd425d5d3", "record_id": "flaws_cloudtrail:0000584:c8e31a38-0969-4bb2-ba17-e49fd425d5d3", "row_index": 584, "timestamp": "2018-04-17T08:16:03Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c8e31a38-0969-4bb2-ba17-e49fd425d5d3", "eventTime": "2018-04-17T08:16:03Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d936e40a-30f3-4528-bf3c-6deda8e993af", "record_id": "flaws_cloudtrail:0000585:d936e40a-30f3-4528-bf3c-6deda8e993af", "row_index": 585, "timestamp": "2018-04-17T08:16:03Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d936e40a-30f3-4528-bf3c-6deda8e993af", "eventTime": "2018-04-17T08:16:03Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f844671f-2e2d-4c89-8940-d72372c8", "record_id": "flaws_cloudtrail:0000586:f844671f-2e2d-4c89-8940-d72372c8", "row_index": 586, "timestamp": "2018-04-17T08:16:03Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 797, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f844671f-2e2d-4c89-8940-d72372c8", "eventTime": "2018-04-17T08:16:03Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d0b23816-b515-4d4b-aa96-47c2876a283d", "record_id": "flaws_cloudtrail:0000587:d0b23816-b515-4d4b-aa96-47c2876a283d", "row_index": 587, "timestamp": "2018-04-17T08:16:05Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1936, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d0b23816-b515-4d4b-aa96-47c2876a283d", "eventTime": "2018-04-17T08:16:05Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: FYRQish5IblIdCgiYhWFJRGQBEbbGTRQJSLjZtKfQUkEb6jAXd-IyV5Jof9yd2qpTCUyrzqD07_FyAG_kRga1BXVbJL_-4fRsDoLFO1wYGkrV-vYQoZNiChjb-2zl2mN_3wp77yjMixt9_Sied4U82YgQaR6lhl0V8SGzZqCWXJL5ezXxhxfe-KsZZiaW1KsJFZbRkC18XZwXQ8DmTKfwi7XwiMZcM1ewkSMFV62diiwEXtlqSwvM-KEGp0qhRFcrnw2wSs4CKVduTNCwxlwhGkIxOGxlQ5G2XJuKObhVMLhbHKLq3naD0KLWgXn1ysMCUtLqLPH0763zqvTeukbsKV7XBUtChoMHSr_mrYxUnnOiroKBq9X2uFnJpCKaFpdrwWgJppmq-eHsa4S_d3W2meSHRB6r2cWGeDVQfJIUQiANHevl46PGMUdzqUNDKeXN38f8bddlSokNl5so0yIcxk3bF-4sF6Mz-xo7tP_qH9rRMvlu4DDj9DvEPC8vEL3gfYofWu1tty-_iPCA9kq2JFjJekTeVy4tjH22M-g6O_zqzqQ9P7tnqZvky1RiGRU_Fpx5ZJF4ErtzGlwhLRSRFU2sNFpM_WsxhXKqUEIMLMm3RGSYvuhAR9KyoKbfMfkyQ59GbJgtd2x2wPkYJ4AjopmMTF-UMxWbzlTbUE", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-02d34bac", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "704f8d8b-fd10-448f-b929-f44fdb2aff8b", "record_id": "flaws_cloudtrail:0000588:704f8d8b-fd10-448f-b929-f44fdb2aff8b", "row_index": 588, "timestamp": "2018-04-17T08:16:05Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "704f8d8b-fd10-448f-b929-f44fdb2aff8b", "eventTime": "2018-04-17T08:16:05Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0b47924-9861-4035-8914-d7170a2339a8", "record_id": "flaws_cloudtrail:0000589:0b47924-9861-4035-8914-d7170a2339a8", "row_index": 589, "timestamp": "2018-04-17T08:16:06Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 910, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0b47924-9861-4035-8914-d7170a2339a8", "eventTime": "2018-04-17T08:16:06Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "29a1889b-36a5-4ec0-904f-2a79369c6a9a", "record_id": "flaws_cloudtrail:0000590:29a1889b-36a5-4ec0-904f-2a79369c6a9a", "row_index": 