Task: attack_reconstruction (flaws_cloudtrail)
Prompt: An IAM principal appears to confirm who they are, survey the account’s audit-trail configuration, and then take action to reduce CloudTrail visibility. Identify the responsible principal, the applicable MITRE ATT&CK technique, the supporting CloudTrail record_ids for each phase of the chain, and the impacted AWS assets. Return a JSON object matching the AttackReconstructionAnswer schema. Use principal.arn for primary_actor, the MITRE ATT&CK ID (e.g. T1530) for technique, and group the supporting CloudTrail record_ids by attack phase. List the AWS asset identifiers (bucket names, role/user names, trail names, ARNs) the attack acted on as impacted_assets.
Answer schema: attack_reconstruction_answer

CloudTrail records:
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "58c10ef9-26cb-421f-8bd8-6a4e92c0356f", "record_id": "flaws_cloudtrail:0000000:58c10ef9-26cb-421f-8bd8-6a4e92c0356f", "row_index": 0, "timestamp": "2017-05-26T22:13:02Z", "event_type": "DescribeCacheClusters", "event_source": "elasticache.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 735, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "58c10ef9-26cb-421f-8bd8-6a4e92c0356f", "eventTime": "2017-05-26T22:13:02Z", "eventName": "DescribeCacheClusters", "eventSource": "elasticache.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"maxRecords": 100}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1e699a59-f344-447e-90a1-d5d909aecfa3", "record_id": "flaws_cloudtrail:0000001:1e699a59-f344-447e-90a1-d5d909aecfa3", "row_index": 1, "timestamp": "2017-05-26T22:13:02Z", "event_type": "DescribeReservedInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 755, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1e699a59-f344-447e-90a1-d5d909aecfa3", "eventTime": "2017-05-26T22:13:02Z", "eventName": "DescribeReservedInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"reservedInstancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "01f6039b-40a7-49e7-8a0d-cdf2156fdaf7", "record_id": "flaws_cloudtrail:0000002:01f6039b-40a7-49e7-8a0d-cdf2156fdaf7", "row_index": 2, "timestamp": "2017-05-26T22:13:02Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 772, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "01f6039b-40a7-49e7-8a0d-cdf2156fdaf7", "eventTime": "2017-05-26T22:13:02Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bb1fec71-3b09-4f3d-ad36-9f8891e3c6a7", "record_id": "flaws_cloudtrail:0000003:bb1fec71-3b09-4f3d-ad36-9f8891e3c6a7", "row_index": 3, "timestamp": "2017-05-26T22:13:02Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "[aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 648, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bb1fec71-3b09-4f3d-ad36-9f8891e3c6a7", "eventTime": "2017-05-26T22:13:02Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "[aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1cab2e47-eff1-42cd-91f4-6ee7358dc949", "record_id": "flaws_cloudtrail:0000004:1cab2e47-eff1-42cd-91f4-6ee7358dc949", "row_index": 4, "timestamp": "2017-05-26T22:13:02Z", "event_type": "DescribePolicies", "event_source": "autoscaling.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 729, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1cab2e47-eff1-42cd-91f4-6ee7358dc949", "eventTime": "2017-05-26T22:13:02Z", "eventName": "DescribePolicies", "eventSource": "autoscaling.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"maxRecords": 50}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2f1a32ff-5f48-43f0-b4e6-2bf9e906a353", "record_id": "flaws_cloudtrail:0000005:2f1a32ff-5f48-43f0-b4e6-2bf9e906a353", "row_index": 5, "timestamp": "2017-05-26T22:13:02Z", "event_type": "DescribeScalingActivities", "event_source": "autoscaling.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 738, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2f1a32ff-5f48-43f0-b4e6-2bf9e906a353", "eventTime": "2017-05-26T22:13:02Z", "eventName": "DescribeScalingActivities", "eventSource": "autoscaling.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"maxRecords": 50}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "589270fb5-076e-4ff5-93f7-1607fba5e44a", "record_id": "flaws_cloudtrail:0000006:589270fb5-076e-4ff5-93f7-1607fba5e44a", "row_index": 6, "timestamp": "2017-05-26T22:13:02Z", "event_type": "DescribeAutoScalingGroups", "event_source": "autoscaling.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 739, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "589270fb5-076e-4ff5-93f7-1607fba5e44a", "eventTime": "2017-05-26T22:13:02Z", "eventName": "DescribeAutoScalingGroups", "eventSource": "autoscaling.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"maxRecords": 50}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ee3d11c6-2040-4ddc-b288-3c832061b80f6", "record_id": "flaws_cloudtrail:0000007:ee3d11c6-2040-4ddc-b288-3c832061b80f6", "row_index": 7, "timestamp": "2017-05-26T22:13:02Z", "event_type": "DescribeTags", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 717, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ee3d11c6-2040-4ddc-b288-3c832061b80f6", "eventTime": "2017-05-26T22:13:02Z", "eventName": "DescribeTags", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "59ec771d-cc4c-4f30-8ca1-d72244a71d13", "record_id": "flaws_cloudtrail:0000008:59ec771d-cc4c-4f30-8ca1-d72244a71d13", "row_index": 8, "timestamp": "2017-05-26T22:13:02Z", "event_type": "DescribeLoadBalancers", "event_source": "elasticloadbalancing.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 772, "raw_record_depth": 3, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "59ec771d-cc4c-4f30-8ca1-d72244a71d13", "eventTime": "2017-05-26T22:13:02Z", "eventName": "DescribeLoadBalancers", "eventSource": "elasticloadbalancing.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "responseElements": {"loadBalancers": []}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ccf8b2cd-1483-468d-bfb4-92cd61c0e185", "record_id": "flaws_cloudtrail:0000009:ccf8b2cd-1483-468d-bfb4-92cd61c0e185", "row_index": 9, "timestamp": "2017-05-26T22:13:02Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 739, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ccf8b2cd-1483-468d-bfb4-92cd61c0e185", "eventTime": "2017-05-26T22:13:02Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cd4c8c4a-9350-4410-9e20-16f020327e98", "record_id": "flaws_cloudtrail:0000010:cd4c8c4a-9350-4410-9e20-16f020327e98", "row_index": 10, "timestamp": "2017-05-26T22:13:02Z", "event_type": "DescribeAlarms", "event_source": "monitoring.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 727, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cd4c8c4a-9350-4410-9e20-16f020327e98", "eventTime": "2017-05-26T22:13:02Z", "eventName": "DescribeAlarms", "eventSource": "monitoring.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"maxRecords": 100}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "58916a6f-1be7-4d50-9af4-004914b35ad", "record_id": "flaws_cloudtrail:0000011:58916a6f-1be7-4d50-9af4-004914b35ad", "row_index": 11, "timestamp": "2017-05-26T22:13:02Z", "event_type": "DescribeDBSubnetGroups", "event_source": "rds.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 713, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "58916a6f-1be7-4d50-9af4-004914b35ad", "eventTime": "2017-05-26T22:13:02Z", "eventName": "DescribeDBSubnetGroups", "eventSource": "rds.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "93b6d179-a96e-4f2e-94bb-a7df59f9e3b2", "record_id": "flaws_cloudtrail:0000012:93b6d179-a96e-4f2e-94bb-a7df59f9e3b2", "row_index": 12, "timestamp": "2017-05-26T22:13:02Z", "event_type": "DescribeSubnets", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 732, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "93b6d179-a96e-4f2e-94bb-a7df59f9e3b2", "eventTime": "2017-05-26T22:13:02Z", "eventName": "DescribeSubnets", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"subnetSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "37d7e68c-2587-4bd2-86f5-6977ebd90bfc", "record_id": "flaws_cloudtrail:0000013:37d7e68c-2587-4bd2-86f5-6977ebd90bfc", "row_index": 13, "timestamp": "2017-05-26T22:13:02Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 734, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "37d7e68c-2587-4bd2-86f5-6977ebd90bfc", "eventTime": "2017-05-26T22:13:02Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "768e3774-ac39-4c74-92d7-bdcee0dc51b1", "record_id": "flaws_cloudtrail:0000014:768e3774-ac39-4c74-92d7-bdcee0dc51b1", "row_index": 14, "timestamp": "2017-05-26T22:13:02Z", "event_type": "DescribeAddresses", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 761, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "768e3774-ac39-4c74-92d7-bdcee0dc51b1", "eventTime": "2017-05-26T22:13:02Z", "eventName": "DescribeAddresses", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"publicIpsSet": {}, "filterSet": {}, "allocationIdsSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8fdfc1a3-21e5-47c1-8b54-3b12926e", "record_id": "flaws_cloudtrail:0000015:8fdfc1a3-21e5-47c1-8b54-3b12926e", "row_index": 15, "timestamp": "2017-05-26T22:13:02Z", "event_type": "DescribeVpcs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 724, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8fdfc1a3-21e5-47c1-8b54-3b12926e", "eventTime": "2017-05-26T22:13:02Z", "eventName": "DescribeVpcs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"vpcSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a9f21472-13dd-4535-bae7-6fe305b9f7f1", "record_id": "flaws_cloudtrail:0000016:a9f21472-13dd-4535-bae7-6fe305b9f7f1", "row_index": 16, "timestamp": "2017-05-26T22:13:02Z", "event_type": "DescribeScheduledActions", "event_source": "autoscaling.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 734, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a9f21472-13dd-4535-bae7-6fe305b9f7f1", "eventTime": "2017-05-26T22:13:02Z", "eventName": "DescribeScheduledActions", "eventSource": "autoscaling.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"maxRecords": 50}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "332416d-d5cc-4f84-8de8-3e96f318029", "record_id": "flaws_cloudtrail:0000017:332416d-d5cc-4f84-8de8-3e96f318029", "row_index": 17, "timestamp": "2017-05-26T22:13:02Z", "event_type": "DescribeLaunchConfigurations", "event_source": "autoscaling.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 739, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "332416d-d5cc-4f84-8de8-3e96f318029", "eventTime": "2017-05-26T22:13:02Z", "eventName": "DescribeLaunchConfigurations", "eventSource": "autoscaling.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"maxRecords": 50}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9653f54f-84f7-4057-9c71-0c8878bf813b", "record_id": "flaws_cloudtrail:0000018:9653f54f-84f7-4057-9c71-0c8878bf813b", "row_index": 18, "timestamp": "2017-05-26T22:13:02Z", "event_type": "DescribeLoadBalancers", "event_source": "elasticloadbalancing.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 768, "raw_record_depth": 2, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9653f54f-84f7-4057-9c71-0c8878bf813b", "eventTime": "2017-05-26T22:13:02Z", "eventName": "DescribeLoadBalancers", "eventSource": "elasticloadbalancing.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"pageSize": 400}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "613d7c5f-754b-44dc-95f6-a807d2d61e72", "record_id": "flaws_cloudtrail:0000019:613d7c5f-754b-44dc-95f6-a807d2d61e72", "row_index": 19, "timestamp": "2017-05-26T22:13:02Z", "event_type": "DescribeStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 714, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "613d7c5f-754b-44dc-95f6-a807d2d61e72", "eventTime": "2017-05-26T22:13:02Z", "eventName": "DescribeStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "645a5ac8-4df8-4eef-9912-5a1f4dd21a10", "record_id": "flaws_cloudtrail:0000020:645a5ac8-4df8-4eef-9912-5a1f4dd21a10", "row_index": 20, "timestamp": "2017-05-26T22:13:02Z", "event_type": "DescribeTargetGroups", "event_source": "elasticloadbalancing.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 770, "raw_record_depth": 3, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "645a5ac8-4df8-4eef-9912-5a1f4dd21a10", "eventTime": "2017-05-26T22:13:02Z", "eventName": "DescribeTargetGroups", "eventSource": "elasticloadbalancing.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "responseElements": {"targetGroups": []}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2c390c15-8294-4c4a-bd89-581882f91d9d5", "record_id": "flaws_cloudtrail:0000021:2c390c15-8294-4c4a-bd89-581882f91d9d5", "row_index": 21, "timestamp": "2017-05-26T22:13:03Z", "event_type": "ListGroupsForUser", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 726, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2c390c15-8294-4c4a-bd89-581882f91d9d5", "eventTime": "2017-05-26T22:13:03Z", "eventName": "ListGroupsForUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "piper"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "acb2200c-269c-47ef-ad02-40568c8815", "record_id": "flaws_cloudtrail:0000022:acb2200c-269c-47ef-ad02-40568c8815", "row_index": 22, "timestamp": "2017-05-26T22:13:03Z", "event_type": "ListGroupsForUser", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 724, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "acb2200c-269c-47ef-ad02-40568c8815", "eventTime": "2017-05-26T22:13:03Z", "eventName": "ListGroupsForUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a384e996-13b5-429e-8cf7-7f6a6edba43b", "record_id": "flaws_cloudtrail:0000023:a384e996-13b5-429e-8cf7-7f6a6edba43b", "row_index": 23, "timestamp": "2017-05-26T22:13:03Z", "event_type": "DescribeDBInstances", "event_source": "rds.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 724, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a384e996-13b5-429e-8cf7-7f6a6edba43b", "eventTime": "2017-05-26T22:13:03Z", "eventName": "DescribeDBInstances", "eventSource": "rds.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"maxRecords": 50}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "acf126ce-cdad-4e2e-9ffa-dd91ef004d76", "record_id": "flaws_cloudtrail:0000024:acf126ce-cdad-4e2e-9ffa-dd91ef004d76", "row_index": 24, "timestamp": "2017-05-26T22:13:03Z", "event_type": "DescribeReservedInstancesOfferings", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 756, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "acf126ce-cdad-4e2e-9ffa-dd91ef004d76", "eventTime": "2017-05-26T22:13:03Z", "eventName": "DescribeReservedInstancesOfferings", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"reservedInstancesOfferingsSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "47d3f5a6-fed4-4caa-a386-6de4fd3734b1", "record_id": "flaws_cloudtrail:0000025:47d3f5a6-fed4-4caa-a386-6de4fd3734b1", "row_index": 25, "timestamp": "2017-05-26T22:13:04Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 773, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "47d3f5a6-fed4-4caa-a386-6de4fd3734b1", "eventTime": "2017-05-26T22:13:04Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "351539-9893-4a16-8115-b9007b2fcbf4", "record_id": "flaws_cloudtrail:0000026:351539-9893-4a16-8115-b9007b2fcbf4", "row_index": 26, "timestamp": "2017-05-26T22:13:05Z", "event_type": "ListGroupsForUser", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 724, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "351539-9893-4a16-8115-b9007b2fcbf4", "eventTime": "2017-05-26T22:13:05Z", "eventName": "ListGroupsForUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f23138-c30a-40c9-8ca4-59767a53d49", "record_id": "flaws_cloudtrail:0000027:f23138-c30a-40c9-8ca4-59767a53d49", "row_index": 27, "timestamp": "2017-05-26T22:13:06Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 844, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f23138-c30a-40c9-8ca4-59767a53d49", "eventTime": "2017-05-26T22:13:06Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/service-role/AWSLambdaBasicExecutionRole-b6ab3a24-1aa4-4855-94d4-40cdef59ec5b", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1416bb12-a2dd-42b0-b7ff-c22be3de05b9", "record_id": "flaws_cloudtrail:0000028:1416bb12-a2dd-42b0-b7ff-c22be3de05b9", "row_index": 28, "timestamp": "2017-05-26T22:13:07Z", "event_type": "ListAccessKeys", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 723, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1416bb12-a2dd-42b0-b7ff-c22be3de05b9", "eventTime": "2017-05-26T22:13:07Z", "eventName": "ListAccessKeys", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "577520e-be0c-499d-a777-e81d064199", "record_id": "flaws_cloudtrail:0000029:577520e-be0c-499d-a777-e81d064199", "row_index": 29, "timestamp": "2017-05-26T22:13:07Z", "event_type": "ListAccessKeys", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 719, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "577520e-be0c-499d-a777-e81d064199", "eventTime": "2017-05-26T22:13:07Z", "eventName": "ListAccessKeys", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "piper"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f1bc1d4d-e6ab-4c99-961d-48defb63ad82", "record_id": "flaws_cloudtrail:0000030:f1bc1d4d-e6ab-4c99-961d-48defb63ad82", "row_index": 30, "timestamp": "2017-05-26T22:13:09Z", "event_type": "ListAccessKeys", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 723, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f1bc1d4d-e6ab-4c99-961d-48defb63ad82", "eventTime": "2017-05-26T22:13:09Z", "eventName": "ListAccessKeys", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1afbc98a-660b-4518-98d2-db3d551ca6f4", "record_id": "flaws_cloudtrail:0000031:1afbc98a-660b-4518-98d2-db3d551ca6f4", "row_index": 31, "timestamp": "2017-05-26T22:13:10Z", "event_type": "ListUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 726, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1afbc98a-660b-4518-98d2-db3d551ca6f4", "eventTime": "2017-05-26T22:13:10Z", "eventName": "ListUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3ce7af4d-7a6a-4361-9986-2ac30c952705", "record_id": "flaws_cloudtrail:0000032:3ce7af4d-7a6a-4361-9986-2ac30c952705", "row_index": 32, "timestamp": "2017-05-26T22:13:10Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 847, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3ce7af4d-7a6a-4361-9986-2ac30c952705", "eventTime": "2017-05-26T22:13:10Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/service-role/AWSLambdaBasicExecutionRole-d306bccd-4ecb-4557-a96f-9dbc7460dddc", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9e5c43f3-461d-41da-83c8-2ca6290bc97e", "record_id": "flaws_cloudtrail:0000033:9e5c43f3-461d-41da-83c8-2ca6290bc97e", "row_index": 33, "timestamp": "2017-05-26T22:13:12Z", "event_type": "ListUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 723, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9e5c43f3-461d-41da-83c8-2ca6290bc97e", "eventTime": "2017-05-26T22:13:12Z", "eventName": "ListUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "piper"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0bf0f617-ab6f-4fc3-984a-0892fa7f8009", "record_id": "flaws_cloudtrail:0000034:0bf0f617-ab6f-4fc3-984a-0892fa7f8009", "row_index": 34, "timestamp": "2017-05-26T22:13:13Z", "event_type": "ListUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 725, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0bf0f617-ab6f-4fc3-984a-0892fa7f8009", "eventTime": "2017-05-26T22:13:13Z", "eventName": "ListUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "703b4c97-9820-4c0f-a5da-da6023c4a2e9", "record_id": "flaws_cloudtrail:0000035:703b4c97-9820-4c0f-a5da-da6023c4a2e9", "row_index": 35, "timestamp": "2017-05-26T22:13:15Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 847, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "703b4c97-9820-4c0f-a5da-da6023c4a2e9", "eventTime": "2017-05-26T22:13:15Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/service-role/AWSLambdaBasicExecutionRole-4e23caa8-1f82-45b5-9068-3200fb1a0c7a", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a416047-7413-4fcf-8718-4781a3e4c526", "record_id": "flaws_cloudtrail:0000036:a416047-7413-4fcf-8718-4781a3e4c526", "row_index": 36, "timestamp": "2017-05-26T22:13:20Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 776, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a416047-7413-4fcf-8718-4781a3e4c526", "eventTime": "2017-05-26T22:13:20Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/Level3", "versionId": "v10"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "99e5a696-f111-4e29-8cb0-a598a44c663d", "record_id": "flaws_cloudtrail:0000037:99e5a696-f111-4e29-8cb0-a598a44c663d", "row_index": 37, "timestamp": "2017-05-26T22:13:25Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 787, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "99e5a696-f111-4e29-8cb0-a598a44c663d", "eventTime": "2017-05-26T22:13:25Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways", "versionId": "v4"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "31c3060a-61e7-4b25-bb22-4193d1e8f5ac", "record_id": "flaws_cloudtrail:0000038:31c3060a-61e7-4b25-bb22-4193d1e8f5ac", "row_index": 38, "timestamp": "2017-05-26T22:13:30Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 792, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "31c3060a-61e7-4b25-bb22-4193d1e8f5ac", "eventTime": "2017-05-26T22:13:30Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/AWSDirectConnectReadOnlyAccess", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "20e0bb1f-0f8e-4c57-a58d-33a13dcdb0b7", "record_id": "flaws_cloudtrail:0000039:20e0bb1f-0f8e-4c57-a58d-33a13dcdb0b7", "row_index": 39, "timestamp": "2017-05-26T22:13:35Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 786, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "20e0bb1f-0f8e-4c57-a58d-33a13dcdb0b7", "eventTime": "2017-05-26T22:13:35Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/AmazonGlacierReadOnlyAccess", "versionId": "v2"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "049fa80e-d32f-407d-ae4d-621ac3df4d4b", "record_id": "flaws_cloudtrail:0000040:049fa80e-d32f-407d-ae4d-621ac3df4d4b", "row_index": 40, "timestamp": "2017-05-26T22:13:41Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 785, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "049fa80e-d32f-407d-ae4d-621ac3df4d4b", "eventTime": "2017-05-26T22:13:41Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/AWSMarketplaceFullAccess", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d0ce9d39-313a-4da7-b462-5e7e9b4425e6", "record_id": "flaws_cloudtrail:0000041:d0ce9d39-313a-4da7-b462-5e7e9b4425e6", "row_index": 41, "timestamp": "2017-05-26T22:13:48Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 793, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d0ce9d39-313a-4da7-b462-5e7e9b4425e6", "eventTime": "2017-05-26T22:13:48Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/AutoScalingConsoleReadOnlyAccess", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5d9db8a1-f96e-402c-97cc-a3cb8207669d", "record_id": "flaws_cloudtrail:0000042:5d9db8a1-f96e-402c-97cc-a3cb8207669d", "row_index": 42, "timestamp": "2017-05-26T22:13:54Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 797, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5d9db8a1-f96e-402c-97cc-a3cb8207669d", "eventTime": "2017-05-26T22:13:54Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/service-role/AmazonDMSRedshiftS3Role", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8c1fb8f5-6c7e-45db-8173-f60d2c3754e9", "record_id": "flaws_cloudtrail:0000043:8c1fb8f5-6c7e-45db-8173-f60d2c3754e9", "row_index": 43, "timestamp": "2017-05-26T22:14:00Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 792, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8c1fb8f5-6c7e-45db-8173-f60d2c3754e9", "eventTime": "2017-05-26T22:14:00Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/service-role/AWSQuickSightListIAM", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "419538-2362-4f72-960e-a559625a6364", "record_id": "flaws_cloudtrail:0000044:419538-2362-4f72-960e-a559625a6364", "row_index": 44, "timestamp": "2017-05-26T22:14:50Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 778, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "419538-2362-4f72-960e-a559625a6364", "eventTime": "2017-05-26T22:14:50Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/AWSHealthFullAccess", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9af59e91-af16-43cb-b548-b6edcc8a4a30", "record_id": "flaws_cloudtrail:0000045:9af59e91-af16-43cb-b548-b6edcc8a4a30", "row_index": 45, "timestamp": "2017-05-26T22:21:23Z", "event_type": "ListAccountAliases", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 692, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9af59e91-af16-43cb-b548-b6edcc8a4a30", "eventTime": "2017-05-26T22:21:23Z", "eventName": "ListAccountAliases", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "157c7060-2ad5-42cb-8b76-35d41a38a7cb", "record_id": "flaws_cloudtrail:0000046:157c7060-2ad5-42cb-8b76-35d41a38a7cb", "row_index": 46, "timestamp": "2017-05-26T22:21:23Z", "event_type": "ListMFADevices", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 688, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "157c7060-2ad5-42cb-8b76-35d41a38a7cb", "eventTime": "2017-05-26T22:21:23Z", "eventName": "ListMFADevices", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cbb46bde-22ad-4e10-8afd-3c5a4603232f", "record_id": "flaws_cloudtrail:0000047:cbb46bde-22ad-4e10-8afd-3c5a4603232f", "row_index": 47, "timestamp": "2017-05-26T22:21:23Z", "event_type": "ListAccountAliases", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 692, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cbb46bde-22ad-4e10-8afd-3c5a4603232f", "eventTime": "2017-05-26T22:21:23Z", "eventName": "ListAccountAliases", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e0bee345-29e0-4b83-8be1-dca90b05c134", "record_id": "flaws_cloudtrail:0000048:e0bee345-29e0-4b83-8be1-dca90b05c134", "row_index": 48, "timestamp": "2017-05-26T22:21:23Z", "event_type": "GetAccountPasswordPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 819, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e0bee345-29e0-4b83-8be1-dca90b05c134", "eventTime": "2017-05-26T22:21:23Z", "eventName": "GetAccountPasswordPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "errorCode": "NoSuchEntityException", "errorMessage": "The Password Policy with domain name 811596193553 cannot be found.", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "65e24c4c-20ae-465b-9e12-ee41df47061", "record_id": "flaws_cloudtrail:0000049:65e24c4c-20ae-465b-9e12-ee41df47061", "row_index": 49, "timestamp": "2017-05-26T22:21:23Z", "event_type": "GetAccountPasswordPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 817, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "65e24c4c-20ae-465b-9e12-ee41df47061", "eventTime": "2017-05-26T22:21:23Z", "eventName": "GetAccountPasswordPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "errorCode": "NoSuchEntityException", "errorMessage": "The Password Policy with domain name 811596193553 cannot be found.", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "093159-e9c6-489f-a9bb-6ad67e519754", "record_id": "flaws_cloudtrail:0000050:093159-e9c6-489f-a9bb-6ad67e519754", "row_index": 50, "timestamp": "2017-05-26T22:21:23Z", "event_type": "ListMFADevices", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 686, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "093159-e9c6-489f-a9bb-6ad67e519754", "eventTime": "2017-05-26T22:21:23Z", "eventName": "ListMFADevices", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "887dfa7e-4e63-460e-8374-e2e7517aac68", "record_id": "flaws_cloudtrail:0000051:887dfa7e-4e63-460e-8374-e2e7517aac68", "row_index": 51, "timestamp": "2017-05-26T22:21:23Z", "event_type": "ListAccessKeys", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 689, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "887dfa7e-4e63-460e-8374-e2e7517aac68", "eventTime": "2017-05-26T22:21:23Z", "eventName": "ListAccessKeys", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8b15ee60-4eb7-46f5-bfdb-819e2457dd0a", "record_id": "flaws_cloudtrail:0000052:8b15ee60-4eb7-46f5-bfdb-819e2457dd0a", "row_index": 52, "timestamp": "2017-05-26T22:21:23Z", "event_type": "GetAccountSummary", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 692, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8b15ee60-4eb7-46f5-bfdb-819e2457dd0a", "eventTime": "2017-05-26T22:21:23Z", "eventName": "GetAccountSummary", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "87ca008f-0469-40f3-982c-1fc0e5cb3855", "record_id": "flaws_cloudtrail:0000053:87ca008f-0469-40f3-982c-1fc0e5cb3855", "row_index": 53, "timestamp": "2017-05-26T22:21:23Z", "event_type": "ListAccessKeys", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 688, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "87ca008f-0469-40f3-982c-1fc0e5cb3855", "eventTime": "2017-05-26T22:21:23Z", "eventName": "ListAccessKeys", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2e5ca186-9726-45a7-9973-36c996c8176d", "record_id": "flaws_cloudtrail:0000054:2e5ca186-9726-45a7-9973-36c996c8176d", "row_index": 54, "timestamp": "2017-05-26T22:21:23Z", "event_type": "GetAccountSummary", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 691, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2e5ca186-9726-45a7-9973-36c996c8176d", "eventTime": "2017-05-26T22:21:23Z", "eventName": "GetAccountSummary", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8c23a136-1d63-494b-b3e2-61dcf40e88c5", "record_id": "flaws_cloudtrail:0000055:8c23a136-1d63-494b-b3e2-61dcf40e88c5", "row_index": 55, "timestamp": "2017-05-26T22:21:25Z", "event_type": "ListRoles", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 696, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8c23a136-1d63-494b-b3e2-61dcf40e88c5", "eventTime": "2017-05-26T22:21:25Z", "eventName": "ListRoles", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "requestParameters": {"maxItems": 1000}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "573fc4c6-4d55-4332-a451-ca40a32f4be4", "record_id": "flaws_cloudtrail:0000056:573fc4c6-4d55-4332-a451-ca40a32f4be4", "row_index": 56, "timestamp": "2017-05-26T22:21:25Z", "event_type": "ListInstanceProfilesForRole", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 717, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "573fc4c6-4d55-4332-a451-ca40a32f4be4", "eventTime": "2017-05-26T22:21:25Z", "eventName": "ListInstanceProfilesForRole", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "requestParameters": {"roleName": "flaws"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "97d646a0-9f6c-4173-91e9-16e857265", "record_id": "flaws_cloudtrail:0000057:97d646a0-9f6c-4173-91e9-16e857265", "row_index": 57, "timestamp": "2017-05-26T22:21:25Z", "event_type": "ListRolePolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 703, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "97d646a0-9f6c-4173-91e9-16e857265", "eventTime": "2017-05-26T22:21:25Z", "eventName": "ListRolePolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "requestParameters": {"roleName": "flaws"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "269290-a6e0-4ac3-817d-47d6f2deeb47", "record_id": "flaws_cloudtrail:0000058:269290-a6e0-4ac3-817d-47d6f2deeb47", "row_index": 58, "timestamp": "2017-05-26T22:21:25Z", "event_type": "ListInstanceProfilesForRole", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 716, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "269290-a6e0-4ac3-817d-47d6f2deeb47", "eventTime": "2017-05-26T22:21:25Z", "eventName": "ListInstanceProfilesForRole", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "requestParameters": {"roleName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "601f129e-1459-437a-aedc-74ffbe618215", "record_id": "flaws_cloudtrail:0000059:601f129e-1459-437a-aedc-74ffbe618215", "row_index": 59, "timestamp": "2017-05-26T22:21:25Z", "event_type": "ListRolePolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 707, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "601f129e-1459-437a-aedc-74ffbe618215", "eventTime": "2017-05-26T22:21:25Z", "eventName": "ListRolePolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "requestParameters": {"roleName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7e98f795-c5fb-41a9-a842-23b61ec23958", "record_id": "flaws_cloudtrail:0000060:7e98f795-c5fb-41a9-a842-23b61ec23958", "row_index": 60, "timestamp": "2017-05-26T22:21:49Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 720, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7e98f795-c5fb-41a9-a842-23b61ec23958", "eventTime": "2017-05-26T22:21:49Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "requestParameters": {"maxItems": 1000, "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a0ef3fb6-4c0c-4325-bae8-26ba077d2f28", "record_id": "flaws_cloudtrail:0000061:a0ef3fb6-4c0c-4325-bae8-26ba077d2f28", "row_index": 61, "timestamp": "2017-05-26T22:22:07Z", "event_type": "CreateRole", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1791, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a0ef3fb6-4c0c-4325-bae8-26ba077d2f28", "eventTime": "2017-05-26T22:22:07Z", "eventName": "CreateRole", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "requestParameters": {"roleName": "SecurityMonkey", "description": "Allows EC2 instances to call AWS services on your behalf.", "assumeRolePolicyDocument": "{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": [\n        \"sts:AssumeRole\"\n      ],\n      \"Principal\": {\n        \"Service\": [\n          \"ec2.amazonaws.com\"\n        ]\n      }\n    }\n  ]\n}"}, "responseElements": {"role": {"assumeRolePolicyDocument": "%7B%0A%20%20%22Version%22%3A%20%74163-10-17%22%2C%0A%20%20%22Statement%22%3A%20%5B%0A%20%20%20%20%7B%0A%20%20%20%20%20%20%22Effect%22%3A%20%22Allow%22%2C%0A%20%20%20%20%20%20%22Action%22%3A%20%5B%0A%20%20%20%20%20%20%20%20%22sts%3AAssumeRole%22%0A%20%20%20%20%20%20%5D%2C%0A%20%20%20%20%20%20%22Principal%22%3A%20%7B%0A%20%20%20%20%20%20%20%20%22Service%22%3A%20%5B%0A%20%20%20%20%20%20%20%20%20%20%22ec2.amazonaws.com%22%0A%20%20%20%20%20%20%20%20%5D%0A%20%20%20%20%20%20%7D%0A%20%20%20%20%7D%0A%20%20%5D%0A%7D", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleId": "AROAUB2AA5FQRGAHITW4A", "createDate": "May 26, 2017 10:22:07 PM", "roleName": "SecurityMonkey", "path": "/"}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a67c675f-f4ab-4910-9e60-dd92621e34e", "record_id": "flaws_cloudtrail:0000062:a67c675f-f4ab-4910-9e60-dd92621e34e", "row_index": 62, "timestamp": "2017-05-26T22:22:07Z", "event_type": "AttachRolePolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 766, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a67c675f-f4ab-4910-9e60-dd92621e34e", "eventTime": "2017-05-26T22:22:07Z", "eventName": "AttachRolePolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "requestParameters": {"roleName": "SecurityMonkey", "policyArn": "arn:aws:iam::aws:policy/SecurityAudit"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e457c0bd-a4c9-4463-bb82-91cc15c5d18b", "record_id": "flaws_cloudtrail:0000063:e457c0bd-a4c9-4463-bb82-91cc15c5d18b", "row_index": 63, "timestamp": "2017-05-26T22:22:07Z", "event_type": "ListRoles", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 696, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e457c0bd-a4c9-4463-bb82-91cc15c5d18b", "eventTime": "2017-05-26T22:22:07Z", "eventName": "ListRoles", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "requestParameters": {"maxItems": 1000}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f29e48df-6577-4217-845b-0c3186def739", "record_id": "flaws_cloudtrail:0000064:f29e48df-6577-4217-845b-0c3186def739", "row_index": 64, "timestamp": "2017-05-26T22:22:07Z", "event_type": "AddRoleToInstanceProfile", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 762, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f29e48df-6577-4217-845b-0c3186def739", "eventTime": "2017-05-26T22:22:07Z", "eventName": "AddRoleToInstanceProfile", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "requestParameters": {"instanceProfileName": "SecurityMonkey", "roleName": "SecurityMonkey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bbf3794a-f9f1-4153-ab1e-445abb1f560d", "record_id": "flaws_cloudtrail:0000065:bbf3794a-f9f1-4153-ab1e-445abb1f560d", "row_index": 65, "timestamp": "2017-05-26T22:22:07Z", "event_type": "CreateInstanceProfile", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 958, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bbf3794a-f9f1-4153-ab1e-445abb1f560d", "eventTime": "2017-05-26T22:22:07Z", "eventName": "CreateInstanceProfile", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "requestParameters": {"instanceProfileName": "SecurityMonkey"}, "responseElements": {"instanceProfile": {"instanceProfileId": "AIPA462H5HVWYY638HY1T", "arn": "arn:aws:iam::811596193553:instance-profile/SecurityMonkey", "roles": [], "path": "/", "instanceProfileName": "SecurityMonkey", "createDate": "May 26, 2017 10:22:07 PM"}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8f7ab408-32f5-473a-b03d-30c2b8240882", "record_id": "flaws_cloudtrail:0000066:8f7ab408-32f5-473a-b03d-30c2b8240882", "row_index": 66, "timestamp": "2017-05-26T22:22:08Z", "event_type": "ListInstanceProfilesForRole", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 726, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8f7ab408-32f5-473a-b03d-30c2b8240882", "eventTime": "2017-05-26T22:22:08Z", "eventName": "ListInstanceProfilesForRole", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "requestParameters": {"roleName": "SecurityMonkey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ce52d1e4-763c-42ea-9e04-93ed3eeb29ce", "record_id": "flaws_cloudtrail:0000067:ce52d1e4-763c-42ea-9e04-93ed3eeb29ce", "row_index": 67, "timestamp": "2017-05-26T22:22:08Z", "event_type": "ListRolePolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 706, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ce52d1e4-763c-42ea-9e04-93ed3eeb29ce", "eventTime": "2017-05-26T22:22:08Z", "eventName": "ListRolePolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "requestParameters": {"roleName": "flaws"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dd23553-cd86-45cc-9d8f-a08f44c836d6", "record_id": "flaws_cloudtrail:0000068:dd23553-cd86-45cc-9d8f-a08f44c836d6", "row_index": 68, "timestamp": "2017-05-26T22:22:08Z", "event_type": "ListRolePolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 714, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dd23553-cd86-45cc-9d8f-a08f44c836d6", "eventTime": "2017-05-26T22:22:08Z", "eventName": "ListRolePolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "requestParameters": {"roleName": "SecurityMonkey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "976556e-ee0f-4533-95c5-4a3d7b52b290", "record_id": "flaws_cloudtrail:0000069:976556e-ee0f-4533-95c5-4a3d7b52b290", "row_index": 69, "timestamp": "2017-05-26T22:22:08Z", "event_type": "ListInstanceProfilesForRole", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 716, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "976556e-ee0f-4533-95c5-4a3d7b52b290", "eventTime": "2017-05-26T22:22:08Z", "eventName": "ListInstanceProfilesForRole", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "requestParameters": {"roleName": "flaws"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "347f82a0-35f0-420f-b648-956754bbb4", "record_id": "flaws_cloudtrail:0000070:347f82a0-35f0-420f-b648-956754bbb4", "row_index": 70, "timestamp": "2017-05-26T22:22:08Z", "event_type": "ListInstanceProfilesForRole", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 716, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "347f82a0-35f0-420f-b648-956754bbb4", "eventTime": "2017-05-26T22:22:08Z", "eventName": "ListInstanceProfilesForRole", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "requestParameters": {"roleName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "640b17d4-0eee-4f63-bb35-e9d8c3ef6a57", "record_id": "flaws_cloudtrail:0000071:640b17d4-0eee-4f63-bb35-e9d8c3ef6a57", "row_index": 71, "timestamp": "2017-05-26T22:22:08Z", "event_type": "ListRolePolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 708, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "640b17d4-0eee-4f63-bb35-e9d8c3ef6a57", "eventTime": "2017-05-26T22:22:08Z", "eventName": "ListRolePolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "requestParameters": {"roleName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1ffb8856-4d95-4ea8-be13-49cb51c0629e", "record_id": "flaws_cloudtrail:0000072:1ffb8856-4d95-4ea8-be13-49cb51c0629e", "row_index": 72, "timestamp": "2017-05-26T22:22:21Z", "event_type": "ListUsers", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 696, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1ffb8856-4d95-4ea8-be13-49cb51c0629e", "eventTime": "2017-05-26T22:22:21Z", "eventName": "ListUsers", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "requestParameters": {"maxItems": 1000}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fc0d3671-c2b7-4436-8065-e83bdfc553de", "record_id": "flaws_cloudtrail:0000073:fc0d3671-c2b7-4436-8065-e83bdfc553de", "row_index": 73, "timestamp": "2017-05-26T22:22:23Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 720, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fc0d3671-c2b7-4436-8065-e83bdfc553de", "eventTime": "2017-05-26T22:22:23Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "requestParameters": {"maxItems": 1000, "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7e6f31ba-8f90-4ebe-a0d8-b77cc53bc28a", "record_id": "flaws_cloudtrail:0000074:7e6f31ba-8f90-4ebe-a0d8-b77cc53bc28a", "row_index": 74, "timestamp": "2017-05-26T22:22:23Z", "event_type": "GetAccountSummary", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 691, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7e6f31ba-8f90-4ebe-a0d8-b77cc53bc28a", "eventTime": "2017-05-26T22:22:23Z", "eventName": "GetAccountSummary", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "253c079d-5e25-498c-b076-b0db70cfe1ae", "record_id": "flaws_cloudtrail:0000075:253c079d-5e25-498c-b076-b0db70cfe1ae", "row_index": 75, "timestamp": "2017-05-26T22:22:23Z", "event_type": "ListMFADevices", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 688, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "253c079d-5e25-498c-b076-b0db70cfe1ae", "eventTime": "2017-05-26T22:22:23Z", "eventName": "ListMFADevices", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "017bc7ff-2344-4da3-9427-0d4c75062b4c", "record_id": "flaws_cloudtrail:0000076:017bc7ff-2344-4da3-9427-0d4c75062b4c", "row_index": 76, "timestamp": "2017-05-26T22:22:23Z", "event_type": "ListAccessKeys", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 688, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "017bc7ff-2344-4da3-9427-0d4c75062b4c", "eventTime": "2017-05-26T22:22:23Z", "eventName": "ListAccessKeys", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bccc5dbc-39af-4976-bfaa-d72e158f4a1c", "record_id": "flaws_cloudtrail:0000077:bccc5dbc-39af-4976-bfaa-d72e158f4a1c", "row_index": 77, "timestamp": "2017-05-26T22:22:23Z", "event_type": "ListAccountAliases", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 692, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bccc5dbc-39af-4976-bfaa-d72e158f4a1c", "eventTime": "2017-05-26T22:22:23Z", "eventName": "ListAccountAliases", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ac347614-ada3-4efd-8478-cdaa0afed030", "record_id": "flaws_cloudtrail:0000078:ac347614-ada3-4efd-8478-cdaa0afed030", "row_index": 78, "timestamp": "2017-05-26T22:22:23Z", "event_type": "GetAccountPasswordPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 818, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ac347614-ada3-4efd-8478-cdaa0afed030", "eventTime": "2017-05-26T22:22:23Z", "eventName": "GetAccountPasswordPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "errorCode": "NoSuchEntityException", "errorMessage": "The Password Policy with domain name 811596193553 cannot be found.", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "25a3665a-85b2-4140-9f28-7dbe664724f3d", "record_id": "flaws_cloudtrail:0000079:25a3665a-85b2-4140-9f28-7dbe664724f3d", "row_index": 79, "timestamp": "2017-05-26T22:22:31Z", "event_type": "ListGroups", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 698, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "25a3665a-85b2-4140-9f28-7dbe664724f3d", "eventTime": "2017-05-26T22:22:31Z", "eventName": "ListGroups", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "requestParameters": {"maxItems": 1000}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a4eecc4e-81d7-4435-bc55-35990d20", "record_id": "flaws_cloudtrail:0000080:a4eecc4e-81d7-4435-bc55-35990d20", "row_index": 80, "timestamp": "2017-05-26T22:23:03Z", "event_type": "GetAccountPasswordPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 813, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a4eecc4e-81d7-4435-bc55-35990d20", "eventTime": "2017-05-26T22:23:03Z", "eventName": "GetAccountPasswordPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "errorCode": "NoSuchEntityException", "errorMessage": "The Password Policy with domain name 811596193553 cannot be found.", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e6605ef6-8ad2-498b-93bd-792aca4eb0c0", "record_id": "flaws_cloudtrail:0000081:e6605ef6-8ad2-498b-93bd-792aca4eb0c0", "row_index": 81, "timestamp": "2017-05-26T22:23:03Z", "event_type": "ListAccountAliases", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 692, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e6605ef6-8ad2-498b-93bd-792aca4eb0c0", "eventTime": "2017-05-26T22:23:03Z", "eventName": "ListAccountAliases", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4453cc97-1ae0-4374-a7e4-52a7bf87926", "record_id": "flaws_cloudtrail:0000082:4453cc97-1ae0-4374-a7e4-52a7bf87926", "row_index": 82, "timestamp": "2017-05-26T22:23:03Z", "event_type": "ListAccessKeys", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 687, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4453cc97-1ae0-4374-a7e4-52a7bf87926", "eventTime": "2017-05-26T22:23:03Z", "eventName": "ListAccessKeys", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a2713dd5-e4bc-45ae-b60c-3f759a965ed8", "record_id": "flaws_cloudtrail:0000083:a2713dd5-e4bc-45ae-b60c-3f759a965ed8", "row_index": 83, "timestamp": "2017-05-26T22:23:03Z", "event_type": "ListMFADevices", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 688, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a2713dd5-e4bc-45ae-b60c-3f759a965ed8", "eventTime": "2017-05-26T22:23:03Z", "eventName": "ListMFADevices", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "db623a6c-0969-4439-bc9f-21ead0692364", "record_id": "flaws_cloudtrail:0000084:db623a6c-0969-4439-bc9f-21ead0692364", "row_index": 84, "timestamp": "2017-05-26T22:23:03Z", "event_type": "GetAccountSummary", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 691, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "db623a6c-0969-4439-bc9f-21ead0692364", "eventTime": "2017-05-26T22:23:03Z", "eventName": "GetAccountSummary", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "791e8544-7615-461b-ae56-d8d01850", "record_id": "flaws_cloudtrail:0000085:791e8544-7615-461b-ae56-d8d01850", "row_index": 85, "timestamp": "2017-05-26T22:23:04Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 716, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "791e8544-7615-461b-ae56-d8d01850", "eventTime": "2017-05-26T22:23:04Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "requestParameters": {"maxItems": 1000, "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9de2d192-6a7f-47a7-9f0f-3fff7c718792", "record_id": "flaws_cloudtrail:0000086:9de2d192-6a7f-47a7-9f0f-3fff7c718792", "row_index": 86, "timestamp": "2017-05-26T22:23:35Z", "event_type": "ListAccountAliases", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 692, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9de2d192-6a7f-47a7-9f0f-3fff7c718792", "eventTime": "2017-05-26T22:23:35Z", "eventName": "ListAccountAliases", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "76c4e02d-07d6-47a0-87be-bda96580dafa", "record_id": "flaws_cloudtrail:0000087:76c4e02d-07d6-47a0-87be-bda96580dafa", "row_index": 87, "timestamp": "2017-05-26T22:23:35Z", "event_type": "ListMFADevices", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 688, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "76c4e02d-07d6-47a0-87be-bda96580dafa", "eventTime": "2017-05-26T22:23:35Z", "eventName": "ListMFADevices", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "996fae36-8f82-4c7c-adb9-7a51d2ed5470", "record_id": "flaws_cloudtrail:0000088:996fae36-8f82-4c7c-adb9-7a51d2ed5470", "row_index": 88, "timestamp": "2017-05-26T22:23:35Z", "event_type": "GetAccountPasswordPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 818, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "996fae36-8f82-4c7c-adb9-7a51d2ed5470", "eventTime": "2017-05-26T22:23:35Z", "eventName": "GetAccountPasswordPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "errorCode": "NoSuchEntityException", "errorMessage": "The Password Policy with domain name 811596193553 cannot be found.", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "06f0967d-2d2a-4280-8a76-0d0fd4d82180", "record_id": "flaws_cloudtrail:0000089:06f0967d-2d2a-4280-8a76-0d0fd4d82180", "row_index": 89, "timestamp": "2017-05-26T22:23:35Z", "event_type": "GetAccountSummary", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 691, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "06f0967d-2d2a-4280-8a76-0d0fd4d82180", "eventTime": "2017-05-26T22:23:35Z", "eventName": "GetAccountSummary", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "977a7a88-efd7-44f7-8490-4aa8db21fdc6", "record_id": "flaws_cloudtrail:0000090:977a7a88-efd7-44f7-8490-4aa8db21fdc6", "row_index": 90, "timestamp": "2017-05-26T22:23:35Z", "event_type": "ListAccessKeys", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 688, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "977a7a88-efd7-44f7-8490-4aa8db21fdc6", "eventTime": "2017-05-26T22:23:35Z", "eventName": "ListAccessKeys", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d085524e0-dcc6-4e40-a71d-900683f81433", "record_id": "flaws_cloudtrail:0000091:d085524e0-dcc6-4e40-a71d-900683f81433", "row_index": 91, "timestamp": "2017-05-26T22:23:35Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 721, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d085524e0-dcc6-4e40-a71d-900683f81433", "eventTime": "2017-05-26T22:23:35Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "requestParameters": {"maxItems": 1000, "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f68d7e7d-df58-4ebe-81d3-d05f660498b0a", "record_id": "flaws_cloudtrail:0000092:f68d7e7d-df58-4ebe-81d3-d05f660498b0a", "row_index": 92, "timestamp": "2017-05-26T22:23:35Z", "event_type": "CreatePolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1340, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f68d7e7d-df58-4ebe-81d3-d05f660498b0a", "eventTime": "2017-05-26T22:23:35Z", "eventName": "CreatePolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "requestParameters": {"policyDocument": "{\r\n  \"Version\": \"2012-10-17\",\r\n  \"Statement\": [\r\n    {\r\n      \"Sid\": \"Stmt3138246446502\",\r\n      \"Effect\": \"Allow\",\r\n      \"Action\": [\r\n        \"sts:AssumeRole\"\r\n      ],\r\n      \"Resource\": [\r\n        \"arn:aws:iam::811596193553:role/SecurityMonkey\"\r\n      ]\r\n    }\r\n  ]\r\n}", "policyName": "SecurityMonkey"}, "responseElements": {"policy": {"updateDate": "May 26, 2017 10:23:35 PM", "createDate": "May 26, 2017 10:23:35 PM", "attachmentCount": 0, "arn": "arn:aws:iam::811596193553:policy/SecurityMonkey", "defaultVersionId": "v1", "path": "/", "policyId": "ANPA0JVMJ6EHU2606YFY7", "policyName": "SecurityMonkey", "isAttachable": true}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7c539518d-3bbf-4858-b721-55b27a6704cd", "record_id": "flaws_cloudtrail:0000093:7c539518d-3bbf-4858-b721-55b27a6704cd", "row_index": 93, "timestamp": "2017-05-26T22:23:39Z", "event_type": "ListUsers", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 697, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7c539518d-3bbf-4858-b721-55b27a6704cd", "eventTime": "2017-05-26T22:23:39Z", "eventName": "ListUsers", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "requestParameters": {"maxItems": 1000}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "784488f-7415-4272-a8c1-bf5f9aa6271a", "record_id": "flaws_cloudtrail:0000094:784488f-7415-4272-a8c1-bf5f9aa6271a", "row_index": 94, "timestamp": "2017-05-26T22:23:48Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 719, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "784488f-7415-4272-a8c1-bf5f9aa6271a", "eventTime": "2017-05-26T22:23:48Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "requestParameters": {"maxItems": 1000, "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "19a74aeb-ef42-4e48-a75b-3bac4fa6f895", "record_id": "flaws_cloudtrail:0000095:19a74aeb-ef42-4e48-a75b-3bac4fa6f895", "row_index": 95, "timestamp": "2017-05-26T22:23:54Z", "event_type": "ListAccessKeys", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 728, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "19a74aeb-ef42-4e48-a75b-3bac4fa6f895", "eventTime": "2017-05-26T22:23:54Z", "eventName": "ListAccessKeys", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "requestParameters": {"maxItems": 1000, "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "873975d0-b93f-40c2-9338-1142d01725a", "record_id": "flaws_cloudtrail:0000096:873975d0-b93f-40c2-9338-1142d01725a", "row_index": 96, "timestamp": "2017-05-26T22:23:54Z", "event_type": "AttachUserPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 775, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "873975d0-b93f-40c2-9338-1142d01725a", "eventTime": "2017-05-26T22:23:54Z", "eventName": "AttachUserPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "requestParameters": {"userName": "SecurityMokey", "policyArn": "arn:aws:iam::811596193553:policy/SecurityMonkey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a9c86065-6906-447c-8144-0d3bcd990346", "record_id": "flaws_cloudtrail:0000097:a9c86065-6906-447c-8144-0d3bcd990346", "row_index": 97, "timestamp": "2017-05-26T22:23:54Z", "event_type": "GetPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 742, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a9c86065-6906-447c-8144-0d3bcd990346", "eventTime": "2017-05-26T22:23:54Z", "eventName": "GetPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/SecurityMonkey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3733d1e4-847e-44aa-9d8d-384a7d3cc084", "record_id": "flaws_cloudtrail:0000098:3733d1e4-847e-44aa-9d8d-384a7d3cc084", "row_index": 98, "timestamp": "2017-05-26T22:23:54Z", "event_type": "ListUsers", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 696, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3733d1e4-847e-44aa-9d8d-384a7d3cc084", "eventTime": "2017-05-26T22:23:54Z", "eventName": "ListUsers", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "requestParameters": {"maxItems": 1000}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8b417780-63cb-46aa-b2ea-bdea33c235ae", "record_id": "flaws_cloudtrail:0000099:8b417780-63cb-46aa-b2ea-bdea33c235ae", "row_index": 99, "timestamp": "2017-05-26T22:23:54Z", "event_type": "CreateUser", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 878, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8b417780-63cb-46aa-b2ea-bdea33c235ae", "eventTime": "2017-05-26T22:23:54Z", "eventName": "CreateUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "requestParameters": {"userName": "SecurityMokey"}, "responseElements": {"user": {"path": "/", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "userId": "AIDAQ9SRE1SZZZ4Q4UOJH", "createDate": "May 26, 2017 10:23:54 PM", "userName": "SecurityMokey"}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5ae72156-6d2b-48ac-8fdc-30f7a4935ca6", "record_id": "flaws_cloudtrail:0000100:5ae72156-6d2b-48ac-8fdc-30f7a4935ca6", "row_index": 100, "timestamp": "2017-05-26T22:23:54Z", "event_type": "CreateAccessKey", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 846, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5ae72156-6d2b-48ac-8fdc-30f7a4935ca6", "eventTime": "2017-05-26T22:23:54Z", "eventName": "CreateAccessKey", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "requestParameters": {"userName": "SecurityMokey"}, "responseElements": {"accessKey": {"accessKeyId": "AKIAXJ0III4JBKZDXGXN", "status": "Active", "userName": "SecurityMokey", "createDate": "May 26, 2017 10:23:54 PM"}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3e58772-6958-4680-b1ed-a1fa4cb5bac9", "record_id": "flaws_cloudtrail:0000101:3e58772-6958-4680-b1ed-a1fa4cb5bac9", "row_index": 101, "timestamp": "2017-05-26T22:23:55Z", "event_type": "ListAccountAliases", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3e58772-6958-4680-b1ed-a1fa4cb5bac9", "eventTime": "2017-05-26T22:23:55Z", "eventName": "ListAccountAliases", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "requestParameters": {"maxItems": 1000}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0c18e28d-59d6-484d-81ad-cebc418013df", "record_id": "flaws_cloudtrail:0000102:0c18e28d-59d6-484d-81ad-cebc418013df", "row_index": 102, "timestamp": "2017-05-26T22:23:58Z", "event_type": "DescribeLoadBalancers", "event_source": "elasticloadbalancing.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 768, "raw_record_depth": 2, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0c18e28d-59d6-484d-81ad-cebc418013df", "eventTime": "2017-05-26T22:23:58Z", "eventName": "DescribeLoadBalancers", "eventSource": "elasticloadbalancing.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"pageSize": 400}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0713b08d-9362-428b-86f9-190a529dafa5", "record_id": "flaws_cloudtrail:0000103:0713b08d-9362-428b-86f9-190a529dafa5", "row_index": 103, "timestamp": "2017-05-26T22:23:59Z", "event_type": "ListHostedZones", "event_source": "route53.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 737, "raw_record_depth": 2, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0713b08d-9362-428b-86f9-190a529dafa5", "eventTime": "2017-05-26T22:23:59Z", "eventName": "ListHostedZones", "eventSource": "route53.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5c9eb1f4-5bda-4ee1-911f-744b5e48d386", "record_id": "flaws_cloudtrail:0000104:5c9eb1f4-5bda-4ee1-911f-744b5e48d386", "row_index": 104, "timestamp": "2017-05-26T22:23:59Z", "event_type": "ListRoles", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 701, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5c9eb1f4-5bda-4ee1-911f-744b5e48d386", "eventTime": "2017-05-26T22:23:59Z", "eventName": "ListRoles", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8e6b385d-b82e-47b7-ade7-0226c92faf8e", "record_id": "flaws_cloudtrail:0000105:8e6b385d-b82e-47b7-ade7-0226c92faf8e", "row_index": 105, "timestamp": "2017-05-26T22:23:59Z", "event_type": "ListGroups", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 702, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8e6b385d-b82e-47b7-ade7-0226c92faf8e", "eventTime": "2017-05-26T22:23:59Z", "eventName": "ListGroups", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b84b4bb4-e713-4735-8cf8-82fd75408a", "record_id": "flaws_cloudtrail:0000106:b84b4bb4-e713-4735-8cf8-82fd75408a", "row_index": 106, "timestamp": "2017-05-26T22:23:59Z", "event_type": "ListVirtualMFADevices", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 710, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b84b4bb4-e713-4735-8cf8-82fd75408a", "eventTime": "2017-05-26T22:23:59Z", "eventName": "ListVirtualMFADevices", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2de6004f-009d-4824-84f4-14d8023b6621", "record_id": "flaws_cloudtrail:0000107:2de6004f-009d-4824-84f4-14d8023b6621", "row_index": 107, "timestamp": "2017-05-26T22:23:59Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 810, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2de6004f-009d-4824-84f4-14d8023b6621", "eventTime": "2017-05-26T22:23:59Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "responseElements": {"userId": "AIDADO2GQD0K8TEF7KW1V", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f8e96390-1a73-4470-95f4-d30ecd754fca", "record_id": "flaws_cloudtrail:0000108:f8e96390-1a73-4470-95f4-d30ecd754fca", "row_index": 108, "timestamp": "2017-05-26T22:23:59Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 779, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f8e96390-1a73-4470-95f4-d30ecd754fca", "eventTime": "2017-05-26T22:23:59Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/AmazonRDSFullAccess", "versionId": "v2"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3bcc6ecf-a65b-4142-b89f-d168bfd066f5", "record_id": "flaws_cloudtrail:0000109:3bcc6ecf-a65b-4142-b89f-d168bfd066f5", "row_index": 109, "timestamp": "2017-05-26T22:23:59Z", "event_type": "ListUsers", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 698, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3bcc6ecf-a65b-4142-b89f-d168bfd066f5", "eventTime": "2017-05-26T22:23:59Z", "eventName": "ListUsers", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "484a0937-6f55-48be-865e-2555cad6120e", "record_id": "flaws_cloudtrail:0000110:484a0937-6f55-48be-865e-2555cad6120e", "row_index": 110, "timestamp": "2017-05-26T22:23:59Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 739, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "484a0937-6f55-48be-865e-2555cad6120e", "eventTime": "2017-05-26T22:23:59Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7ae8448a-f04f-4507-b4b9-cbf887f58a54", "record_id": "flaws_cloudtrail:0000111:7ae8448a-f04f-4507-b4b9-cbf887f58a54", "row_index": 111, "timestamp": "2017-05-26T22:23:59Z", "event_type": "DescribeSubnets", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 734, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7ae8448a-f04f-4507-b4b9-cbf887f58a54", "eventTime": "2017-05-26T22:23:59Z", "eventName": "DescribeSubnets", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"subnetSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a7f83c6c-02bf-4f12-abee-6a5993e51edf", "record_id": "flaws_cloudtrail:0000112:a7f83c6c-02bf-4f12-abee-6a5993e51edf", "row_index": 112, "timestamp": "2017-05-26T22:23:59Z", "event_type": "DescribeTargetGroups", "event_source": "elasticloadbalancing.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 770, "raw_record_depth": 3, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a7f83c6c-02bf-4f12-abee-6a5993e51edf", "eventTime": "2017-05-26T22:23:59Z", "eventName": "DescribeTargetGroups", "eventSource": "elasticloadbalancing.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "responseElements": {"targetGroups": []}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6e9a0591-79d7-4c6c-9788-d32a56b453a1", "record_id": "flaws_cloudtrail:0000113:6e9a0591-79d7-4c6c-9788-d32a56b453a1", "row_index": 113, "timestamp": "2017-05-26T22:23:59Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "[aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 647, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6e9a0591-79d7-4c6c-9788-d32a56b453a1", "eventTime": "2017-05-26T22:23:59Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "[aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8d1683fa-6b9f-428a-89b2-e214ed675b83", "record_id": "flaws_cloudtrail:0000114:8d1683fa-6b9f-428a-89b2-e214ed675b83", "row_index": 114, "timestamp": "2017-05-26T22:23:59Z", "event_type": "DescribeAutoScalingGroups", "event_source": "autoscaling.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 738, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8d1683fa-6b9f-428a-89b2-e214ed675b83", "eventTime": "2017-05-26T22:23:59Z", "eventName": "DescribeAutoScalingGroups", "eventSource": "autoscaling.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"maxRecords": 50}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dcce9876-3d20-444e-81fa-ecc212c77e8a", "record_id": "flaws_cloudtrail:0000115:dcce9876-3d20-444e-81fa-ecc212c77e8a", "row_index": 115, "timestamp": "2017-05-26T22:23:59Z", "event_type": "DescribeAddresses", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 761, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dcce9876-3d20-444e-81fa-ecc212c77e8a", "eventTime": "2017-05-26T22:23:59Z", "eventName": "DescribeAddresses", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"publicIpsSet": {}, "filterSet": {}, "allocationIdsSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ed240158a-857e-45a4-af69-18018a696c3", "record_id": "flaws_cloudtrail:0000116:ed240158a-857e-45a4-af69-18018a696c3", "row_index": 116, "timestamp": "2017-05-26T22:23:59Z", "event_type": "DescribeScheduledActions", "event_source": "autoscaling.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 735, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ed240158a-857e-45a4-af69-18018a696c3", "eventTime": "2017-05-26T22:23:59Z", "eventName": "DescribeScheduledActions", "eventSource": "autoscaling.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"maxRecords": 50}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "106d9cab-a8d2-44e4-9701-c338e4faef25", "record_id": "flaws_cloudtrail:0000117:106d9cab-a8d2-44e4-9701-c338e4faef25", "row_index": 117, "timestamp": "2017-05-26T22:23:59Z", "event_type": "DescribeCacheClusters", "event_source": "elasticache.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 735, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "106d9cab-a8d2-44e4-9701-c338e4faef25", "eventTime": "2017-05-26T22:23:59Z", "eventName": "DescribeCacheClusters", "eventSource": "elasticache.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"maxRecords": 100}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "81f5e5cc-3ed4-4f10-a5e8-fa01c3b66ac8", "record_id": "flaws_cloudtrail:0000118:81f5e5cc-3ed4-4f10-a5e8-fa01c3b66ac8", "row_index": 118, "timestamp": "2017-05-26T22:23:59Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 772, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "81f5e5cc-3ed4-4f10-a5e8-fa01c3b66ac8", "eventTime": "2017-05-26T22:23:59Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1e42b098-88fb-44a8-8243-a839f3758a03", "record_id": "flaws_cloudtrail:0000119:1e42b098-88fb-44a8-8243-a839f3758a03", "row_index": 119, "timestamp": "2017-05-26T22:23:59Z", "event_type": "DescribePolicies", "event_source": "autoscaling.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 729, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1e42b098-88fb-44a8-8243-a839f3758a03", "eventTime": "2017-05-26T22:23:59Z", "eventName": "DescribePolicies", "eventSource": "autoscaling.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"maxRecords": 50}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bbf69b2f-ccab-4756-89ce-4e9c7333ac8d", "record_id": "flaws_cloudtrail:0000120:bbf69b2f-ccab-4756-89ce-4e9c7333ac8d", "row_index": 120, "timestamp": "2017-05-26T22:23:59Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 734, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bbf69b2f-ccab-4756-89ce-4e9c7333ac8d", "eventTime": "2017-05-26T22:23:59Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "358844ac4-67b0-4745-a50c-3d51b234e0c4", "record_id": "flaws_cloudtrail:0000121:358844ac4-67b0-4745-a50c-3d51b234e0c4", "row_index": 121, "timestamp": "2017-05-26T22:23:59Z", "event_type": "DescribeLaunchConfigurations", "event_source": "autoscaling.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 742, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "358844ac4-67b0-4745-a50c-3d51b234e0c4", "eventTime": "2017-05-26T22:23:59Z", "eventName": "DescribeLaunchConfigurations", "eventSource": "autoscaling.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"maxRecords": 50}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "132c8cd7-2b2d-4fd8-a635-0c571c367f65", "record_id": "flaws_cloudtrail:0000122:132c8cd7-2b2d-4fd8-a635-0c571c367f65", "row_index": 122, "timestamp": "2017-05-26T22:23:59Z", "event_type": "DescribeLaunchConfigurations", "event_source": "autoscaling.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 741, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "132c8cd7-2b2d-4fd8-a635-0c571c367f65", "eventTime": "2017-05-26T22:23:59Z", "eventName": "DescribeLaunchConfigurations", "eventSource": "autoscaling.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"maxRecords": 50}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e664f2b3-f01a-45b1-a2f4-fee3dcd80a7d", "record_id": "flaws_cloudtrail:0000123:e664f2b3-f01a-45b1-a2f4-fee3dcd80a7d", "row_index": 123, "timestamp": "2017-05-26T22:23:59Z", "event_type": "DescribeScalingActivities", "event_source": "autoscaling.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 736, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e664f2b3-f01a-45b1-a2f4-fee3dcd80a7d", "eventTime": "2017-05-26T22:23:59Z", "eventName": "DescribeScalingActivities", "eventSource": "autoscaling.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"maxRecords": 50}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8c256d38-9473-455d-b7c4-c300affa8697", "record_id": "flaws_cloudtrail:0000124:8c256d38-9473-455d-b7c4-c300affa8697", "row_index": 124, "timestamp": "2017-05-26T22:23:59Z", "event_type": "DescribeDBSubnetGroups", "event_source": "rds.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 714, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8c256d38-9473-455d-b7c4-c300affa8697", "eventTime": "2017-05-26T22:23:59Z", "eventName": "DescribeDBSubnetGroups", "eventSource": "rds.