590, "timestamp": "2018-04-17T08:16:06Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1379, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "29a1889b-36a5-4ec0-904f-2a79369c6a9a", "eventTime": "2018-04-17T08:16:06Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-bbcb674a", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "67a34ee7-b2e3-498a-b2de-b504c02b9e3d", "record_id": "flaws_cloudtrail:0000591:67a34ee7-b2e3-498a-b2de-b504c02b9e3d", "row_index": 591, "timestamp": "2018-04-17T08:16:06Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 911, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "67a34ee7-b2e3-498a-b2de-b504c02b9e3d", "eventTime": "2018-04-17T08:16:06Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4284a74c-9d5b-4ab9-827f-b4e50027c621", "record_id": "flaws_cloudtrail:0000592:4284a74c-9d5b-4ab9-827f-b4e50027c621", "row_index": 592, "timestamp": "2018-04-17T08:16:06Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1376, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4284a74c-9d5b-4ab9-827f-b4e50027c621", "eventTime": "2018-04-17T08:16:06Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-71cdc376", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "14554cca-763c-4bfd-b97a-0928e02616a6", "record_id": "flaws_cloudtrail:0000593:14554cca-763c-4bfd-b97a-0928e02616a6", "row_index": 593, "timestamp": "2018-04-17T08:16:07Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1376, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "14554cca-763c-4bfd-b97a-0928e02616a6", "eventTime": "2018-04-17T08:16:07Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-71cdc376", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "72ee7569-b1be-4a70-b4b1-f45fca48b932", "record_id": "flaws_cloudtrail:0000594:72ee7569-b1be-4a70-b4b1-f45fca48b932", "row_index": 594, "timestamp": "2018-04-17T08:16:08Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1270, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "72ee7569-b1be-4a70-b4b1-f45fca48b932", "eventTime": "2018-04-17T08:16:08Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-71cdc376", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9ec4d94c-40ef-4384-b8cc-d3b826fcc942", "record_id": "flaws_cloudtrail:0000595:9ec4d94c-40ef-4384-b8cc-d3b826fcc942", "row_index": 595, "timestamp": "2018-04-17T08:16:09Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1273, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9ec4d94c-40ef-4384-b8cc-d3b826fcc942", "eventTime": "2018-04-17T08:16:09Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-bbcb674a", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8f6a2a53-4035-408e-ba4c-616155f06513", "record_id": "flaws_cloudtrail:0000596:8f6a2a53-4035-408e-ba4c-616155f06513", "row_index": 596, "timestamp": "2018-04-17T08:16:09Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1926, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8f6a2a53-4035-408e-ba4c-616155f06513", "eventTime": "2018-04-17T08:16:09Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: JDCgibtgSWs5cwewhI8CQgNkNVLmXAr8sbP1V90Xe3ytFdD5kWYsawX7aaXPdTcvZFgAKjmYDYDsDAbdL7ugCVu71_7qqA1Ebe3UU84CRscDFNZ6MKU8f_ZRPXF_bXznbMnjG7b2pdIzwNmhtwlaxlBBXBLjYAR3H1k6uy3rbNO0kQdRUS11XIlWiJaOATAjXLMycXhjkadJZhitFvwEvl9rQ8nGDoQ1sUOCgSUK5f3DXb-dcfsR5UBzYummbwEXyq2rg3XqswNlToLHQIqBU4cKdi6nks4Wl7LEkCHRGxqsZ1G22wx6fIRNG5eE19Yg8mU-QbCHLLanbICPR-BIUtX9OxA7quOKB9W67jl7V4JcCusvdreTbltIHO9lcmpm2eLHL0ptoz5QzxKBaBII3qyTumdwlb1LSOD21ZhJ6ENrEkaGXXNE9ATKiMVVzrpHMqWJO18JQ4C9Vub1z0DZU27V751TlopbkJB1FSLJbtSr55JebUUT0nVxJQuROhcaez7xRPoC2bn7CCplVohOhTQ2VRibyh3iN2CMOwo_QaefQ6kk3V536GxRV7pnQ-qh95YTpcdJzy8vR56qnDrwn_33Ip-nkBsAykR4zV1pQFXmbDg4BjZZpFPCMR8YdJu9Qtgy4D43ipLhZEhSWFwu2OjqQDHJhtcMQA", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-71cdc376", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5b5e5294-2288-4505-b88b-a69f2d25ec3a", "record_id": "flaws_cloudtrail:0000597:5b5e5294-2288-4505-b88b-a69f2d25ec3a", "row_index": 597, "timestamp": "2018-04-17T08:16:10Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 804, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5b5e5294-2288-4505-b88b-a69f2d25ec3a", "eventTime": "2018-04-17T08:16:10Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "657e50d2-5ff9-47ce-b63c-5ce4d72f0b32", "record_id": "flaws_cloudtrail:0000598:657e50d2-5ff9-47ce-b63c-5ce4d72f0b32", "row_index": 598, "timestamp": "2018-04-17T08:16:12Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 806, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "657e50d2-5ff9-47ce-b63c-5ce4d72f0b32", "eventTime": "2018-04-17T08:16:12Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9bf10300-cf31-40ae-ae06-6d1737c464cd", "record_id": "flaws_cloudtrail:0000599:9bf10300-cf31-40ae-ae06-6d1737c464cd", "row_index": 599, "timestamp": "2018-04-17T08:16:13Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1931, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9bf10300-cf31-40ae-ae06-6d1737c464cd", "eventTime": "2018-04-17T08:16:13Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: hx8iSULTQO--I3JOuoUP-pKcLC_h6n2rZgF4fHyRwLoYV6f7SyeNV4drm9yU8N4z3GAoUpVfh_WMmbBsnBQTkIVeuXB6PUlrd1EiD7byjqI6TfrF2Ws4wcIRQxSU466FUi0b94gwo-3i7-q4ZzRpa8C7SUV6CnfyMi8FbUOMrSvF7bapVqy6c9dwvXzfLjwYkpmgP8YGh9kDp1guog3DgnTjr4ntse_Djr8lkNWTRrTvBOf6PTMjSl0Q3O0-ocibb3UJT0OH9j-iDDm98-MmM_2L9yWMqAIlvjNqtwILZj9_LulOYyQREngRuvKHyzb_S5AQOZ2Ob02dQfCBkeVDpD48HGhoE0X9xuRQ3RvrOzneVhiqVi2eTrfQexHf4dcKroCvH-6_v1qMi9E0AJyWWHKJoPu1zKR5MKUo4LvSqRaVCoedzBUPIZUedKeOmRlZQsWuL488PcDEC3KGITxePONeqWK_yY7T45nJMKt5i_4eJQ7X7jVPnUUDCdsvp3dhrzaomB71rNlLXalwAT81ljgeCNBPK-ghiK87bDiz8FChGCvB1srRXFpf-XaZXdRt3AEJMBFdzXAgLmRgTuU1A1ZF6yqWmeF0veXaoSQUZZ6LaBpKG4b4VWiwp8kjvYBQVu_ZBul2NPwMnhuT8apEsUo6koDKA2oafHJN", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-bbcb674a", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "624b67e5-16cd-4bec-b4d1-a130bf36e0eb", "record_id": "flaws_cloudtrail:0000600:624b67e5-16cd-4bec-b4d1-a130bf36e0eb", "row_index": 600, "timestamp": "2018-04-17T08:16:13Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 804, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "624b67e5-16cd-4bec-b4d1-a130bf36e0eb", "eventTime": "2018-04-17T08:16:13Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "844569-fec5-4492-9689-8ece7fbc8b91", "record_id": "flaws_cloudtrail:0000601:844569-fec5-4492-9689-8ece7fbc8b91", "row_index": 