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "87715adc-3635-4ac3-8ba4-6a2c6afd0aaa", "record_id": "flaws_cloudtrail:0000125:87715adc-3635-4ac3-8ba4-6a2c6afd0aaa", "row_index": 125, "timestamp": "2017-05-26T22:23:59Z", "event_type": "DescribeVpcs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 728, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "87715adc-3635-4ac3-8ba4-6a2c6afd0aaa", "eventTime": "2017-05-26T22:23:59Z", "eventName": "DescribeVpcs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"vpcSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9329cada-fb67-4126-bafd-d2305f66bc22", "record_id": "flaws_cloudtrail:0000126:9329cada-fb67-4126-bafd-d2305f66bc22", "row_index": 126, "timestamp": "2017-05-26T22:23:59Z", "event_type": "DescribeReservedInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 756, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9329cada-fb67-4126-bafd-d2305f66bc22", "eventTime": "2017-05-26T22:23:59Z", "eventName": "DescribeReservedInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"reservedInstancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d06ff577-8aa6-4ed1-b561-27e0ac70ee52", "record_id": "flaws_cloudtrail:0000127:d06ff577-8aa6-4ed1-b561-27e0ac70ee52", "row_index": 127, "timestamp": "2017-05-26T22:23:59Z", "event_type": "DescribeTags", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 716, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d06ff577-8aa6-4ed1-b561-27e0ac70ee52", "eventTime": "2017-05-26T22:23:59Z", "eventName": "DescribeTags", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "506f9a5e-5dc6-416c-a950-291ca2e7b013", "record_id": "flaws_cloudtrail:0000128:506f9a5e-5dc6-416c-a950-291ca2e7b013", "row_index": 128, "timestamp": "2017-05-26T22:23:59Z", "event_type": "DescribeAlarms", "event_source": "monitoring.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 727, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "506f9a5e-5dc6-416c-a950-291ca2e7b013", "eventTime": "2017-05-26T22:23:59Z", "eventName": "DescribeAlarms", "eventSource": "monitoring.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"maxRecords": 100}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3ff0382e-9c7c-4a5f-ac7c-8e9961d64303", "record_id": "flaws_cloudtrail:0000129:3ff0382e-9c7c-4a5f-ac7c-8e9961d64303", "row_index": 129, "timestamp": "2017-05-26T22:23:59Z", "event_type": "DescribeLoadBalancers", "event_source": "elasticloadbalancing.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 772, "raw_record_depth": 3, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3ff0382e-9c7c-4a5f-ac7c-8e9961d64303", "eventTime": "2017-05-26T22:23:59Z", "eventName": "DescribeLoadBalancers", "eventSource": "elasticloadbalancing.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "responseElements": {"loadBalancers": []}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3c5d8bf0-424f-412e-a38c-06b833814d9a", "record_id": "flaws_cloudtrail:0000130:3c5d8bf0-424f-412e-a38c-06b833814d9a", "row_index": 130, "timestamp": "2017-05-26T22:23:59Z", "event_type": "DescribeLoadBalancers", "event_source": "elasticloadbalancing.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 768, "raw_record_depth": 2, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3c5d8bf0-424f-412e-a38c-06b833814d9a", "eventTime": "2017-05-26T22:23:59Z", "eventName": "DescribeLoadBalancers", "eventSource": "elasticloadbalancing.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"pageSize": 400}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "58832fde-3ba7-4a33-835a-abd1a8e77779", "record_id": "flaws_cloudtrail:0000131:58832fde-3ba7-4a33-835a-abd1a8e77779", "row_index": 131, "timestamp": "2017-05-26T22:23:59Z", "event_type": "DescribeReservedInstancesOfferings", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 759, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "58832fde-3ba7-4a33-835a-abd1a8e77779", "eventTime": "2017-05-26T22:23:59Z", "eventName": "DescribeReservedInstancesOfferings", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-sdk-java/1.11.60 Linux/4.4.0-78-generic Java_HotSpot(TM)_64-Bit_Server_VM/25.131-b11/1.8.0_131", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"reservedInstancesOfferingsSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0fe27f56-00be-4a7b-84d5-7c29f2331a0e", "record_id": "flaws_cloudtrail:0000132:0fe27f56-00be-4a7b-84d5-7c29f2331a0e", "row_index": 132, "timestamp": "2017-05-26T22:25:09Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 880, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0fe27f56-00be-4a7b-84d5-7c29f2331a0e", "eventTime": "2017-05-26T22:25:09Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "48874-161c-4c39-9448-0609c61229ab", "record_id": "flaws_cloudtrail:0000133:48874-161c-4c39-9448-0609c61229ab", "row_index": 133, "timestamp": "2017-05-26T22:25:09Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 878, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "48874-161c-4c39-9448-0609c61229ab", "eventTime": "2017-05-26T22:25:09Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "29ab8990-451b-4c3e-833a-ce756c6ba9dd", "record_id": "flaws_cloudtrail:0000134:29ab8990-451b-4c3e-833a-ce756c6ba9dd", "row_index": 134, "timestamp": "2017-05-26T22:25:09Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 881, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "29ab8990-451b-4c3e-833a-ce756c6ba9dd", "eventTime": "2017-05-26T22:25:09Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5ffd70d7-886b-498a-a264-08a0b6933b58", "record_id": "flaws_cloudtrail:0000135:5ffd70d7-886b-498a-a264-08a0b6933b58", "row_index": 135, "timestamp": "2017-05-26T22:25:09Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 881, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5ffd70d7-886b-498a-a264-08a0b6933b58", "eventTime": "2017-05-26T22:25:09Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "152f7f8e-be3c-4444-82bc-8de9e001e217", "record_id": "flaws_cloudtrail:0000136:152f7f8e-be3c-4444-82bc-8de9e001e217", "row_index": 136, "timestamp": "2017-05-26T22:25:10Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 881, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "152f7f8e-be3c-4444-82bc-8de9e001e217", "eventTime": "2017-05-26T22:25:10Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7fd0a9a0-5ec7-45f5-9305-d210db546118", "record_id": "flaws_cloudtrail:0000137:7fd0a9a0-5ec7-45f5-9305-d210db546118", "row_index": 137, "timestamp": "2017-05-26T22:25:10Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 882, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7fd0a9a0-5ec7-45f5-9305-d210db546118", "eventTime": "2017-05-26T22:25:10Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "05a0fca4-5fd1-479a-b03c-077af9a6119e", "record_id": "flaws_cloudtrail:0000138:05a0fca4-5fd1-479a-b03c-077af9a6119e", "row_index": 138, "timestamp": "2017-05-26T22:25:10Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 881, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "05a0fca4-5fd1-479a-b03c-077af9a6119e", "eventTime": "2017-05-26T22:25:10Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f3d553e7-59cb-4c86-8e28-87726d", "record_id": "flaws_cloudtrail:0000139:f3d553e7-59cb-4c86-8e28-87726d", "row_index": 139, "timestamp": "2017-05-26T22:25:10Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 875, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f3d553e7-59cb-4c86-8e28-87726d", "eventTime": "2017-05-26T22:25:10Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "73383a63-bcb8-4016-998e-d6453461996b", "record_id": "flaws_cloudtrail:0000140:73383a63-bcb8-4016-998e-d6453461996b", "row_index": 140, "timestamp": "2017-05-26T22:25:10Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 881, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "73383a63-bcb8-4016-998e-d6453461996b", "eventTime": "2017-05-26T22:25:10Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "691538ce7-fa88-4adc-9b7a-ae1d5044c8a5", "record_id": "flaws_cloudtrail:0000141:691538ce7-fa88-4adc-9b7a-ae1d5044c8a5", "row_index": 141, "timestamp": "2017-05-26T22:25:10Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 882, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "691538ce7-fa88-4adc-9b7a-ae1d5044c8a5", "eventTime": "2017-05-26T22:25:10Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dc3193fa-f1c7-41a3-8e58-03ae25a827982", "record_id": "flaws_cloudtrail:0000142:dc3193fa-f1c7-41a3-8e58-03ae25a827982", "row_index": 142, "timestamp": "2017-05-26T22:25:11Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 881, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dc3193fa-f1c7-41a3-8e58-03ae25a827982", "eventTime": "2017-05-26T22:25:11Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "923d678b-e70c-4e9f-8144-23061faea455", "record_id": "flaws_cloudtrail:0000143:923d678b-e70c-4e9f-8144-23061faea455", "row_index": 143, "timestamp": "2017-05-26T22:25:11Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 881, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "923d678b-e70c-4e9f-8144-23061faea455", "eventTime": "2017-05-26T22:25:11Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6ab4f2de-9efd-4640-a0e4-94a8e64c3bb8", "record_id": "flaws_cloudtrail:0000144:6ab4f2de-9efd-4640-a0e4-94a8e64c3bb8", "row_index": 144, "timestamp": "2017-05-26T22:25:11Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 881, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6ab4f2de-9efd-4640-a0e4-94a8e64c3bb8", "eventTime": "2017-05-26T22:25:11Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a423374-4e2a-460b-8c7f-60de375d39ba", "record_id": "flaws_cloudtrail:0000145:a423374-4e2a-460b-8c7f-60de375d39ba", "row_index": 145, "timestamp": "2017-05-26T22:25:11Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 880, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a423374-4e2a-460b-8c7f-60de375d39ba", "eventTime": "2017-05-26T22:25:11Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cfecfd88-afa9-41a0-b9c7-ee00b32612", "record_id": "flaws_cloudtrail:0000146:cfecfd88-afa9-41a0-b9c7-ee00b32612", "row_index": 146, "timestamp": "2017-05-26T22:25:12Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 879, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cfecfd88-afa9-41a0-b9c7-ee00b32612", "eventTime": "2017-05-26T22:25:12Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b4cbe973-6cca-49ad-aef9-193527391408", "record_id": "flaws_cloudtrail:0000147:b4cbe973-6cca-49ad-aef9-193527391408", "row_index": 147, "timestamp": "2017-05-26T22:25:12Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 882, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b4cbe973-6cca-49ad-aef9-193527391408", "eventTime": "2017-05-26T22:25:12Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2138c4ba-45ec-47cd-84b4-dae98563c", "record_id": "flaws_cloudtrail:0000148:2138c4ba-45ec-47cd-84b4-dae98563c", "row_index": 148, "timestamp": "2017-05-26T22:25:12Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 878, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2138c4ba-45ec-47cd-84b4-dae98563c", "eventTime": "2017-05-26T22:25:12Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2aa1c20a-37cd-437c-ac17-7916a4910dcd", "record_id": "flaws_cloudtrail:0000149:2aa1c20a-37cd-437c-ac17-7916a4910dcd", "row_index": 149, "timestamp": "2017-05-26T22:25:13Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 881, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2aa1c20a-37cd-437c-ac17-7916a4910dcd", "eventTime": "2017-05-26T22:25:13Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "68f5b05f-c871-44bc-ae13-8da4c293eea3", "record_id": "flaws_cloudtrail:0000150:68f5b05f-c871-44bc-ae13-8da4c293eea3", "row_index": 150, "timestamp": "2017-05-26T22:25:13Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 879, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "68f5b05f-c871-44bc-ae13-8da4c293eea3", "eventTime": "2017-05-26T22:25:13Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "923849aa0-1859-4b36-b605-6d26074ed3f", "record_id": "flaws_cloudtrail:0000151:923849aa0-1859-4b36-b605-6d26074ed3f", "row_index": 151, "timestamp": "2017-05-26T22:25:13Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 881, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "923849aa0-1859-4b36-b605-6d26074ed3f", "eventTime": "2017-05-26T22:25:13Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9ca704361-6613-4aed-ba2c-45a151c178e0", "record_id": "flaws_cloudtrail:0000152:9ca704361-6613-4aed-ba2c-45a151c178e0", "row_index": 152, "timestamp": "2017-05-26T22:25:14Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 882, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9ca704361-6613-4aed-ba2c-45a151c178e0", "eventTime": "2017-05-26T22:25:14Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a514607-5108-4959-91ca-07e0147423cf", "record_id": "flaws_cloudtrail:0000153:a514607-5108-4959-91ca-07e0147423cf", "row_index": 153, "timestamp": "2017-05-26T22:25:14Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 880, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a514607-5108-4959-91ca-07e0147423cf", "eventTime": "2017-05-26T22:25:14Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e4c83ef3-6ae6-497c-9564-b62821c84b80", "record_id": "flaws_cloudtrail:0000154:e4c83ef3-6ae6-497c-9564-b62821c84b80", "row_index": 154, "timestamp": "2017-05-26T22:25:14Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 877, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e4c83ef3-6ae6-497c-9564-b62821c84b80", "eventTime": "2017-05-26T22:25:14Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "942ef931-08a4-49fe-9ac4-8ce6e84a442a", "record_id": "flaws_cloudtrail:0000155:942ef931-08a4-49fe-9ac4-8ce6e84a442a", "row_index": 155, "timestamp": "2017-05-26T22:25:30Z", "event_type": "ListRoles", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 696, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "942ef931-08a4-49fe-9ac4-8ce6e84a442a", "eventTime": "2017-05-26T22:25:30Z", "eventName": "ListRoles", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "requestParameters": {"maxItems": 1000}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dec07a59-7fc4-43ce-ae60-d98df20a8bb4", "record_id": "flaws_cloudtrail:0000156:dec07a59-7fc4-43ce-ae60-d98df20a8bb4", "row_index": 156, "timestamp": "2017-05-26T22:25:30Z", "event_type": "ListRolePolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 706, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dec07a59-7fc4-43ce-ae60-d98df20a8bb4", "eventTime": "2017-05-26T22:25:30Z", "eventName": "ListRolePolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "requestParameters": {"roleName": "flaws"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d46134cd-8665-48ac-8dbe-28b7edf85b8f", "record_id": "flaws_cloudtrail:0000157:d46134cd-8665-48ac-8dbe-28b7edf85b8f", "row_index": 157, "timestamp": "2017-05-26T22:25:30Z", "event_type": "ListRolePolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 707, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d46134cd-8665-48ac-8dbe-28b7edf85b8f", "eventTime": "2017-05-26T22:25:30Z", "eventName": "ListRolePolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "requestParameters": {"roleName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bd7bbc66-323a-49ce-8b8b-05621a424eec", "record_id": "flaws_cloudtrail:0000158:bd7bbc66-323a-49ce-8b8b-05621a424eec", "row_index": 158, "timestamp": "2017-05-26T22:25:30Z", "event_type": "ListInstanceProfilesForRole", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 718, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bd7bbc66-323a-49ce-8b8b-05621a424eec", "eventTime": "2017-05-26T22:25:30Z", "eventName": "ListInstanceProfilesForRole", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "requestParameters": {"roleName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1b303bc6-c3b7-481b-b146-550172cec5dfe", "record_id": "flaws_cloudtrail:0000159:1b303bc6-c3b7-481b-b146-550172cec5dfe", "row_index": 159, "timestamp": "2017-05-26T22:25:30Z", "event_type": "ListRolePolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 716, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1b303bc6-c3b7-481b-b146-550172cec5dfe", "eventTime": "2017-05-26T22:25:30Z", "eventName": "ListRolePolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "requestParameters": {"roleName": "SecurityMonkey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0c3fff1f-e5cc-46b7-9c8f-d7a3d701e8d8", "record_id": "flaws_cloudtrail:0000160:0c3fff1f-e5cc-46b7-9c8f-d7a3d701e8d8", "row_index": 160, "timestamp": "2017-05-26T22:25:30Z", "event_type": "ListInstanceProfilesForRole", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 717, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0c3fff1f-e5cc-46b7-9c8f-d7a3d701e8d8", "eventTime": "2017-05-26T22:25:30Z", "eventName": "ListInstanceProfilesForRole", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "requestParameters": {"roleName": "flaws"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1129c5dd-f049-4e4d-9431-00c529bd06fc", "record_id": "flaws_cloudtrail:0000161:1129c5dd-f049-4e4d-9431-00c529bd06fc", "row_index": 161, "timestamp": "2017-05-26T22:25:31Z", "event_type": "ListInstanceProfilesForRole", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 726, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1129c5dd-f049-4e4d-9431-00c529bd06fc", "eventTime": "2017-05-26T22:25:31Z", "eventName": "ListInstanceProfilesForRole", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "requestParameters": {"roleName": "SecurityMonkey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7ab41a83-5176-4db2-9feb-863306b7aecc", "record_id": "flaws_cloudtrail:0000162:7ab41a83-5176-4db2-9feb-863306b7aecc", "row_index": 162, "timestamp": "2017-05-26T22:25:32Z", "event_type": "ListAttachedRolePolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 723, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7ab41a83-5176-4db2-9feb-863306b7aecc", "eventTime": "2017-05-26T22:25:32Z", "eventName": "ListAttachedRolePolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "requestParameters": {"roleName": "SecurityMonkey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "360e0db2-44b0-4fc8-9ca3-20305fdac3a6", "record_id": "flaws_cloudtrail:0000163:360e0db2-44b0-4fc8-9ca3-20305fdac3a6", "row_index": 163, "timestamp": "2017-05-26T22:26:08Z", "event_type": "UpdateAssumeRolePolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1059, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "360e0db2-44b0-4fc8-9ca3-20305fdac3a6", "eventTime": "2017-05-26T22:26:08Z", "eventName": "UpdateAssumeRolePolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "requestParameters": {"policyDocument": "{\r\n  \"Version\": \"2008-10-17\",\r\n  \"Statement\": [\r\n    {\r\n      \"Sid\": \"\",\r\n      \"Effect\": \"Allow\",\r\n      \"Principal\": {\r\n        \"AWS\": [\r\n          \"arn:aws:iam::811596193553:user/SecurityMokey\"\r\n        ]\r\n      },\r\n      \"Action\": \"sts:AssumeRole\"\r\n    }\r\n  ]\r\n}", "roleName": "SecurityMonkey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3d9f8e6a-1301-456a-9636-01ec5d12f965", "record_id": "flaws_cloudtrail:0000164:3d9f8e6a-1301-456a-9636-01ec5d12f965", "row_index": 164, "timestamp": "2017-05-26T22:26:08Z", "event_type": "GetRole", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 706, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3d9f8e6a-1301-456a-9636-01ec5d12f965", "eventTime": "2017-05-26T22:26:08Z", "eventName": "GetRole", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "requestParameters": {"roleName": "SecurityMonkey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ded257a8-b196-494d-add0-766ca0042e01", "record_id": "flaws_cloudtrail:0000165:ded257a8-b196-494d-add0-766ca0042e01", "row_index": 165, "timestamp": "2017-05-26T22:26:48Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1455, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ded257a8-b196-494d-add0-766ca0042e01", "eventTime": "2017-05-26T22:26:48Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIA5WJHBQCM0SMQ789W", "expiration": "May 26, 2017 11:26:48 PM", "sessionToken": "FQoDYXdzECAaDEtQTouPVhwzMFF1aCLMAVfQVZaGkjC7h/SRnyU5p5N5/iJan+x7D2KFHOikdaOkiJEmueuexq0mOKyiFQdNOz4WiuNvCK409681yvm++15A54vyavtGjM8MHOu+KUlbpG7Ijkb+oIRl9EnXMu6O0DQt7Fk38pFpsqeBsBZhNEdz2Dhz98JBCqEvZv9DxGJJKLrPnG0LgWOA0S50I/XxKchbs4cxrw2wPQyFDwefb7aGS9r/7/4BqsIzzdNQ3LhHSwlslHwIma+AIMW6RhYp/Eo6Pk5uD3g87hWdiCyio16LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a1e56d13-f4e1-4bb7-8ece-74cea2117b98", "record_id": "flaws_cloudtrail:0000166:a1e56d13-f4e1-4bb7-8ece-74cea2117b98", "row_index": 166, "timestamp": "2017-05-26T22:26:48Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 881, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a1e56d13-f4e1-4bb7-8ece-74cea2117b98", "eventTime": "2017-05-26T22:26:48Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "69bd873e-0073-4cb7-9b3c-da60bfa3f49a", "record_id": "flaws_cloudtrail:0000167:69bd873e-0073-4cb7-9b3c-da60bfa3f49a", "row_index": 167, "timestamp": "2017-05-26T22:26:49Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "69bd873e-0073-4cb7-9b3c-da60bfa3f49a", "eventTime": "2017-05-26T22:26:49Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAY8WU35Q74XAXKZYV", "expiration": "May 26, 2017 11:26:49 PM", "sessionToken": "FQoDYXdzECAaDEizGI60aMZQ63Z4/iLMAW/b8FbdG0Efkj1qHUl9ojmqSLn0OOB4wVG5tqXaaNSTuaeui61xQgIZO4g+LLX4eqwvEi2o2H/0lOr9hs5zBUdTytH0U03C3Z7oYg5JNHZTMzLw8D2dl4nXthQMgp8yU9tJrKCpBd8XkiOQscm1QT+WIv2/Hq2500Wjug2HGY5DvTaKd43nOlDTCcQXlfBHbvHaUwbpLqECTiNYcs53NFDHLllv07crT8L109c+oJLwYYLfhguXSf4vMwc6yESSHe+REoki5Tyy0J+4piip16LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "100253c5-becb-4b3c-b467-f9e32bd86f08", "record_id": "flaws_cloudtrail:0000168:100253c5-becb-4b3c-b467-f9e32bd86f08", "row_index": 168, "timestamp": "2017-05-26T22:26:49Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1452, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "100253c5-becb-4b3c-b467-f9e32bd86f08", "eventTime": "2017-05-26T22:26:49Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAWX1ZX5MM5ODUIYB8", "expiration": "May 26, 2017 11:26:49 PM", "sessionToken": "FQoDYXdzECAaDGGCa0xQkylqjjYB3yLMAcZON0hzvO+JxvJbYbF4cIo84FbTl0tbNcnH27T1cTGoP+SsF94hFJUTOSIp3G2BzsiSv81MR7T7GgLIsxA2SkzMC0jER6/bmHOzLmEDUneS6mnLiqHPnUxniogi0BobYOsOJuTq9Kbof3BazZqwYonZUru7feFOdgzRQUxs4/FIU/TuNnZqPv4x6yWFSwB12KT8NacB4uhmAqo9+RAc67U5aDwp/lx8KRKVjd+ovjTKNahKsuEggimGpYo/BElrFlWGKb9XzyF69boewSip16LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "37104d-7a79-484c-bd58-92fffd33cd5a", "record_id": "flaws_cloudtrail:0000169:37104d-7a79-484c-bd58-92fffd33cd5a", "row_index": 169, "timestamp": "2017-05-26T22:26:49Z", "event_type": "GetTrailStatus", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA5WJHBQCM0SMQ789W", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1040, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "37104d-7a79-484c-bd58-92fffd33cd5a", "eventTime": "2017-05-26T22:26:49Z", "eventName": "GetTrailStatus", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-west-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA5WJHBQCM0SMQ789W", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:26:48Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"name": "arn:aws:cloudtrail:us-west-2:811596193553:trail/cloudtrail"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "17b2c696-c0b3-4e32-aada-58ea29dedb0f", "record_id": "flaws_cloudtrail:0000170:17b2c696-c0b3-4e32-aada-58ea29dedb0f", "row_index": 170, "timestamp": "2017-05-26T22:26:49Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA5WJHBQCM0SMQ789W", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 977, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "17b2c696-c0b3-4e32-aada-58ea29dedb0f", "eventTime": "2017-05-26T22:26:49Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-west-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA5WJHBQCM0SMQ789W", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:26:48Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e9e421b1-ed66-49cf-8fff-9489e772722f", "record_id": "flaws_cloudtrail:0000171:e9e421b1-ed66-49cf-8fff-9489e772722f", "row_index": 171, "timestamp": "2017-05-26T22:26:50Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAY8WU35Q74XAXKZYV", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1068, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e9e421b1-ed66-49cf-8fff-9489e772722f", "eventTime": "2017-05-26T22:26:50Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAY8WU35Q74XAXKZYV", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:26:49Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"snapshotSet": {}, "ownersSet": {"items": [{"owner": "self"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "07dfd505-618d-45f8-a100-85fa5a0887bc", "record_id": "flaws_cloudtrail:0000172:07dfd505-618d-45f8-a100-85fa5a0887bc", "row_index": 172, "timestamp": "2017-05-26T22:26:50Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAWX1ZX5MM5ODUIYB8", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 977, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "07dfd505-618d-45f8-a100-85fa5a0887bc", "eventTime": "2017-05-26T22:26:50Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAWX1ZX5MM5ODUIYB8", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:26:49Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "526201fa-ad76-404f-a93a-1975ba04a20b", "record_id": "flaws_cloudtrail:0000173:526201fa-ad76-404f-a93a-1975ba04a20b", "row_index": 173, "timestamp": "2017-05-26T22:26:50Z", "event_type": "GetTrailStatus", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAWX1ZX5MM5ODUIYB8", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1042, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "526201fa-ad76-404f-a93a-1975ba04a20b", "eventTime": "2017-05-26T22:26:50Z", "eventName": "GetTrailStatus", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAWX1ZX5MM5ODUIYB8", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:26:49Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"name": "arn:aws:cloudtrail:us-west-2:811596193553:trail/cloudtrail"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fea0c80e-d068-4d32-9f2b-15d621874799", "record_id": "flaws_cloudtrail:0000174:fea0c80e-d068-4d32-9f2b-15d621874799", "row_index": 174, "timestamp": "2017-05-26T22:26:50Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fea0c80e-d068-4d32-9f2b-15d621874799", "eventTime": "2017-05-26T22:26:50Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIA5WGDYZEW4EHWVP8V", "expiration": "May 26, 2017 11:26:50 PM", "sessionToken": "FQoDYXdzECAaDAIGNdr7fznTiLZFIiLMAeZErjjFTESazRjFLsjnnVthwRt2KTDFLO79FHPfUGipR55ZXDHBsTlhWZUqFs2/jyrf7rWealn/ZeNBlxwC2CobCFi7l0yxb8x6JvBsr9WWiVynk1TFkkYrvmyXxQmAm1cAtjwFhaKVII2yh9FQ1wvKV6dEZPon8Z9+OGufqxiYGCPksGHV6c9yQk57zVidamgsLPQ7o+hyzU6RFKuF8k0WWc4GMrHd6wj/xRidFVX2CB8dxDEAxRBsRkE0x9w/4o0Tp+6g4GaWqol9Syiq16LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4dd0f910-1bac-44e7-9421-dfdf6bed96f5", "record_id": "flaws_cloudtrail:0000175:4dd0f910-1bac-44e7-9421-dfdf6bed96f5", "row_index": 175, "timestamp": "2017-05-26T22:26:51Z", "event_type": "GetTrailStatus", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA5WGDYZEW4EHWVP8V", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1046, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4dd0f910-1bac-44e7-9421-dfdf6bed96f5", "eventTime": "2017-05-26T22:26:51Z", "eventName": "GetTrailStatus", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA5WGDYZEW4EHWVP8V", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:26:50Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"name": "arn:aws:cloudtrail:us-west-2:811596193553:trail/cloudtrail"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f1e167161-9a82-41fd-9940-0099b0265c5e", "record_id": "flaws_cloudtrail:0000176:f1e167161-9a82-41fd-9940-0099b0265c5e", "row_index": 176, "timestamp": "2017-05-26T22:26:51Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA5WGDYZEW4EHWVP8V", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 983, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f1e167161-9a82-41fd-9940-0099b0265c5e", "eventTime": "2017-05-26T22:26:51Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA5WGDYZEW4EHWVP8V", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:26:50Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "83ec1d02-dca1-45d1-8a48-12313fd32fba", "record_id": "flaws_cloudtrail:0000177:83ec1d02-dca1-45d1-8a48-12313fd32fba", "row_index": 177, "timestamp": "2017-05-26T22:26:51Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAY8WU35Q74XAXKZYV", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1068, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "83ec1d02-dca1-45d1-8a48-12313fd32fba", "eventTime": "2017-05-26T22:26:51Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAY8WU35Q74XAXKZYV", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:26:49Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"snapshotSet": {}, "ownersSet": {"items": [{"owner": "self"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2caf5c83-84d9-4ce1-a758-5cade8250f47", "record_id": "flaws_cloudtrail:0000178:2caf5c83-84d9-4ce1-a758-5cade8250f47", "row_index": 178, "timestamp": "2017-05-26T22:26:52Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2caf5c83-84d9-4ce1-a758-5cade8250f47", "eventTime": "2017-05-26T22:26:52Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAHVW53L2RAKMS0SSE", "expiration": "May 26, 2017 11:26:52 PM", "sessionToken": "FQoDYXdzECAaDPTkr6ojnZUbvMLrcCLMAbv2zjRqJipiQcYq1nwsYB6vWJELcIKaBpcnSCdWXbU3b+C5r5nXhpLyuNzyMbMMRK3G9Qb24swdE9+g969SoyQcsRAalZWjZC4QmRvupqQOeMp5lSv6lp6RYQLCbt9xq2RQ/aA+LgJr8dvdXk/xZGntgiUA90RPW54MMdJ9/2g7+pFmLiD9Bh2sHWLkQ1NH5xKvs+dAl2BvaWHIN5AVcQKO1JfttbtFLyzxbVV2HzKCh/eyaL4UcIXYF/oqxEzJmsfFn7YZ2aT+hvhtPyis16LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8b357cd1-fd7f-4a1b-a2c8-293372bf9d42", "record_id": "flaws_cloudtrail:0000179:8b357cd1-fd7f-4a1b-a2c8-293372bf9d42", "row_index": 179, "timestamp": "2017-05-26T22:26:53Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAY8WU35Q74XAXKZYV", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8b357cd1-fd7f-4a1b-a2c8-293372bf9d42", "eventTime": "2017-05-26T22:26:53Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-south-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAY8WU35Q74XAXKZYV", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:26:49Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"snapshotSet": {}, "ownersSet": {"items": [{"owner": "self"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e0fc4e82-67c0-4d86-8571-087c2a65a561", "record_id": "flaws_cloudtrail:0000180:e0fc4e82-67c0-4d86-8571-087c2a65a561", "row_index": 180, "timestamp": "2017-05-26T22:26:53Z", "event_type": "GetTrailStatus", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAHVW53L2RAKMS0SSE", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1047, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e0fc4e82-67c0-4d86-8571-087c2a65a561", "eventTime": "2017-05-26T22:26:53Z", "eventName": "GetTrailStatus", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAHVW53L2RAKMS0SSE", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:26:52Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"name": "arn:aws:cloudtrail:us-west-2:811596193553:trail/cloudtrail"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "951580f9-3ad8-4fd9-81cd-66ca4745aa5e", "record_id": "flaws_cloudtrail:0000181:951580f9-3ad8-4fd9-81cd-66ca4745aa5e", "row_index": 181, "timestamp": "2017-05-26T22:26:53Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAHVW53L2RAKMS0SSE", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 982, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "951580f9-3ad8-4fd9-81cd-66ca4745aa5e", "eventTime": "2017-05-26T22:26:53Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAHVW53L2RAKMS0SSE", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:26:52Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "58b14ae4-367d-4045-a14b-edca09177e08", "record_id": "flaws_cloudtrail:0000182:58b14ae4-367d-4045-a14b-edca09177e08", "row_index": 182, "timestamp": "2017-05-26T22:26:53Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "58b14ae4-367d-4045-a14b-edca09177e08", "eventTime": "2017-05-26T22:26:53Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAM12P7LD79L1RBPL5", "expiration": "May 26, 2017 11:26:53 PM", "sessionToken": "FQoDYXdzECAaDDP3zE3OFci1exX1ZCLMAWQL6hJsngIi0TW3GFaEa/W6Stg+g+aBMc2rbKVU5PKWM6IyamUxijKn3Zt58nWqpGD4smGxnGwllOeCZ/fXEQmswV+/YqxpCjswjLHgN9RO9iU24wnbVIladB/U041jnelb9oRjNTrkJZrT5fdUMuxkZ8xjkdFXpXPE/8rkURtRtXiJ7+OpyWPtCJe+NI6pYcrXOD217g4yrY+6DK8ew06ru2i8ZcM2wp+jqSwLybHO6WqBbh8Lwq14Zg38FYcO054d0kexIr5Xr3HHISit16LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5b6bf0c2-933d-4f88-83af-b40dfbeaedba", "record_id": "flaws_cloudtrail:0000183:5b6bf0c2-933d-4f88-83af-b40dfbeaedba", "row_index": 183, "timestamp": "2017-05-26T22:26:54Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAY8WU35Q74XAXKZYV", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1068, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5b6bf0c2-933d-4f88-83af-b40dfbeaedba", "eventTime": "2017-05-26T22:26:54Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAY8WU35Q74XAXKZYV", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:26:49Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"snapshotSet": {}, "ownersSet": {"items": [{"owner": "self"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7a1a1aae-69dd-4a58-a3c0-8f800bbd02ce", "record_id": "flaws_cloudtrail:0000184:7a1a1aae-69dd-4a58-a3c0-8f800bbd02ce", "row_index": 184, "timestamp": "2017-05-26T22:26:54Z", "event_type": "GetTrailStatus", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAM12P7LD79L1RBPL5", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1044, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7a1a1aae-69dd-4a58-a3c0-8f800bbd02ce", "eventTime": "2017-05-26T22:26:54Z", "eventName": "GetTrailStatus", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "sa-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAM12P7LD79L1RBPL5", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:26:53Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"name": "arn:aws:cloudtrail:us-west-2:811596193553:trail/cloudtrail"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1c42b3b1-385e-41cd-a720-e63a1764dbff", "record_id": "flaws_cloudtrail:0000185:1c42b3b1-385e-41cd-a720-e63a1764dbff", "row_index": 185, "timestamp": "2017-05-26T22:26:54Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAM12P7LD79L1RBPL5", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 979, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1c42b3b1-385e-41cd-a720-e63a1764dbff", "eventTime": "2017-05-26T22:26:54Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "sa-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAM12P7LD79L1RBPL5", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:26:53Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6aea1ec6-94f7-4431-81b5-77e1ca747f2b", "record_id": "flaws_cloudtrail:0000186:6aea1ec6-94f7-4431-81b5-77e1ca747f2b", "row_index": 186, "timestamp": "2017-05-26T22:26:55Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAY8WU35Q74XAXKZYV", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1068, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6aea1ec6-94f7-4431-81b5-77e1ca747f2b", "eventTime": "2017-05-26T22:26:55Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAY8WU35Q74XAXKZYV", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:26:49Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"snapshotSet": {}, "ownersSet": {"items": [{"owner": "self"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1a16a15b-0f8f-44e7-8768-91b06512ff8", "record_id": "flaws_cloudtrail:0000187:1a16a15b-0f8f-44e7-8768-91b06512ff8", "row_index": 187, "timestamp": "2017-05-26T22:26:55Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAY8WU35Q74XAXKZYV", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1065, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1a16a15b-0f8f-44e7-8768-91b06512ff8", "eventTime": "2017-05-26T22:26:55Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ca-central-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAY8WU35Q74XAXKZYV", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:26:49Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"snapshotSet": {}, "ownersSet": {"items": [{"owner": "self"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b55f5bdb-aebc-4b54-8d06-c733e3747e76", "record_id": "flaws_cloudtrail:0000188:b55f5bdb-aebc-4b54-8d06-c733e3747e76", "row_index": 188, "timestamp": "2017-05-26T22:26:55Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1449, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b55f5bdb-aebc-4b54-8d06-c733e3747e76", "eventTime": "2017-05-26T22:26:55Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIA638DPK359SHLVZ4O", "expiration": "May 26, 2017 11:26:55 PM", "sessionToken": "FQoDYXdzECAaDOZJvDoZmIB+X0ltzyLMASeiMkIVtZ+jObE5zVUrb8xyOjJVCT3F4In15rZLKCu2OGyeTAa7LRRbqs4EzSkv9iFExnmpkTs3h4wFlaGqbUXRrFfViCFBI580rNwz5Ap7VX6+8VvioxSfMq+PNdix5gMXKOyZg/6YprxgTgc/FQj9c2QC8zB3KHe8p9xyGVK5aIxgdtOmEJ2f1GoDmCf77xv+mT9bQXxACOnHdtTdv/hFbJc5Axu+/woymRNBNHefs0IqT0KYbq8wFSkbJe0HOaCrztCyCOH6i3qh4iiv16LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ceea561b-0e2f-44b5-a683-e81f87e2c8d2", "record_id": "flaws_cloudtrail:0000189:ceea561b-0e2f-44b5-a683-e81f87e2c8d2", "row_index": 189, "timestamp": "2017-05-26T22:26:56Z", "event_type": "GetTrailStatus", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA638DPK359SHLVZ4O", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1047, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ceea561b-0e2f-44b5-a683-e81f87e2c8d2", "eventTime": "2017-05-26T22:26:56Z", "eventName": "GetTrailStatus", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA638DPK359SHLVZ4O", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:26:55Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"name": "arn:aws:cloudtrail:us-west-2:811596193553:trail/cloudtrail"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d9796c57-d861-40a7-886c-5ddaa4ba2ff0", "record_id": "flaws_cloudtrail:0000190:d9796c57-d861-40a7-886c-5ddaa4ba2ff0", "row_index": 190, "timestamp": "2017-05-26T22:26:56Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA638DPK359SHLVZ4O", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 982, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d9796c57-d861-40a7-886c-5ddaa4ba2ff0", "eventTime": "2017-05-26T22:26:56Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA638DPK359SHLVZ4O", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:26:55Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b652a7f8-357b-4dde-a322-15ca4a3feea2", "record_id": "flaws_cloudtrail:0000191:b652a7f8-357b-4dde-a322-15ca4a3feea2", "row_index": 191, "timestamp": "2017-05-26T22:26:56Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAY8WU35Q74XAXKZYV", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b652a7f8-357b-4dde-a322-15ca4a3feea2", "eventTime": "2017-05-26T22:26:56Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "eu-central-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAY8WU35Q74XAXKZYV", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:26:49Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"snapshotSet": {}, "ownersSet": {"items": [{"owner": "self"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a2db2cc9-8956-402d-91fc-0c70318fd0d8", "record_id": "flaws_cloudtrail:0000192:a2db2cc9-8956-402d-91fc-0c70318fd0d8", "row_index": 192, "timestamp": "2017-05-26T22:26:56Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 881, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a2db2cc9-8956-402d-91fc-0c70318fd0d8", "eventTime": "2017-05-26T22:26:56Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1a243eb4-f90a-4082-988f-218a1764db0d", "record_id": "flaws_cloudtrail:0000193:1a243eb4-f90a-4082-988f-218a1764db0d", "row_index": 193, "timestamp": "2017-05-26T22:26:57Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAY8WU35Q74XAXKZYV", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1063, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1a243eb4-f90a-4082-988f-218a1764db0d", "eventTime": "2017-05-26T22:26:57Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "eu-west-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAY8WU35Q74XAXKZYV", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:26:49Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"snapshotSet": {}, "ownersSet": {"items": [{"owner": "self"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1db2a844-de5e-4506-8175-c60905b81d4", "record_id": "flaws_cloudtrail:0000194:1db2a844-de5e-4506-8175-c60905b81d4", "row_index": 194, "timestamp": "2017-05-26T22:26:57Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1453, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1db2a844-de5e-4506-8175-c60905b81d4", "eventTime": "2017-05-26T22:26:57Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIA7PGE2G04XNQ1PLEU", "expiration": "May 26, 2017 11:26:57 PM", "sessionToken": "FQoDYXdzECAaDDRMNIVxU3KnqR/uZSLMAfK9SzU00lDwCYz52PUkpQsyNSfMGYFBzrEypvh2R6r7wstLzDymX6qkfXqw+vjWwxm6URq/MU1uFhz2ONUqpYKyE/zyAqqyfpIf58UAwqztuJWJXufpYCLPKxN7QZ0hmxCpAcA8Brubw1beexsL/JRMQncRCOc7mmQacH8U5djeenH7Dwv3ca1YnASyU4EjuWAWaDebQSJw95wI3Il+Dw+W6gky1I4lmp4lz2fnmN71s9LAPtom+qObhrCeKX7b/afwRKlGOB2tz4KYNSix16LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6e00215f-9a71-4e27-88ac-b834e915aa29", "record_id": "flaws_cloudtrail:0000195:6e00215f-9a71-4e27-88ac-b834e915aa29", "row_index": 195, "timestamp": "2017-05-26T22:26:58Z", "event_type": "GetTrailStatus", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA7PGE2G04XNQ1PLEU", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1047, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6e00215f-9a71-4e27-88ac-b834e915aa29", "eventTime": "2017-05-26T22:26:58Z", "eventName": "GetTrailStatus", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA7PGE2G04XNQ1PLEU", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:26:57Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"name": "arn:aws:cloudtrail:us-west-2:811596193553:trail/cloudtrail"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4763d4c8-b5f1-4251-b7c9-0df1f6b53186", "record_id": "flaws_cloudtrail:0000196:4763d4c8-b5f1-4251-b7c9-0df1f6b53186", "row_index": 196, "timestamp": "2017-05-26T22:26:58Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA7PGE2G04XNQ1PLEU", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 982, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4763d4c8-b5f1-4251-b7c9-0df1f6b53186", "eventTime": "2017-05-26T22:26:58Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA7PGE2G04XNQ1PLEU", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:26:57Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1b5cf0bc-8c9e-48b5-95c3-c947cedff753", "record_id": "flaws_cloudtrail:0000197:1b5cf0bc-8c9e-48b5-95c3-c947cedff753", "row_index": 197, "timestamp": "2017-05-26T22:26:58Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAY8WU35Q74XAXKZYV", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1064, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1b5cf0bc-8c9e-48b5-95c3-c947cedff753", "eventTime": "2017-05-26T22:26:58Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "eu-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAY8WU35Q74XAXKZYV", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:26:49Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"snapshotSet": {}, "ownersSet": {"items": [{"owner": "self"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8790cf9f-2898-44c7-873c-75e8c95b748b", "record_id": "flaws_cloudtrail:0000198:8790cf9f-2898-44c7-873c-75e8c95b748b", "row_index": 198, "timestamp": "2017-05-26T22:26:59Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAY8WU35Q74XAXKZYV", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1063, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8790cf9f-2898-44c7-873c-75e8c95b748b", "eventTime": "2017-05-26T22:26:59Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "sa-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAY8WU35Q74XAXKZYV", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:26:49Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"snapshotSet": {}, "ownersSet": {"items": [{"owner": "self"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3fe90434-3bb0-4c53-beb7-5ab6b46ee7df", "record_id": "flaws_cloudtrail:0000199:3fe90434-3bb0-4c53-beb7-5ab6b46ee7df", "row_index": 199, "timestamp": "2017-05-26T22:26:59Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 881, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3fe90434-3bb0-4c53-beb7-5ab6b46ee7df", "eventTime": "2017-05-26T22:26:59Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b361df47-02d5-4c39-a6ef-b764de3bf21d", "record_id": "flaws_cloudtrail:0000200:b361df47-02d5-4c39-a6ef-b764de3bf21d", "row_index": 200, "timestamp": "2017-05-26T22:26:59Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b361df47-02d5-4c39-a6ef-b764de3bf21d", "eventTime": "2017-05-26T22:26:59Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAWXEN3Q56VRW2QGGX", "expiration": "May 26, 2017 11:26:59 PM", "sessionToken": "FQoDYXdzECAaDOxqBn0TVWz5i9DlkiLMAc9eCKwAjmZYYHY/KSkR7Vc8h0BvyyjxaWe6NnjREOsnMgLNy/SUzp3dyCxVxWu/3kqv3By/qzVwYSJYEzzfye6Qn4JJETxDMtPp5dTVagaBS/Zci+WtUFnL1A/32GNgqTZmHnUUbY7KXCKoKngKLaPknxiuvhhOhvWQpa0RC3SQ3xp3769SEEU9Jrb7/N00m4lP27eYLQN/tvxqDEvetsDu18LPnjfWqFZ34IHnjJuQfinnxCc3NeuQo5afhPbEOp5OjttD9w+SFAb4Giiz16LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1b911355-b364-4de2-bc69-167dfc79abe5", "record_id": "flaws_cloudtrail:0000201:1b911355-b364-4de2-bc69-167dfc79abe5", "row_index": 201, "timestamp": "2017-05-26T22:27:00Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAY8WU35Q74XAXKZYV", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1063, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1b911355-b364-4de2-bc69-167dfc79abe5", "eventTime": "2017-05-26T22:27:00Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAY8WU35Q74XAXKZYV", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:26:49Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"snapshotSet": {}, "ownersSet": {"items": [{"owner": "self"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8be885ca-65bc-47ce-b9de-d3ce4441a1d5", "record_id": "flaws_cloudtrail:0000202:8be885ca-65bc-47ce-b9de-d3ce4441a1d5", "row_index": 202, "timestamp": "2017-05-26T22:27:00Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1449, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8be885ca-65bc-47ce-b9de-d3ce4441a1d5", "eventTime": "2017-05-26T22:27:00Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIADCDVET2KY4WTH9T8", "expiration": "May 26, 2017 11:27:00 PM", "sessionToken": "FQoDYXdzECAaDOtGNFN+BeJQ7+IZMSLMAboQvx8qdVgG13uvwx6EuvGQxMoAqJlTHLLNcgOAxwzYDwMCXI2asHB+sk1bsWJAzgL6MLcquUZmcb9wM0n3EkoJ3eDWt2d1rpnveSV6DSDwCWwtpQVCEb9KuINmQKwz7BbaOCABB/ADZnKTAg21uEbubM6K4nKPXhkb/eP9EHGxoQbomWn6f2Zg1nYbp1jPYdjnw6cNUMO9/Wj1ftzURR6z3huLZyFIaSJScqqhihKPzL0St2A2Z0OErQVJ1+2OsOLxSqneeOZD1vd4NSi016LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2d495120b-922e-4faf-8608-dd38321c786", "record_id": "flaws_cloudtrail:0000203:2d495120b-922e-4faf-8608-dd38321c786", "row_index": 203, "timestamp": "2017-05-26T22:27:00Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAY8WU35Q74XAXKZYV", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1063, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2d495120b-922e-4faf-8608-dd38321c786", "eventTime": "2017-05-26T22:27:00Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAY8WU35Q74XAXKZYV", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:26:49Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"snapshotSet": {}, "ownersSet": {"items": [{"owner": "self"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "966753fc0-6384-48e8-ab56-ba43972efbff", "record_id": "flaws_cloudtrail:0000204:966753fc0-6384-48e8-ab56-ba43972efbff", "row_index": 