601, "timestamp": "2018-04-17T08:16:14Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1377, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "844569-fec5-4492-9689-8ece7fbc8b91", "eventTime": "2018-04-17T08:16:14Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-d10c94e9", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "624369-3740-43d9-8839-17eb656b8b7f", "record_id": "flaws_cloudtrail:0000602:624369-3740-43d9-8839-17eb656b8b7f", "row_index": 602, "timestamp": "2018-04-17T08:16:15Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 905, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "624369-3740-43d9-8839-17eb656b8b7f", "eventTime": "2018-04-17T08:16:15Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f920a7cf-f397-4c56-8c38-328b36c5fdd6", "record_id": "flaws_cloudtrail:0000603:f920a7cf-f397-4c56-8c38-328b36c5fdd6", "row_index": 603, "timestamp": "2018-04-17T08:16:16Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1379, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f920a7cf-f397-4c56-8c38-328b36c5fdd6", "eventTime": "2018-04-17T08:16:16Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-d10c94e9", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "29aa3d90-1d7b-4fdd-baf4-ab1e28ec0c6f", "record_id": "flaws_cloudtrail:0000604:29aa3d90-1d7b-4fdd-baf4-ab1e28ec0c6f", "row_index": 604, "timestamp": "2018-04-17T08:16:17Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1271, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "29aa3d90-1d7b-4fdd-baf4-ab1e28ec0c6f", "eventTime": "2018-04-17T08:16:17Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-d10c94e9", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d0b807ab-fab2-4f50-b83b-ae30c460a170", "record_id": "flaws_cloudtrail:0000605:d0b807ab-fab2-4f50-b83b-ae30c460a170", "row_index": 605, "timestamp": "2018-04-17T08:16:19Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAGD2JRX0V6RJGWR59", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1931, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d0b807ab-fab2-4f50-b83b-ae30c460a170", "eventTime": "2018-04-17T08:16:19Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: 1pZITMPaTz97sB03sE8gock8sHXuYVa0SzZqFcJz1XJbbVHwg9vSrVjOcTJ1oTyi4-7-clEHM2jWWSBDRDYYq1fm2anPlN5HCJZ3tYBMTHb7yYGKh2m-i5xEanUaCK-VXQ00Yqxt8pPJRl9hg3j0RxYn_2t0V4oiN4kBcWuquQQmVuSRU922wwFqSn89a3XIJZtJEqEzyLmzusnKIMDi7qupmuKxRIhyMJ6OWYC0q34fpjycYR0THbxOmS5Kdx8uOwtgN_hqNNlAX95Nds3cwcUj6Rjkv1pF5B0lI8m90MFq4kGpDc2oVVzHjjZC1lrl4bR8Ahi1Zqpq4PCToZbKmB913qn4-yBAuU6Nu4-HO6dlI6JweJrvCXvY6d9l1Kyed4uPk_a0VR4mBeqa-GiEK-oxetOgaKBo7msvdIAcGCTLvd3tmI6klgRQhIrLxp34zPmOLivuNQE_1Bz9RE0XCWhab1Y87nz9oU9B3ebFwyUBLgCcJUMzW0j_UEhKDbTLGSX0tvmg_OLehk_RC75-z6eiualCbr249jTiUbH6lDX_JR7OktUXprG5GzrSjH6oEB3Q-9fO9JW43AOoXIpYyBJBiz0cJ-4RSV8mIeebG1Xe86gXtRO3cxUf4GtksY0azWiCDVgyuI65GiVmSXjVA5YIsKxqaHPbJHuW", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAGD2JRX0V6RJGWR59", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-04-16T06:59:20Z"}}}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-d10c94e9", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}