204, "timestamp": "2017-05-26T22:27:01Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1455, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "966753fc0-6384-48e8-ab56-ba43972efbff", "eventTime": "2017-05-26T22:27:01Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIA9TRBIUH70SU73DUX", "expiration": "May 26, 2017 11:27:01 PM", "sessionToken": "FQoDYXdzECAaDAy2FaHdQiV0hOOwfyLMAVkKM6Hd/0xON5FS8+6WukG1aV45H+SJunqnOIE+50yeMSXSSlxjnxOeQLfZO1bna6MEXGN6XRnV50ojIfLsWjvfdSDVBFu+sbPa/vPLQTgdk6RhFfYyjbFWz+iAWzArG+Ev+brT5nkibANFT+kLfntqwrDn3ZVdiR8nB+x56mAM3occ4LxXUP2rJcZp6EyiI5xHd3DLULmBCIIBI+GDhbO2lIKhVXX0E9GbiOcCDdYmO6SYnsZA66jqWJ08S30N2vcAotb9yk6go12spCi116LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b0b28fab-ea0b-4dff-b493-2f13b7231dc4", "record_id": "flaws_cloudtrail:0000205:b0b28fab-ea0b-4dff-b493-2f13b7231dc4", "row_index": 205, "timestamp": "2017-05-26T22:27:01Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAY8WU35Q74XAXKZYV", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1060, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b0b28fab-ea0b-4dff-b493-2f13b7231dc4", "eventTime": "2017-05-26T22:27:01Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-west-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAY8WU35Q74XAXKZYV", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:26:49Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"snapshotSet": {}, "ownersSet": {"items": [{"owner": "self"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e9eda9d3-771f-4c8f-bd95-3421c091855dd", "record_id": "flaws_cloudtrail:0000206:e9eda9d3-771f-4c8f-bd95-3421c091855dd", "row_index": 206, "timestamp": "2017-05-26T22:27:01Z", "event_type": "GetTrailStatus", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIADCDVET2KY4WTH9T8", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1044, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e9eda9d3-771f-4c8f-bd95-3421c091855dd", "eventTime": "2017-05-26T22:27:01Z", "eventName": "GetTrailStatus", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIADCDVET2KY4WTH9T8", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:00Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"name": "arn:aws:cloudtrail:us-west-2:811596193553:trail/cloudtrail"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "aadcddb8-b39f-4506-b679-e90584e42", "record_id": "flaws_cloudtrail:0000207:aadcddb8-b39f-4506-b679-e90584e42", "row_index": 207, "timestamp": "2017-05-26T22:27:01Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIADCDVET2KY4WTH9T8", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 974, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "aadcddb8-b39f-4506-b679-e90584e42", "eventTime": "2017-05-26T22:27:01Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIADCDVET2KY4WTH9T8", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:00Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cc02b7e7-8567-45ca-bdc3-9c896c9db930", "record_id": "flaws_cloudtrail:0000208:cc02b7e7-8567-45ca-bdc3-9c896c9db930", "row_index": 208, "timestamp": "2017-05-26T22:27:01Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAY8WU35Q74XAXKZYV", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1063, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cc02b7e7-8567-45ca-bdc3-9c896c9db930", "eventTime": "2017-05-26T22:27:01Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAY8WU35Q74XAXKZYV", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:26:49Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"snapshotSet": {}, "ownersSet": {"items": [{"owner": "self"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "89ff5eb6-e303-47aa-aec1-0509d6505aa7", "record_id": "flaws_cloudtrail:0000209:89ff5eb6-e303-47aa-aec1-0509d6505aa7", "row_index": 209, "timestamp": "2017-05-26T22:27:02Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 881, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "89ff5eb6-e303-47aa-aec1-0509d6505aa7", "eventTime": "2017-05-26T22:27:02Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e54e6774-288d-4a7e-ad5b-35c5b6439d81", "record_id": "flaws_cloudtrail:0000210:e54e6774-288d-4a7e-ad5b-35c5b6439d81", "row_index": 210, "timestamp": "2017-05-26T22:27:02Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e54e6774-288d-4a7e-ad5b-35c5b6439d81", "eventTime": "2017-05-26T22:27:02Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAIC6B02BW84DZYW36", "expiration": "May 26, 2017 11:27:02 PM", "sessionToken": "FQoDYXdzECAaDO3IsEY7bLPfJGzWMyLMAV16ZlArq/H8mZoIdpL2Yb6YbOaGXjYbg3LGROpXHd5r1WdkSkeQ6IASTbBEErHAY8VHtpx/z9ufydznHOUW+Wp8no+UIb4HsNiO5KhwRA7X10nUzOALupBd+VD+upIbtxh+uQq2GOdl2uubUvv+0USWMkfU8tOJ2N8otX4xqPbiINzX4WegQ8HV0ZF+kTbjf6pTWAMTwcKtLEJts+mSxKx4aE0l24AiELVfcpQLBHXY3rallnTuCPJdkuFjjjn9dxU0Pa0FG+hzMF0m3Ci216LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "303af5bb-05be-4cb5-92a6-9386b99acf3e", "record_id": "flaws_cloudtrail:0000211:303af5bb-05be-4cb5-92a6-9386b99acf3e", "row_index": 211, "timestamp": "2017-05-26T22:27:02Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "303af5bb-05be-4cb5-92a6-9386b99acf3e", "eventTime": "2017-05-26T22:27:02Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAJ738EUFN5ASWNAT1", "expiration": "May 26, 2017 11:27:02 PM", "sessionToken": "FQoDYXdzECAaDIH+TRi1sBxg3BrX8CLMAVpzzjzQua4Q4Hdw/Gc00tu1Pw/+LslVrOn1DizQBsoMeVhpdkGKiHw3mMsC52v+d8sJOHd4bpib5R9TvYDeBj1QPK9mOxRSdckzow/Vdo3DoMr6DTtGoMNqypXrgBZ6AShqhdNWl5ivhbo6YPN/I1ggzGGtIDctScBLaOH0TSs5pxibvuv3bsHHG4EgKw0X7KLFpdNRtSL89X01EjgbrEJtwItdLXGYK7h3BDI9G9x6KqxE/uJ/HKm0BM4jFPdRunldrfGvtAkb2Vex0Ci216LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "96f518320-6066-4840-af6a-a8b582906233", "record_id": "flaws_cloudtrail:0000212:96f518320-6066-4840-af6a-a8b582906233", "row_index": 212, "timestamp": "2017-05-26T22:27:02Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1455, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "96f518320-6066-4840-af6a-a8b582906233", "eventTime": "2017-05-26T22:27:02Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAL5HMC9XZQVTX63ZX", "expiration": "May 26, 2017 11:27:02 PM", "sessionToken": "FQoDYXdzECAaDAixsIsvyebsBCE6ISLMATaZmzzo77XNS09wTTNVWOVS1JO3KWpI04M8Q696C9QiHp5T+YVomiynSxUMvgq8RkPw2cQVKWqgi8dYs0s48i5Obzu6lo6EYWxovKrCzJ62grnJ2GmZel5+CMYOj5vBamShWnks3zh6/2QJm/FE/dO6lR+7HMfUy4hGsF+ThghZEy/96xJPiakaWdfxBjU4ijWlWnx2X+za/05zilaxOivY2GIEywNImK73qJArCP0ewkmyDsaP1e08SAdZpTeudKD8MQjnSzgLqt9C6Ci216LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2e1e8056-34e5-4771-9ccf-15a5cd246edd", "record_id": "flaws_cloudtrail:0000213:2e1e8056-34e5-4771-9ccf-15a5cd246edd", "row_index": 213, "timestamp": "2017-05-26T22:27:02Z", "event_type": "ListVerifiedEmailAddresses", "event_source": "ses.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAIC6B02BW84DZYW36", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto/2.47.0 Python/2.7.12 Linux/4.4.0-78-generic", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1141, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2e1e8056-34e5-4771-9ccf-15a5cd246edd", "eventTime": "2017-05-26T22:27:02Z", "eventName": "ListVerifiedEmailAddresses", "eventSource": "ses.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto/2.47.0 Python/2.7.12 Linux/4.4.0-78-generic", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey is not authorized to perform: ses:ListVerifiedEmailAddresses", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAIC6B02BW84DZYW36", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:02Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a3ad171e-750b-4996-9600-bd909804af103", "record_id": "flaws_cloudtrail:0000214:a3ad171e-750b-4996-9600-bd909804af103", "row_index": 214, "timestamp": "2017-05-26T22:27:02Z", "event_type": "ListIdentities", "event_source": "ses.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAIC6B02BW84DZYW36", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto/2.47.0 Python/2.7.12 Linux/4.4.0-78-generic", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 955, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a3ad171e-750b-4996-9600-bd909804af103", "eventTime": "2017-05-26T22:27:02Z", "eventName": "ListIdentities", "eventSource": "ses.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto/2.47.0 Python/2.7.12 Linux/4.4.0-78-generic", "awsRegion": "us-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAIC6B02BW84DZYW36", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:02Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fb57d787-cf80-4a2b-a8a3-b1f20ea908290", "record_id": "flaws_cloudtrail:0000215:fb57d787-cf80-4a2b-a8a3-b1f20ea908290", "row_index": 215, "timestamp": "2017-05-26T22:27:03Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAJ738EUFN5ASWNAT1", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 980, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fb57d787-cf80-4a2b-a8a3-b1f20ea908290", "eventTime": "2017-05-26T22:27:03Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "eu-central-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAJ738EUFN5ASWNAT1", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:02Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "495908d16-6bc2-4801-8dfe-c854f417f2f1", "record_id": "flaws_cloudtrail:0000216:495908d16-6bc2-4801-8dfe-c854f417f2f1", "row_index": 216, "timestamp": "2017-05-26T22:27:03Z", "event_type": "GetTrailStatus", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAJ738EUFN5ASWNAT1", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1046, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "495908d16-6bc2-4801-8dfe-c854f417f2f1", "eventTime": "2017-05-26T22:27:03Z", "eventName": "GetTrailStatus", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "eu-central-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAJ738EUFN5ASWNAT1", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:02Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"name": "arn:aws:cloudtrail:us-west-2:811596193553:trail/cloudtrail"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b125900f5-e912-460f-b67d-d547f541bdea", "record_id": "flaws_cloudtrail:0000217:b125900f5-e912-460f-b67d-d547f541bdea", "row_index": 217, "timestamp": "2017-05-26T22:27:03Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1455, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b125900f5-e912-460f-b67d-d547f541bdea", "eventTime": "2017-05-26T22:27:03Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAVSRZEF359BGPAJY2", "expiration": "May 26, 2017 11:27:03 PM", "sessionToken": "FQoDYXdzECAaDPQn2rZXRdcdgpVT0CLMAc7yGXN08D9h/HljBJJRASkKGBxb8+TMzmNKELWYJXpnqolpJNNa75HMR2xU2HpGdh7z1hb3YYJ/NvIS5F2bV5eo9GiqfcQzIQ+o28yt1fEs1ZmW921q0MBCWAZ47Zjkrj6H03o9RMLI+8//MkEbOoqbC76aZyCXFJkxUMnatj6/EcV7Roq0BvulITH5iz+kHD2QGsOObbS7+9vE1wkZqJNRfuD4yaW0I9LKIT/CZlVNa2alNiWWdK2JiP6hx6rMB4Eenh000yIoKLwGWSi316LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ccf4b302-eec1-415d-b5d8-1ee74b2fa698", "record_id": "flaws_cloudtrail:0000218:ccf4b302-eec1-415d-b5d8-1ee74b2fa698", "row_index": 218, "timestamp": "2017-05-26T22:27:03Z", "event_type": "ListIdentities", "event_source": "ses.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAL5HMC9XZQVTX63ZX", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto/2.47.0 Python/2.7.12 Linux/4.4.0-78-generic", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 954, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ccf4b302-eec1-415d-b5d8-1ee74b2fa698", "eventTime": "2017-05-26T22:27:03Z", "eventName": "ListIdentities", "eventSource": "ses.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto/2.47.0 Python/2.7.12 Linux/4.4.0-78-generic", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAL5HMC9XZQVTX63ZX", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:02Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7f446fea-5131-4731-bad6-fa03402b2ca5", "record_id": "flaws_cloudtrail:0000219:7f446fea-5131-4731-bad6-fa03402b2ca5", "row_index": 219, "timestamp": "2017-05-26T22:27:03Z", "event_type": "ListVerifiedEmailAddresses", "event_source": "ses.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAL5HMC9XZQVTX63ZX", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto/2.47.0 Python/2.7.12 Linux/4.4.0-78-generic", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1141, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7f446fea-5131-4731-bad6-fa03402b2ca5", "eventTime": "2017-05-26T22:27:03Z", "eventName": "ListVerifiedEmailAddresses", "eventSource": "ses.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto/2.47.0 Python/2.7.12 Linux/4.4.0-78-generic", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey is not authorized to perform: ses:ListVerifiedEmailAddresses", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAL5HMC9XZQVTX63ZX", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:02Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7e7492cb-9969-4b24-8d22-fa972063c50fa", "record_id": "flaws_cloudtrail:0000220:7e7492cb-9969-4b24-8d22-fa972063c50fa", "row_index": 220, "timestamp": "2017-05-26T22:27:04Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAVGEHLDPY2XMM5EYO", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 978, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7e7492cb-9969-4b24-8d22-fa972063c50fa", "eventTime": "2017-05-26T22:27:04Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "eu-west-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAVGEHLDPY2XMM5EYO", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:04Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bb861f0e-9200-44e6-8167-f1080d4b7bbe", "record_id": "flaws_cloudtrail:0000221:bb861f0e-9200-44e6-8167-f1080d4b7bbe", "row_index": 221, "timestamp": "2017-05-26T22:27:04Z", "event_type": "ListVerifiedEmailAddresses", "event_source": "ses.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAVSRZEF359BGPAJY2", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto/2.47.0 Python/2.7.12 Linux/4.4.0-78-generic", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1141, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bb861f0e-9200-44e6-8167-f1080d4b7bbe", "eventTime": "2017-05-26T22:27:04Z", "eventName": "ListVerifiedEmailAddresses", "eventSource": "ses.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto/2.47.0 Python/2.7.12 Linux/4.4.0-78-generic", "awsRegion": "eu-west-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey is not authorized to perform: ses:ListVerifiedEmailAddresses", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAVSRZEF359BGPAJY2", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:03Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8e243613-c208-41f0-ab8f-e815014b3147", "record_id": "flaws_cloudtrail:0000222:8e243613-c208-41f0-ab8f-e815014b3147", "row_index": 222, "timestamp": "2017-05-26T22:27:04Z", "event_type": "ListIdentities", "event_source": "ses.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAVSRZEF359BGPAJY2", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto/2.47.0 Python/2.7.12 Linux/4.4.0-78-generic", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 954, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8e243613-c208-41f0-ab8f-e815014b3147", "eventTime": "2017-05-26T22:27:04Z", "eventName": "ListIdentities", "eventSource": "ses.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto/2.47.0 Python/2.7.12 Linux/4.4.0-78-generic", "awsRegion": "eu-west-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAVSRZEF359BGPAJY2", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:03Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "09031cbb-0a37-4ea6-a870-df5b9d4315eb", "record_id": "flaws_cloudtrail:0000223:09031cbb-0a37-4ea6-a870-df5b9d4315eb", "row_index": 223, "timestamp": "2017-05-26T22:27:04Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "09031cbb-0a37-4ea6-a870-df5b9d4315eb", "eventTime": "2017-05-26T22:27:04Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAVGEHLDPY2XMM5EYO", "expiration": "May 26, 2017 11:27:04 PM", "sessionToken": "FQoDYXdzECAaDDxtc6+FP4k/nNCrQyLMAcutRBwFQWXYXkxWN8LTp0FhIwJS/bxRWUER/aaqVJNWmw1nsR15irnK9sZKfJ0hsNgpe75uuecHkJRBzDCesPVy38R6P1vpXGp1yZS3VwKrFCYDAmWfsSOqQoo8oM6MNNjNZzJ3BazCo1B7avQcjLHLtX0TKDmtkm4zkYDstEPKFyyhroxOJddejcu3e4ZQmbwXYRXJpOQ1RMxbWvVwqOsVVqBPV/w8xeGoPwWHqbt6TD93rz6dy3kdeZymMMtjtcH5Bd+wdl+O1XSCYSi416LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4564bd35-425e-435f-9004-4045bbf327f4", "record_id": "flaws_cloudtrail:0000224:4564bd35-425e-435f-9004-4045bbf327f4", "row_index": 224, "timestamp": "2017-05-26T22:27:04Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4564bd35-425e-435f-9004-4045bbf327f4", "eventTime": "2017-05-26T22:27:04Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAZ5MDZZXVI2GOKBGR", "expiration": "May 26, 2017 11:27:04 PM", "sessionToken": "FQoDYXdzECAaDETcYSkrmAu3aFgoByLMAR3B9AE+2EnmlJ8FjdrceNnnOHlsenF0dgMrhcLrtDEjS4SmaCWwt947f3w11wfWW0+rmau643XRjb+H9gaHbJVTO/6kaYi4hrfRW/wE1sL41aZTeDAR1vf+YyF0bkHn2VqQ+mvOJfUN0KLlYso7FQo+zJ4d2isC/D0CdJbHWWKhxZMY59qqfwj9pMr8CoFLhNJ/hb8hWCetHsmX7dMQTdyZXPxAmE0XfVaidy64lNMMiU4IpqXcpQ0kjvthYX+MmnFCpk50Ypji4YmqLSi416LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cd8d1d8e-8993-4da2-8362-0a73666f7c60", "record_id": "flaws_cloudtrail:0000225:cd8d1d8e-8993-4da2-8362-0a73666f7c60", "row_index": 225, "timestamp": "2017-05-26T22:27:05Z", "event_type": "GetTrailStatus", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAVGEHLDPY2XMM5EYO", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1042, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cd8d1d8e-8993-4da2-8362-0a73666f7c60", "eventTime": "2017-05-26T22:27:05Z", "eventName": "GetTrailStatus", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "eu-west-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAVGEHLDPY2XMM5EYO", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:04Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"name": "arn:aws:cloudtrail:us-west-2:811596193553:trail/cloudtrail"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "37ea230b-6e9c-4fa1-a8fc-af9f35f430fc", "record_id": "flaws_cloudtrail:0000226:37ea230b-6e9c-4fa1-a8fc-af9f35f430fc", "row_index": 226, "timestamp": "2017-05-26T22:27:05Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 881, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "37ea230b-6e9c-4fa1-a8fc-af9f35f430fc", "eventTime": "2017-05-26T22:27:05Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "524823efe-b0bc-421b-a2ea-cfa8b249dffd", "record_id": "flaws_cloudtrail:0000227:524823efe-b0bc-421b-a2ea-cfa8b249dffd", "row_index": 227, "timestamp": "2017-05-26T22:27:05Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1448, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "524823efe-b0bc-421b-a2ea-cfa8b249dffd", "eventTime": "2017-05-26T22:27:05Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "cloudaux"}, "responseElements": {"credentials": {"accessKeyId": "ASIA76WQYI2J9VU7F2YE", "expiration": "May 26, 2017 11:27:05 PM", "sessionToken": "FQoDYXdzECAaDKC8fpuWlvxqqsdaYyLLASf5iI0eUHmmOKcdzFRND3kwAUq0KrMLw/lwFIU7p07a0P5YvzB2d9FlVp/5s3TRIiKuMokNeJ2uZMnxkp/Drg+UUWfR36yVSVpSeFg2Kx/y1bMCUZZ5+x9CxVjNSxfVB4aRzlwjwOg3vVHYZCIPfyu04ZoIfl7QS2qIVagk/+He508VNyAcmgfbN3HYNIb8rBEF56YSGDRHKQQBeG7Lx171cdR7eCND4uynylHcrEeoeSu2pNpWUi/svsMYGVx7Rf2J3kRAZM4/Vw2zKLnXoskF"}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:cloudaux", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/cloudaux"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e5885ce5-4b89-4a4e-9e3a-36fbf2de73f5", "record_id": "flaws_cloudtrail:0000228:e5885ce5-4b89-4a4e-9e3a-36fbf2de73f5", "row_index": 228, "timestamp": "2017-05-26T22:27:05Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 882, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e5885ce5-4b89-4a4e-9e3a-36fbf2de73f5", "eventTime": "2017-05-26T22:27:05Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "726acec6-d530-4b2d-bd11-827543c2b27c8", "record_id": "flaws_cloudtrail:0000229:726acec6-d530-4b2d-bd11-827543c2b27c8", "row_index": 229, "timestamp": "2017-05-26T22:27:05Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1455, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "726acec6-d530-4b2d-bd11-827543c2b27c8", "eventTime": "2017-05-26T22:27:05Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAQ5SH9Z8NDD95Y0ZF", "expiration": "May 26, 2017 11:27:05 PM", "sessionToken": "FQoDYXdzECAaDPrJwunTSrCeQTHieyLMAYa/BI7NIZwQkwOdAo3ol/FdoAexSEl9bjDsCzBHfhPlsCYyGsMj5T0Uxs+/DA5Uh4sa6enfQVfHO3DFx28EJnQhHFY/MV71vhmcQ/KKek9NuZPqf1iLb71q8muOezRAWGz9ib/ssa15NDxjBo2PRiAiQ3OE9o0Wnn+ZrwY2HumcKvbTyDJGcwB+yrIMtbenS/JI9w1TCN2AH/IM/IApk4vFAjOx56Ch11dAem3ZvgHzBf8JoGLBVA8wcOtey5A3+CbBoB3rBFahAC+Nnii516LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b1bcbc7a-1e24-47dc-91df-9e8a4af8e0c3", "record_id": "flaws_cloudtrail:0000230:b1bcbc7a-1e24-47dc-91df-9e8a4af8e0c3", "row_index": 230, "timestamp": "2017-05-26T22:27:05Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 882, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b1bcbc7a-1e24-47dc-91df-9e8a4af8e0c3", "eventTime": "2017-05-26T22:27:05Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "abc779d0-155f-462c-beaa-cc5936503349", "record_id": "flaws_cloudtrail:0000231:abc779d0-155f-462c-beaa-cc5936503349", "row_index": 231, "timestamp": "2017-05-26T22:27:06Z", "event_type": "DescribeRegions", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAQ5SH9Z8NDD95Y0ZF", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto/2.47.0 Python/2.7.12 Linux/4.4.0-78-generic", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 967, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "abc779d0-155f-462c-beaa-cc5936503349", "eventTime": "2017-05-26T22:27:06Z", "eventName": "DescribeRegions", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto/2.47.0 Python/2.7.12 Linux/4.4.0-78-generic", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAQ5SH9Z8NDD95Y0ZF", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:05Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"regionSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c67b8059-01bb-4766-a5bf-afcf9fcb2b86", "record_id": "flaws_cloudtrail:0000232:c67b8059-01bb-4766-a5bf-afcf9fcb2b86", "row_index": 232, "timestamp": "2017-05-26T22:27:06Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1449, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c67b8059-01bb-4766-a5bf-afcf9fcb2b86", "eventTime": "2017-05-26T22:27:06Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIACSFAHBSXU9HT992L", "expiration": "May 26, 2017 11:27:06 PM", "sessionToken": "FQoDYXdzECAaDFl7TAaXdRnKZqJPDyLMAfXHhqTXrtTC+GsDnlEcv6+5h++qiyayL4idFJFirhnu3EY+HeDPMlc72enVGujWm5Nf8tagfP43cFgkgbWXTtlTLHZgNa2Kx5tnVsZgHzLsk+LZ0pJghhIQFVTOL5lgAgoZ7Fvb8McTkFcGrb+yRlYYgFygBnvCKJjELeYJsxrch1McRbcHy+1eQGHTkQsCb5jBJd+2XlgseMn81JpQrAYtchymmjBCpHgiu17/MKI5WZFrsMbkPz9vTyIY9fXcBoj6CyiMNp1c88gGoCi616LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8157c140-d954-4848-bfea-7e14ab4297c5", "record_id": "flaws_cloudtrail:0000233:8157c140-d954-4848-bfea-7e14ab4297c5", "row_index": 233, "timestamp": "2017-05-26T22:27:07Z", "event_type": "DescribeLoadBalancers", "event_source": "elasticloadbalancing.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/cloudaux", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:cloudaux", "user_name": null, "access_key_id": "ASIA76WQYI2J9VU7F2YE", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 1034, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8157c140-d954-4848-bfea-7e14ab4297c5", "eventTime": "2017-05-26T22:27:07Z", "eventName": "DescribeLoadBalancers", "eventSource": "elasticloadbalancing.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-south-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:cloudaux", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/cloudaux", "accountId": "811596193553", "accessKeyId": "ASIA76WQYI2J9VU7F2YE", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:05Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "responseElements": {"loadBalancers": []}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "438cb71b-8e0d-4e10-b68b-ffe5a766fca1", "record_id": "flaws_cloudtrail:0000234:438cb71b-8e0d-4e10-b68b-ffe5a766fca1", "row_index": 234, "timestamp": "2017-05-26T22:27:07Z", "event_type": "ListCertificates", "event_source": "acm.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIACSFAHBSXU9HT992L", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 1139, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "438cb71b-8e0d-4e10-b68b-ffe5a766fca1", "eventTime": "2017-05-26T22:27:07Z", "eventName": "ListCertificates", "eventSource": "acm.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-south-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey is not authorized to perform: acm:ListCertificates", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIACSFAHBSXU9HT992L", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:06Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4db8cbce-0083-418f-a5f5-1b99d576917", "record_id": "flaws_cloudtrail:0000235:4db8cbce-0083-418f-a5f5-1b99d576917", "row_index": 235, "timestamp": "2017-05-26T22:27:07Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1446, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4db8cbce-0083-418f-a5f5-1b99d576917", "eventTime": "2017-05-26T22:27:07Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "cloudaux"}, "responseElements": {"credentials": {"accessKeyId": "ASIA60JU63GY4X8KYR8Y", "expiration": "May 26, 2017 11:27:07 PM", "sessionToken": "FQoDYXdzECAaDDL1M96ECUQcXKa4hSLLARWBLaOsw4t7JIvZSb0Ym5PAaRK+Sc0B01uAUxXc1nZBtw0n2s5XOnttvDna8G72Dk3OpKlQiydir69AF/pI5rrrKAFO3HJOAKAnc1GUOipxERh9Z7G93ESK3ROAgr1dlVbyHZAADiC/U/mWY1oelmjyWtedJGKdZ2WBsuT8k2bOsoomrkSFC8i9j/hNqxZYq5qBlae40eYR/wn4CTU/DmWRYGbuEMp7N/lFO30Y6kWRK+X3Zq1x25tF4iUam/remmwWnWmeSnDw+TyyKLvXoskF"}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:cloudaux", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/cloudaux"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ae137e35-c94e-47e4-8f49-d61de4c0a110", "record_id": "flaws_cloudtrail:0000236:ae137e35-c94e-47e4-8f49-d61de4c0a110", "row_index": 236, "timestamp": "2017-05-26T22:27:08Z", "event_type": "DescribeLoadBalancers", "event_source": "elasticloadbalancing.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/cloudaux", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:cloudaux", "user_name": null, "access_key_id": "ASIA60JU63GY4X8KYR8Y", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1039, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ae137e35-c94e-47e4-8f49-d61de4c0a110", "eventTime": "2017-05-26T22:27:08Z", "eventName": "DescribeLoadBalancers", "eventSource": "elasticloadbalancing.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:cloudaux", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/cloudaux", "accountId": "811596193553", "accessKeyId": "ASIA60JU63GY4X8KYR8Y", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:07Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "responseElements": {"loadBalancers": []}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d3a00011-f3e9-450f-a34e-b94590fb3a4a", "record_id": "flaws_cloudtrail:0000237:d3a00011-f3e9-450f-a34e-b94590fb3a4a", "row_index": 237, "timestamp": "2017-05-26T22:27:08Z", "event_type": "ListCertificates", "event_source": "acm.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIARTMMVCQDDZG4P852", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1137, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d3a00011-f3e9-450f-a34e-b94590fb3a4a", "eventTime": "2017-05-26T22:27:08Z", "eventName": "ListCertificates", "eventSource": "acm.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "eu-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey is not authorized to perform: acm:ListCertificates", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIARTMMVCQDDZG4P852", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:08Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ff9cfd72-80e1-4181-a981-c28495e0e0", "record_id": "flaws_cloudtrail:0000238:ff9cfd72-80e1-4181-a981-c28495e0e0", "row_index": 238, "timestamp": "2017-05-26T22:27:08Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1450, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ff9cfd72-80e1-4181-a981-c28495e0e0", "eventTime": "2017-05-26T22:27:08Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIARTMMVCQDDZG4P852", "expiration": "May 26, 2017 11:27:08 PM", "sessionToken": "FQoDYXdzECAaDLY9De3Gb+HJ+SeK3yLMASkfYjD0g5np5cIB4TDxD8v6npIssUVpP4TEsXWQbZh+rf3Z1RkHZAiZLBh1mkH3G8PAWIhPHGptfqWdhQicoa8VzBl2gfJdUZm8XILA2R/MxUdFQqgcGcehjL/H3VdnpMxvHbsEpLyrS3BqA7iKdqxwPjY2pHnkR4zNC1auz5AttWmWP6/em5HrHQ0/9BRrn02KE+w4yNuGzFCEja0u9ba6I+pJW+49J1ziDtiaQyjTu/FCOj8mjXgjbMpsLY6uY+lIjDEWJOuhRRD+BCi816LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fe8dfdad-4ff7-4238-9928-1cfa679dc3e1", "record_id": "flaws_cloudtrail:0000239:fe8dfdad-4ff7-4238-9928-1cfa679dc3e1", "row_index": 239, "timestamp": "2017-05-26T22:27:09Z", "event_type": "DescribeLoadBalancers", "event_source": "elasticloadbalancing.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/cloudaux", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:cloudaux", "user_name": null, "access_key_id": "ASIAY1ICZTL4QEJ6AFJD", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1040, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fe8dfdad-4ff7-4238-9928-1cfa679dc3e1", "eventTime": "2017-05-26T22:27:09Z", "eventName": "DescribeLoadBalancers", "eventSource": "elasticloadbalancing.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:cloudaux", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/cloudaux", "accountId": "811596193553", "accessKeyId": "ASIAY1ICZTL4QEJ6AFJD", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:09Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "responseElements": {"loadBalancers": []}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e8909b7e-8383-441b-9c40-323dc82aa89d", "record_id": "flaws_cloudtrail:0000240:e8909b7e-8383-441b-9c40-323dc82aa89d", "row_index": 240, "timestamp": "2017-05-26T22:27:09Z", "event_type": "ListCertificates", "event_source": "acm.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAK4U6DXCSH4YZ19Y2", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1137, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e8909b7e-8383-441b-9c40-323dc82aa89d", "eventTime": "2017-05-26T22:27:09Z", "eventName": "ListCertificates", "eventSource": "acm.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "eu-west-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey is not authorized to perform: acm:ListCertificates", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAK4U6DXCSH4YZ19Y2", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:09Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7a03135-5605-4638-9406-ebd316054de7", "record_id": "flaws_cloudtrail:0000241:7a03135-5605-4638-9406-ebd316054de7", "row_index": 241, "timestamp": "2017-05-26T22:27:09Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1446, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7a03135-5605-4638-9406-ebd316054de7", "eventTime": "2017-05-26T22:27:09Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "cloudaux"}, "responseElements": {"credentials": {"accessKeyId": "ASIAY1ICZTL4QEJ6AFJD", "expiration": "May 26, 2017 11:27:09 PM", "sessionToken": "FQoDYXdzECAaDD3crwT/pFMRwwsHOyLLATTHrul8ekWmKuJjB5yiY0BjV9Xbp1IdMshwGRM+7PTpd79tGqPHAC3R3rpQQYGiFi356+2y5BZsYrRi1dHnZI0W22gG0HYm0e2Ah+v+9lnTPk6mCurZzsTlp5FM42bddcICab6fMZlu9050C3NWNFvDkjMyg/kJoDQp3ErtUghRNUbPHge+5DjSBW0dEPUmL0XfZb2g2ilnKlRMbqJFlAr86i7IOa2mJLWeuyv3h4qlodh4kyejkaX/Fb3aYdBCRThR6rC5XKHuz823KL3XoskF"}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:cloudaux", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/cloudaux"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "36e370327-45f2-4f6e-8178-9bda3a7cfc99", "record_id": "flaws_cloudtrail:0000242:36e370327-45f2-4f6e-8178-9bda3a7cfc99", "row_index": 242, "timestamp": "2017-05-26T22:27:09Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1455, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "36e370327-45f2-4f6e-8178-9bda3a7cfc99", "eventTime": "2017-05-26T22:27:09Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAK4U6DXCSH4YZ19Y2", "expiration": "May 26, 2017 11:27:09 PM", "sessionToken": "FQoDYXdzECAaDHpxXTVBldp8w04LnCLMAe3T59IHHfH6hRhv0Uhs9tNBkT6h/zf+fXvcbNf0W41z6wWDSg5VN6fADj5kqHQfDL9vVVxCAGiXuOBS32FdNHu7DMoBlwVrfsWu3s+wWNeC558KQr4IAAoCvJIgTj1GT+zK8SEz9lKCjnC++uTyULSKfZMVN6IcKOTo3wP0VDADzhhPUCjrmY4+uvWbI/o/9+EGfn6G0Qp0fxThhap7ZOyhctoJTtX0ID5fc4IHXu38O49XToe4zEErCHCY6El0XNHPFJZCcl6NrS93iyi916LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "44a68442-37cb-421f-bae0-d1f1f996310", "record_id": "flaws_cloudtrail:0000243:44a68442-37cb-421f-bae0-d1f1f996310", "row_index": 243, "timestamp": "2017-05-26T22:27:10Z", "event_type": "DescribeLoadBalancers", "event_source": "elasticloadbalancing.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/cloudaux", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:cloudaux", "user_name": null, "access_key_id": "ASIAFP1Y0JT8JK8WLIUU", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1036, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "44a68442-37cb-421f-bae0-d1f1f996310", "eventTime": "2017-05-26T22:27:10Z", "eventName": "DescribeLoadBalancers", "eventSource": "elasticloadbalancing.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ca-central-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:cloudaux", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/cloudaux", "accountId": "811596193553", "accessKeyId": "ASIAFP1Y0JT8JK8WLIUU", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:10Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "responseElements": {"loadBalancers": []}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b2024d15-176b-49c7-b6d2-31ff88aeb128", "record_id": "flaws_cloudtrail:0000244:b2024d15-176b-49c7-b6d2-31ff88aeb128", "row_index": 244, "timestamp": "2017-05-26T22:27:10Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1447, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b2024d15-176b-49c7-b6d2-31ff88aeb128", "eventTime": "2017-05-26T22:27:10Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "cloudaux"}, "responseElements": {"credentials": {"accessKeyId": "ASIAFP1Y0JT8JK8WLIUU", "expiration": "May 26, 2017 11:27:10 PM", "sessionToken": "FQoDYXdzECAaDK+yDeiLGbHeW9u3cyLLAZ5d28E4lBAzA6J9TajYUUz9aTeNXO5Lcj9Ft4/rMrKYNOLwJEKoZ156UmEjTCeqFxbqGZgfbrkTxoV67fOXPIG1gIh/DH52aIgKxpmqqHtsD0IeVpHS+vSzirslqTve5Y1KIK4FtjAfCSuRbPyKCBC+607X5MjLyeIHuIFlkAqnN9bP2hAO7kIgSAZSwhwMLNFb69jxBMEbPqXnMxZ8O+yYunLvyxj3cMTAB8QSIBc4ynsM6GLf+pZsUEzEKc7BNwoMrc4xRAOh6boMKL7XoskF"}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:cloudaux", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/cloudaux"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "63990c07-2207-4ae3-b4eb-e6711b3a72d6", "record_id": "flaws_cloudtrail:0000245:63990c07-2207-4ae3-b4eb-e6711b3a72d6", "row_index": 245, "timestamp": "2017-05-26T22:27:10Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "63990c07-2207-4ae3-b4eb-e6711b3a72d6", "eventTime": "2017-05-26T22:27:10Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAEQIAT30UDHETGBFM", "expiration": "May 26, 2017 11:27:10 PM", "sessionToken": "FQoDYXdzECAaDPQaJDKsVs99YN9JHSLMAcTWdF2ZQaBbh7re5iK/FTIa2yCeL57Z18yX5N9DJLGzu5OdCf4yzCXGh+X2LVprJQwe0HLR1EmtgWLSrVvxfgV0bBEgEHsDDpLr4OAK9KZVNQ0HrgjEaFUj86iGqFQoeDyInF+egiKQFg8fY50fXkOl011JBDnAieUF7cLqOztGcdLMCqKHOtvlLWBeVXkI/VrZ0e0Gu8Oc/SkCyLBcCvq7Rh8johgbWEV21pZ6WHd11kmpdG2+qpiZWiSMPukkpCRlijol8YHbtwEtcii+16LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "62059-2ca0-4074-a050-04e31d4918d6", "record_id": "flaws_cloudtrail:0000246:62059-2ca0-4074-a050-04e31d4918d6", "row_index": 246, "timestamp": "2017-05-26T22:27:11Z", "event_type": "ListCertificates", "event_source": "acm.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAEQIAT30UDHETGBFM", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1139, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "62059-2ca0-4074-a050-04e31d4918d6", "eventTime": "2017-05-26T22:27:11Z", "eventName": "ListCertificates", "eventSource": "acm.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-northeast-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey is not authorized to perform: acm:ListCertificates", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAEQIAT30UDHETGBFM", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:10Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "18ca2e0f-d81b-4dc6-990d-6956435d80c5", "record_id": "flaws_cloudtrail:0000247:18ca2e0f-d81b-4dc6-990d-6956435d80c5", "row_index": 247, "timestamp": "2017-05-26T22:27:11Z", "event_type": "DescribeLoadBalancers", "event_source": "elasticloadbalancing.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/cloudaux", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:cloudaux", "user_name": null, "access_key_id": "ASIAH06Q3XY0DGEXBDHN", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1037, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "18ca2e0f-d81b-4dc6-990d-6956435d80c5", "eventTime": "2017-05-26T22:27:11Z", "eventName": "DescribeLoadBalancers", "eventSource": "elasticloadbalancing.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "eu-central-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:cloudaux", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/cloudaux", "accountId": "811596193553", "accessKeyId": "ASIAH06Q3XY0DGEXBDHN", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:11Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "responseElements": {"loadBalancers": []}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7b5bb95a-9af1-48de-a56d-c3f905b74637", "record_id": "flaws_cloudtrail:0000248:7b5bb95a-9af1-48de-a56d-c3f905b74637", "row_index": 248, "timestamp": "2017-05-26T22:27:11Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1447, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7b5bb95a-9af1-48de-a56d-c3f905b74637", "eventTime": "2017-05-26T22:27:11Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "cloudaux"}, "responseElements": {"credentials": {"accessKeyId": "ASIAH06Q3XY0DGEXBDHN", "expiration": "May 26, 2017 11:27:11 PM", "sessionToken": "FQoDYXdzECAaDOR4DcZ1oBGC97BoSyLLAWYqyxcjiph5zg0dKb0WGH9kHxU1V0N49LfB1tdlWZfuNkJmQ6Kur9HNP42R3g2AFO60fhu7OR6z1crQYqzLlK0fRE8NspX5Q0XidtieYzjYBGBLCaC+1BDjBkaANNSzQ99ZTKccjqw0pKiLv2wQPVMNWsV8wj27ohIixdDFEZ0urHs54x/KbACXNv2oISDL9toGkomogFPhUH9ppEZSeYyqZkFp+khXklsat4NAzg2j/MItlRxlIveD9awlsQOfMRwLLFiQd4V4yK6cKL/XoskF"}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:cloudaux", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/cloudaux"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9905a8c3-20b4-40f0-a566-7091ee851b60", "record_id": "flaws_cloudtrail:0000249:9905a8c3-20b4-40f0-a566-7091ee851b60", "row_index": 249, "timestamp": "2017-05-26T22:27:11Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 881, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9905a8c3-20b4-40f0-a566-7091ee851b60", "eventTime": "2017-05-26T22:27:11Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d823ace4-1007-4ba5-9a73-ab8f6cd01a36", "record_id": "flaws_cloudtrail:0000250:d823ace4-1007-4ba5-9a73-ab8f6cd01a36", "row_index": 250, "timestamp": "2017-05-26T22:27:12Z", "event_type": "ListCertificates", "event_source": "acm.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAACY6LTPVZLTVEUZZ", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1136, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d823ace4-1007-4ba5-9a73-ab8f6cd01a36", "eventTime": "2017-05-26T22:27:12Z", "eventName": "ListCertificates", "eventSource": "acm.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "sa-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey is not authorized to perform: acm:ListCertificates", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAACY6LTPVZLTVEUZZ", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:12Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "336a2d3f-3444-4a35-a612-bce34e7d19e6", "record_id": "flaws_cloudtrail:0000251:336a2d3f-3444-4a35-a612-bce34e7d19e6", "row_index": 251, "timestamp": "2017-05-26T22:27:12Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1451, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "336a2d3f-3444-4a35-a612-bce34e7d19e6", "eventTime": "2017-05-26T22:27:12Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAACY6LTPVZLTVEUZZ", "expiration": "May 26, 2017 11:27:12 PM", "sessionToken": "FQoDYXdzECAaDJqDCL3nKPvXX/YtMyLMARu/i2pqgHq49Mp95BmpUVuGqQW8N8d4PiIlD2qfN5zxbgfrcF7Ohbp8Ux8TNoa2jmULjTYamLzGyx7UQaY3eYktJ8w0aSzOcDYFi3UlYM78so2XEsE1Wdn017AnxR4ntz1VDhZdmL7jpxn4wnbSRfaqfLG8/6WNvjcKpZKwbCKf3sFsYl6HMViBee5DaYa/38XMga5pI6PMk785VtgvvLSloZEiWGbmZE/56fYXSpU1Mk3PgJ9NcGKYv4uzyeY7Tb2WwqDSWUty5o8iuyjA16LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ae27ab3f-cb86-4ed1-a322-233ef21c0a51", "record_id": "flaws_cloudtrail:0000252:ae27ab3f-cb86-4ed1-a322-233ef21c0a51", "row_index": 252, "timestamp": "2017-05-26T22:27:12Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1447, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ae27ab3f-cb86-4ed1-a322-233ef21c0a51", "eventTime": "2017-05-26T22:27:12Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "cloudaux"}, "responseElements": {"credentials": {"accessKeyId": "ASIABCT44P1EQUFOUU3D", "expiration": "May 26, 2017 11:27:12 PM", "sessionToken": "FQoDYXdzECAaDOePBAD3vGbLXH81bCLLAYzQlrzkIvvv80LOLj9fxCTPe7VISryB1kvizf9OjRPLmx+J0he76+ys/SI05MDLUpTmx606a02mihFhV6ZOivRzGfFqMgTf9pt641DAaZygDWQ4VaZ/euDfYTgaMb1/0jzZbx4ceq7qRrmBxg58iyQ8ddXdpsr7K5C1IENTgGlYpDHdNqk17KAmvlmdRX906PvQIc7IXY+HJ8NUzodU/5ZCm3ShD3V0WhUeZ++1deQJHYOeOG8MrerkM3zUkvA034r6+d2T8ESgqeROKMDXoskF"}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:cloudaux", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/cloudaux"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ebdf7ecb-8494-48ff-8f94-88e939069", "record_id": "flaws_cloudtrail:0000253:ebdf7ecb-8494-48ff-8f94-88e939069", "row_index": 253, "timestamp": "2017-05-26T22:27:13Z", "event_type": "DescribeLoadBalancers", "event_source": "elasticloadbalancing.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/cloudaux", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:cloudaux", "user_name": null, "access_key_id": "ASIABCT44P1EQUFOUU3D", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1028, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ebdf7ecb-8494-48ff-8f94-88e939069", "eventTime": "2017-05-26T22:27:13Z", "eventName": "DescribeLoadBalancers", "eventSource": "elasticloadbalancing.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "eu-west-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:cloudaux", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/cloudaux", "accountId": "811596193553", "accessKeyId": "ASIABCT44P1EQUFOUU3D", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:12Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "responseElements": {"loadBalancers": []}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d5eeba29-43d9-4252-aa12-730242b6c8c3", "record_id": "flaws_cloudtrail:0000254:d5eeba29-43d9-4252-aa12-730242b6c8c3", "row_index": 254, "timestamp": "2017-05-26T22:27:13Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d5eeba29-43d9-4252-aa12-730242b6c8c3", "eventTime": "2017-05-26T22:27:13Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAWPTVHAXBUX6L3I97", "expiration": "May 26, 2017 11:27:13 PM", "sessionToken": "FQoDYXdzECAaDIMzmFmdA9T9mxnn3CLMAeJvhGTfMTQ3VsSA2UKeg+igdCfJPB+JmaGSCxZNh6bp72zFN7BirTvCQtXSO1nxFp2dYdqjcVPK6yx9O661ZQ21MEAiPjc7glPzfNzowN1/2oqyF4PTYc54uIClwEDyW2X16gNgPrV+ITpgN7eaTisX+l8HSSHeErlEH3Bx/CWA8pZarsvv9J706w5gHGz4DIOHpIQQVtAetHVojKmdpTIbijEUXvDBpOkVzYYtq1tsoLoCjzWHYojvnMA67Y5Ia8xy38ZAzRb897HfOSjB16LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4530b6a5-22aa-44c7-9772-58f8d936cc33", "record_id": "flaws_cloudtrail:0000255:4530b6a5-22aa-44c7-9772-58f8d936cc33", "row_index": 255, "timestamp": "2017-05-26T22:27:13Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 881, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4530b6a5-22aa-44c7-9772-58f8d936cc33", "eventTime": "2017-05-26T22:27:13Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "57c5bd21-6563-42d0-aded-0b1095c5b93d", "record_id": "flaws_cloudtrail:0000256:57c5bd21-6563-42d0-aded-0b1095c5b93d", "row_index": 256, "timestamp": "2017-05-26T22:27:13Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1447, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "57c5bd21-6563-42d0-aded-0b1095c5b93d", "eventTime": "2017-05-26T22:27:13Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "cloudaux"}, "responseElements": {"credentials": {"accessKeyId": "ASIAGRVWPOZP18H2S1VM", "expiration": "May 26, 2017 11:27:13 PM", "sessionToken": "FQoDYXdzECAaDKnTjr1eXNihNczSqCLLAWgi30YKkAA9l+emoLpGGEKQnejwd+x2u9mYh23WeAPym41GIDggbps0BRdngbfPfmPs3sbrxVkAG8BsMOxID8XBD4uKH8mVZuuut/EFnbdfA/IjLlRHaHj7TbNcIEuyO0jhTqw7psXMy94tgGyHZ8/ovCx07LPhRF6qFTeSA71NQJiu+SgnnTBZU0C0qOUfSdjFhl/3/IykKQU4hK7i8/CfP6q0fVOOw1Gnv9bXISzwbY3DrsMC5XoPfnMzgCK6z2Sg1Jfu57wKg/oeKMHXoskF"}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:cloudaux", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/cloudaux"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ddd02c9f-ee13-4f2f-940f-f989aca8850e", "record_id": "flaws_cloudtrail:0000257:ddd02c9f-ee13-4f2f-940f-f989aca8850e", "row_index": 257, "timestamp": "2017-05-26T22:27:14Z", "event_type": "ListCertificates", "event_source": "acm.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAWPTVHAXBUX6L3I97", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1142, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ddd02c9f-ee13-4f2f-940f-f989aca8850e", "eventTime": "2017-05-26T22:27:14Z", "eventName": "ListCertificates", "eventSource": "acm.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-southeast-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey is not authorized to perform: acm:ListCertificates", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAWPTVHAXBUX6L3I97", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:13Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cff3923e-963a-4fc9-bbb1-966f78484d9", "record_id": "flaws_cloudtrail:0000258:cff3923e-963a-4fc9-bbb1-966f78484d9", "row_index": 258, "timestamp": "2017-05-26T22:27:14Z", "event_type": "DescribeLoadBalancers", "event_source": "elasticloadbalancing.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/cloudaux", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:cloudaux", "user_name": null, "access_key_id": "ASIAGRVWPOZP18H2S1VM", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1033, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cff3923e-963a-4fc9-bbb1-966f78484d9", "eventTime": "2017-05-26T22:27:14Z", "eventName": "DescribeLoadBalancers", "eventSource": "elasticloadbalancing.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "eu-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:cloudaux", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/cloudaux", "accountId": "811596193553", "accessKeyId": "ASIAGRVWPOZP18H2S1VM", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:13Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "responseElements": {"loadBalancers": []}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "08d350d7-3331-4df5-bfb8-a4386df905db", "record_id": "flaws_cloudtrail:0000259:08d350d7-3331-4df5-bfb8-a4386df905db", "row_index": 259, "timestamp": "2017-05-26T22:27:14Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1447, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "08d350d7-3331-4df5-bfb8-a4386df905db", "eventTime": "2017-05-26T22:27:14Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "cloudaux"}, "responseElements": {"credentials": {"accessKeyId": "ASIAXPFUFM56MQNTC54U", "expiration": "May 26, 2017 11:27:14 PM", "sessionToken": "FQoDYXdzECAaDG522CqOz5QBzAOf1SLLAUjQtPW9vKe1Ve7gUJh2Eftjrbvpmq7xc6j+NI3HMUxDzN6al/EBdy8Md92PCz1Os/9OKAXgfFnJj35B/0vXVEZnodvNLf7vJ9M0vpK2eP3CuR+VaN4Ei7JpNAdCOAfFc3I9YE3z5quJykQuKecw9m7ypPLE4HrSuWhAJwQxQY3WhY+dlSlvZYILKWkrv+m4JOkrgHf3RVHQ75dk0s9nLyaBLi83IcjAsySYgmJJVYwVRTsu6muwTVQ+ZEC8Ab3VxMN6zMDxsB5v3IEJKMLXoskF"}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:cloudaux", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/cloudaux"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "77455c-fa6c-4724-a38e-ccd34d26a683", "record_id": "flaws_cloudtrail:0000260:77455c-fa6c-4724-a38e-ccd34d26a683", "row_index": 260, "timestamp": "2017-05-26T22:27:15Z", "event_type": "DescribeLoadBalancers", "event_source": "elasticloadbalancing.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/cloudaux", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:cloudaux", "user_name": null, "access_key_id": "ASIAXPFUFM56MQNTC54U", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1033, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "77455c-fa6c-4724-a38e-ccd34d26a683", "eventTime": "2017-05-26T22:27:15Z", "eventName": "DescribeLoadBalancers", "eventSource": "elasticloadbalancing.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "sa-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:cloudaux", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/cloudaux", "accountId": "811596193553", "accessKeyId": "ASIAXPFUFM56MQNTC54U", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:14Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "responseElements": {"loadBalancers": []}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1a1f1993-c16f-43bc-88ba-95656582f2ad", "record_id": "flaws_cloudtrail:0000261:1a1f1993-c16f-43bc-88ba-95656582f2ad", "row_index": 261, "timestamp": "2017-05-26T22:27:15Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1447, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1a1f1993-c16f-43bc-88ba-95656582f2ad", "eventTime": "2017-05-26T22:27:15Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "cloudaux"}, "responseElements": {"credentials": {"accessKeyId": "ASIA1S4SBH960W5A3AIA", "expiration": "May 26, 2017 11:27:15 PM", "sessionToken": "FQoDYXdzECAaDG38nplv7s5Sz2+f3CLLARqNGoZRXP69khWmClDlPoUQOv7CS47QvBbhXFUFOWUZpwMTYl+Fo/JqtJNQHXXqlv/LQsEcEsb+TJutJli8r5R2Sn0xNLoDg+sIv4qMPhcv7wiv/Y6nYNunwPjIvaxgsQk8l0DnnQNzZrmwEk0RBlHYdmQ70tV/NqfiS2RFzcZaWj1nFTVwCbLh+kqINgO1SzBZ1S/AACqT+fbupKblEDANt8KLIAW90vcCt7Tkg2/WOeCGWMuN555aukNHydpfhsqkhWGkRyuoH/yFKMPXoskF"}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:cloudaux", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/cloudaux"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c2809ea2-952f-4c5e-861c-95610084b434", "record_id": "flaws_cloudtrail:0000262:c2809ea2-952f-4c5e-861c-95610084b434", "row_index": 262, "timestamp": "2017-05-26T22:27:15Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1453, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c2809ea2-952f-4c5e-861c-95610084b434", "eventTime": "2017-05-26T22:27:15Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAS9W7Y7UEHY9NYSH0", "expiration": "May 26, 2017 11:27:15 PM", "sessionToken": "FQoDYXdzECAaDKd+N792kYnrAUx+ziLMAe3zc0DM8WfQlDrwkG2LNlDRr9XqGY4TAdIU9KrSa5TbeGlwdC7FVXyuCZ00peKMmFlD3QRuP+ZhDhgrwiKX/kD4EGutoqktBB5auT93T32isvW/Dlamg1ct4BKfkaK+K4HMZGhO7WVy2OEw7szKyouhySCplOyyIY705ga9s+8kWinFmS3yvP03OH3Alj5n2qiOIVQ50ZcnrhnoM9+3V5/wB0EdOQb5ttpdt2TUeuxZOGdr9uVkPO231AoAyD3d8eBMCq1b2PN2Pv7nECjD16LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "39daec34-fb57-456e-aa1b-428a40e0f896", "record_id": "flaws_cloudtrail:0000263:39daec34-fb57-456e-aa1b-428a40e0f896", "row_index": 263, "timestamp": "2017-05-26T22:27:16Z", "event_type": "ListCertificates", "event_source": "acm.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAS9W7Y7UEHY9NYSH0", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1140, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "39daec34-fb57-456e-aa1b-428a40e0f896", "eventTime": "2017-05-26T22:27:16Z", "eventName": "ListCertificates", "eventSource": "acm.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-southeast-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey is not authorized to perform: acm:ListCertificates", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAS9W7Y7UEHY9NYSH0", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:15Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "325fbf45-94e3-4b5f-8fd6-956dc0d27677", "record_id": "flaws_cloudtrail:0000264:325fbf45-94e3-4b5f-8fd6-956dc0d27677", "row_index": 264, "timestamp": "2017-05-26T22:27:16Z", "event_type": "DescribeLoadBalancers", "event_source": "elasticloadbalancing.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/cloudaux", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:cloudaux", "user_name": null, "access_key_id": "ASIA1S4SBH960W5A3AIA", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1034, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "325fbf45-94e3-4b5f-8fd6-956dc0d27677", "eventTime": "2017-05-26T22:27:16Z", "eventName": "DescribeLoadBalancers", "eventSource": "elasticloadbalancing.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:cloudaux", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/cloudaux", "accountId": "811596193553", "accessKeyId": "ASIA1S4SBH960W5A3AIA", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:15Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "responseElements": {"loadBalancers": []}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "11e350bf-e866-48fa-82f7-fa9b959fdc9d", "record_id": "flaws_cloudtrail:0000265:11e350bf-e866-48fa-82f7-fa9b959fdc9d", "row_index": 265, "timestamp": "2017-05-26T22:27:16Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1447, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "11e350bf-e866-48fa-82f7-fa9b959fdc9d", "eventTime": "2017-05-26T22:27:16Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "cloudaux"}, "responseElements": {"credentials": {"accessKeyId": "ASIA1J27GLH5M0MFR0FT", "expiration": "May 26, 2017 11:27:16 PM", "sessionToken": "FQoDYXdzECAaDFWkK5lNeB2sh6p13yLLAYr+pJBf8JWjRfb4DwAvSSt+MBvYpo6vU6qMWX3vh8gqGE2z9PJOd/0lUecSo8q7WOEndWIWbK3vra7fcQQgJvcN5JnS/yQziyZno7A5D4C/EZT0pPSauIt8y7ywpQVQly00dYGjT/w4Jsk8QrAdRxQrYAclH/aTOs2+BQuVNFlj3MQai6O2mCSJIe2/gqFQ2fdshe/rr5Pg8mAdorpreFHisBsaVlOTjDK02CGxQXMIJx9xjnDjukrNTCpgbUik4PDdkcgKhNW3PB+kKMTXoskF"}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:cloudaux", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/cloudaux"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "29731f97-5b77-43a6-a329-be0308e7a8b3", "record_id": "flaws_cloudtrail:0000266:29731f97-5b77-43a6-a329-be0308e7a8b3", "row_index": 266, "timestamp": "2017-05-26T22:27:16Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "29731f97-5b77-43a6-a329-be0308e7a8b3", "eventTime": "2017-05-26T22:27:16Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAX0IKCH836L0YVWNO", "expiration": "May 26, 2017 11:27:16 PM", "sessionToken": "FQoDYXdzECAaDCmR827nLgIVCSBEUCLMAVWrW+sgAnUCLTbRrmpOY93TH5Ja0VBlTKXaifcz1UBa/J4zmn9Pac1/Rwn/t7A4w+asmfxCoXTm/PyOAPCInNuJZ4XV7KdUpA89SP9YEL4gCN8GkdcZLMG5ojCp1Pa4k1oxITdnyi/AJ2JCQMgI53X2M145e7woWWSCq7Hygqhu2Dw2cmuQaouQyGFbTtMWbRnrG5EVaPwqOkoVxE2zsfJpnbWS+c77b1ilvHphZNGfywveq8uGXk3Q3acQ+YS94cAgNZnnMvt7LwmsnijE16LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f05b9624-e40e-4068-8329-6c35359a3227", "record_id": "flaws_cloudtrail:0000267:f05b9624-e40e-4068-8329-6c35359a3227", "row_index": 267, "timestamp": "2017-05-26T22:27:16Z", "event_type": "DescribeLoadBalancers", "event_source": "elasticloadbalancing.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/cloudaux", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:cloudaux", "user_name": null, "access_key_id": "ASIA1J27GLH5M0MFR0FT", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1034, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f05b9624-e40e-4068-8329-6c35359a3227", "eventTime": "2017-05-26T22:27:16Z", "eventName": "DescribeLoadBalancers", "eventSource": "elasticloadbalancing.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:cloudaux", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/cloudaux", "accountId": "811596193553", "accessKeyId": "ASIA1J27GLH5M0MFR0FT", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:16Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "responseElements": {"loadBalancers": []}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9b85b2e4-3bfa-448f-83a0-2fb3f9fc093a", "record_id": "flaws_cloudtrail:0000268:9b85b2e4-3bfa-448f-83a0-2fb3f9fc093a", "row_index": 268, "timestamp": "2017-05-26T22:27:17Z", "event_type": "ListCertificates", "event_source": "acm.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAX0IKCH836L0YVWNO", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1140, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9b85b2e4-3bfa-448f-83a0-2fb3f9fc093a", "eventTime": "2017-05-26T22:27:17Z", "eventName": "ListCertificates", "eventSource": "acm.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "eu-central-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey is not authorized to perform: acm:ListCertificates", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAX0IKCH836L0YVWNO", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:16Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4c83dfc6-6f5b-4092-a436-55aaa57e49bb", "record_id": "flaws_cloudtrail:0000269:4c83dfc6-6f5b-4092-a436-55aaa57e49bb", "row_index": 269, "timestamp": "2017-05-26T22:27:17Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1448, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4c83dfc6-6f5b-4092-a436-55aaa57e49bb", "eventTime": "2017-05-26T22:27:17Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "cloudaux"}, "responseElements": {"credentials": {"accessKeyId": "ASIAXE10AT9FSZX7DLVI", "expiration": "May 26, 2017 11:27:17 PM", "sessionToken": "FQoDYXdzECAaDHtyYHHAZ5YVR2VgHSLLAWnopCW2k4hdf0a6G7bJZ3mB9mdgg2evRdDtVV/yCmJm2hbIKDFOvCfpxXBxvoFfWJ/hoGDn33yLTcpPxtbW2Bsok8U57MoRDHpRuf0AaLKb58rdnyX7fPwClGhvD/m9NYTcVxyUeygAen7KJC/OOVOiNkNobBrOrAGQ2U17P08yJg0d7b8xFgcejeTDtXUZM9JyAIGhBGx5GnVjikcQnjfEDfgc5Sh8iPUeKeIosGHi4iZfkwxHjLdpJzrJFe5LiEt4bVq+HfOGdgieKMXXoskF"}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:cloudaux", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/cloudaux"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1b0939d6-6fe2-47dd-965a-1266a2e3fa96", "record_id": "flaws_cloudtrail:0000270:1b0939d6-6fe2-47dd-965a-1266a2e3fa96", "row_index": 270, "timestamp": "2017-05-26T22:27:17Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1b0939d6-6fe2-47dd-965a-1266a2e3fa96", "eventTime": "2017-05-26T22:27:17Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAGOJFA06UQVWD06Z8", "expiration": "May 26, 2017 11:27:17 PM", "sessionToken": "FQoDYXdzECAaDNNVbFXc0ZBqcifc+yLMARL4Uaa5Sn+UKX+vUdZiBoE2Mu82rUfqhkBq7RpKyu/MmEpspXW8QPVW0vg+UOwOWk3i8yCp3Q3UmVN0R9K6MNIoBFwKoRtopaQrN+z6OSswaAswBstH9GL/pndl6uF/tcq8AOU6jJOde3jfzKHZrzqs4kbE0crK91dkbd1xkHvk2tXETs9WW7gWbtmpunyc42Pxn1B5np2njGd1xM9V27xd4+maVc/zduAN/YA/sHdl8a1l5tQwxoDfDmyNnv0OEb3lyvpwNcgT9HCYUCjF16LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "80fb2c1e-61b5-4298-80e3-feb8d4185b7f", "record_id": "flaws_cloudtrail:0000271:80fb2c1e-61b5-4298-80e3-feb8d4185b7f", "row_index": 271, "timestamp": "2017-05-26T22:27:17Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1447, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "80fb2c1e-61b5-4298-80e3-feb8d4185b7f", "eventTime": "2017-05-26T22:27:17Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "cloudaux"}, "responseElements": {"credentials": {"accessKeyId": "ASIAAQHRQD6ZEXFK33M4", "expiration": "May 26, 2017 11:27:17 PM", "sessionToken": "FQoDYXdzECAaDPZOeNs+isVd8PpqKiLLAWfzr+NN1O3oBhdJ27eDpv2l4m8Yldw1PNcxlRiRY1+qxFN3GcyF+8i6KF9pnjHOsgOegxVFWN07X3G9FyMqut3lOd9Seh5gDN0imlJ/KpSbANwURPfByl2HZ0j38F3VNrNRHV9QQWQfe6Sk6mTqV8abVblclQEGRsKv5l0PCY9HypBGHOupLblRd61QTYr9wI/WUn3j0i8bd8Riy0j14tzsu5t52HmABAUPrYd7bTY19gNEEZWjWkyRc5RjmuzpgVfj0zFzUfst8C3BKMXXoskF"}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:cloudaux", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/cloudaux"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a66798c1-64f3-4cdf-ba3c-7919389c8ffa", "record_id": "flaws_cloudtrail:0000272:a66798c1-64f3-4cdf-ba3c-7919389c8ffa", "row_index": 272, "timestamp": "2017-05-26T22:27:17Z", "event_type": "DescribeLoadBalancers", "event_source": "elasticloadbalancing.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/cloudaux", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:cloudaux", "user_name": null, "access_key_id": "ASIAXE10AT9FSZX7DLVI", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1034, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a66798c1-64f3-4cdf-ba3c-7919389c8ffa", "eventTime": "2017-05-26T22:27:17Z", "eventName": "DescribeLoadBalancers", "eventSource": "elasticloadbalancing.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-west-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:cloudaux", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/cloudaux", "accountId": "811596193553", "accessKeyId": "ASIAXE10AT9FSZX7DLVI", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:17Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "responseElements": {"loadBalancers": []}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0254a3ff-34c7-49da-81e5-d3226e862f7e", "record_id": "flaws_cloudtrail:0000273:0254a3ff-34c7-49da-81e5-d3226e862f7e", "row_index": 273, "timestamp": "2017-05-26T22:27:18Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0254a3ff-34c7-49da-81e5-d3226e862f7e", "eventTime": "2017-05-26T22:27:18Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIA0M6YI2QVSLNTEIAE", "expiration": "May 26, 2017 11:27:18 PM", "sessionToken": "FQoDYXdzECAaDEHniUtg9AzaiEre+iLMAbEEd95ZT4CJ5ea6aLPELZBUqfAaSL5T8hP1N6Kyy1Wr3pQZeoT7KpZ2pa/TNCU6lONpwgAFWt03xAx83bdlUkd42QdOhbSqpMnrWB5JBLbBCHZgn3A4CA/HXcUPl+JkqSjPBzLRDS28zZ6qf2SHkFffXTg+1iEg7U8Y0SpLx2skHDIqvwRHTETL1d9B9T+PTJ5d277Bbh9TNa+zdoKZdVqQRr6CTqZLNsf04FUss0NPCimZjQpB/8GDvlXAz4d5hAxz+GybudNYUV9jQijG16LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7852b014-f8b2-4b63-a98e-2ff452aae493", "record_id": "flaws_cloudtrail:0000274:7852b014-f8b2-4b63-a98e-2ff452aae493", "row_index": 274, "timestamp": "2017-05-26T22:27:18Z", "event_type": "ListCertificates", "event_source": "acm.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAGOJFA06UQVWD06Z8", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1137, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7852b014-f8b2-4b63-a98e-2ff452aae493", "eventTime": "2017-05-26T22:27:18Z", "eventName": "ListCertificates", "eventSource": "acm.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey is not authorized to perform: acm:ListCertificates", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAGOJFA06UQVWD06Z8", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:17Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e9fbe97c-cb54-4eff-a0ce-f642fe2357de", "record_id": "flaws_cloudtrail:0000275:e9fbe97c-cb54-4eff-a0ce-f642fe2357de", "row_index": 275, "timestamp": "2017-05-26T22:27:18Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1455, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e9fbe97c-cb54-4eff-a0ce-f642fe2357de", "eventTime": "2017-05-26T22:27:18Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIA9P7499U7CA1QB1KR", "expiration": "May 26, 2017 11:27:18 PM", "sessionToken": "FQoDYXdzECAaDBcTKV80sHw8wVOMECLMAcYkUTfylMrH/65ymCCP598eZDLQRy9hDYAT0Im8DqGm0a1PtFmvVrkJG375L4aVciZR2k+zM9VRUNJgem3tc6GL0YuXEU/3Ue6jTanzEvt51F4g17/5yDteFVT0lA878I4EslJdqsA/AzaVZcxpct2RUSR4giEJq3JyIwVhU62YtxUXFu5vmYnqnLXA7K5siTrbjka4lWCzRSC9AvhrgNqqhOTZXxclh0RY7sLHLNKdnnFr6utknT2VjaGq1GCEO/jbRYecQ+SdFLrysCjG16LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c025750-f863-49c5-b5a0-25463d", "record_id": "flaws_cloudtrail:0000276:c025750-f863-49c5-b5a0-25463d", "row_index": 276, "timestamp": "2017-05-26T22:27:18Z", "event_type": "DescribeRegions", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA0M6YI2QVSLNTEIAE", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto/2.47.0 Python/2.7.12 Linux/4.4.0-78-generic", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 961, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c025750-f863-49c5-b5a0-25463d", "eventTime": "2017-05-26T22:27:18Z", "eventName": "DescribeRegions", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto/2.47.0 Python/2.7.12 Linux/4.4.0-78-generic", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA0M6YI2QVSLNTEIAE", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:18Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"regionSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9a21c567-4fd4-4c76-940d-27b9711b5234", "record_id": "flaws_cloudtrail:0000277:9a21c567-4fd4-4c76-940d-27b9711b5234", "row_index": 277, "timestamp": "2017-05-26T22:27:18Z", "event_type": "DescribeLoadBalancers", "event_source": "elasticloadbalancing.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/cloudaux", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:cloudaux", "user_name": null, "access_key_id": "ASIAAQHRQD6ZEXFK33M4", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1034, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9a21c567-4fd4-4c76-940d-27b9711b5234", "eventTime": "2017-05-26T22:27:18Z", "eventName": "DescribeLoadBalancers", "eventSource": "elasticloadbalancing.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:cloudaux", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/cloudaux", "accountId": "811596193553", "accessKeyId": "ASIAAQHRQD6ZEXFK33M4", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:17Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "responseElements": {"loadBalancers": []}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6260a172-2871-4539-a048-7c79e26d216d", "record_id": "flaws_cloudtrail:0000278:6260a172-2871-4539-a048-7c79e26d216d", "row_index": 278, "timestamp": "2017-05-26T22:27:19Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6260a172-2871-4539-a048-7c79e26d216d", "eventTime": "2017-05-26T22:27:19Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAV9C03EHGEMJCOXEY", "expiration": "May 26, 2017 11:27:19 PM", "sessionToken": "FQoDYXdzECAaDPezCoZIXnwwNxT2lSLMAR3G8RDnXVc64TIli2AdkIuI9CXbYudpMSdpKQ+lFRFpHOfGVgRmkjclq4kl9w6KJOizvYsRr7tZ/9LA1vx1bBOUKLI0UBSu2JYKV4pgEnTw3oEUXYV8Dy47D5tzbPN2WGk3Z69tn+A3wDHC/PS5V+B+k60yejC/bC0xwQbdr/oyBpKhoofhJJ1InzZL1pQ9I28ccHFvBmuAoICRmBco8TYW3xR1RYpFJaMHjI32xw5FrcU4e0dO6tT3TwYSilwEG4lRj4uUZs+Vd5twvijH16LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "add596c4-6a9d-4fdd-a453-79c8359e5390", "record_id": "flaws_cloudtrail:0000279:add596c4-6a9d-4fdd-a453-79c8359e5390", "row_index": 279, "timestamp": "2017-05-26T22:27:19Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "add596c4-6a9d-4fdd-a453-79c8359e5390", "eventTime": "2017-05-26T22:27:19Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIABRK61L3D1G9PE021", "expiration": "May 26, 2017 11:27:19 PM", "sessionToken": "FQoDYXdzECAaDOrvh3qDwLyIHaH/uyLMAXSXts9lE6Myy5ylMvkqLrT/XJW6c4lFS+P68YcPb8t1fmkChBg5JU93Tt/yerSR4AibVu+lwzHBCvrYrNLPqz12eWMMH9OZrT4qgkdMyZmy1l7qak0GA1kVgDXY8LtbvjEib4LkAoor6LQY8wtU+jo5Gw0TRQO1vQ/I1xbtFdPqe8INf/C1+igK7w87K5X3wwP01twNbE8psnuV6h7zjPDuedAbBuQqlCHvN2SfHRkvGBxfw1d7U7rIwTSAM9u/vTOkYK8xBfACqzcIBCjH16LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e0a48d10-61fc-479f-905d-196ce9bbf9f7", "record_id": "flaws_cloudtrail:0000280:e0a48d10-61fc-479f-905d-196ce9bbf9f7", "row_index": 280, "timestamp": "2017-05-26T22:27:19Z", "event_type": "ListCertificates", "event_source": "acm.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA9P7499U7CA1QB1KR", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1137, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e0a48d10-61fc-479f-905d-196ce9bbf9f7", "eventTime": "2017-05-26T22:27:19Z", "eventName": "ListCertificates", "eventSource": "acm.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey is not authorized to perform: acm:ListCertificates", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA9P7499U7CA1QB1KR", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:18Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5f55906-f13f-4384-a17e-1c597fad64c3", "record_id": "flaws_cloudtrail:0000281:5f55906-f13f-4384-a17e-1c597fad64c3", "row_index": 281, "timestamp": "2017-05-26T22:27:19Z", "event_type": "ListCertificates", "event_source": "acm.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIABRK61L3D1G9PE021", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1136, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5f55906-f13f-4384-a17e-1c597fad64c3", "eventTime": "2017-05-26T22:27:19Z", "eventName": "ListCertificates", "eventSource": "acm.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-west-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey is not authorized to perform: acm:ListCertificates", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIABRK61L3D1G9PE021", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:19Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "742fa89b-1f5b-4894-9527-78f734bd8e9b", "record_id": "flaws_cloudtrail:0000282:742fa89b-1f5b-4894-9527-78f734bd8e9b", "row_index": 282, "timestamp": "2017-05-26T22:27:20Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAV9C03EHGEMJCOXEY", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 1037, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "742fa89b-1f5b-4894-9527-78f734bd8e9b", "eventTime": "2017-05-26T22:27:20Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-south-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAV9C03EHGEMJCOXEY", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:19Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fc613cad-f9a7-4198-a44e-a33c59285c3f", "record_id": "flaws_cloudtrail:0000283:fc613cad-f9a7-4198-a44e-a33c59285c3f", "row_index": 283, "timestamp": "2017-05-26T22:27:20Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 881, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fc613cad-f9a7-4198-a44e-a33c59285c3f", "eventTime": "2017-05-26T22:27:20Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ffb81eef-cda5-4afc-a7e7-77fe61a568331", "record_id": "flaws_cloudtrail:0000284:ffb81eef-cda5-4afc-a7e7-77fe61a568331", "row_index": 284, "timestamp": "2017-05-26T22:27:21Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAV9C03EHGEMJCOXEY", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 1004, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ffb81eef-cda5-4afc-a7e7-77fe61a568331", "eventTime": "2017-05-26T22:27:21Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-south-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAV9C03EHGEMJCOXEY", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:19Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c3c26c9f-3278-4a52-baf9-b587d8d86dfe", "record_id": "flaws_cloudtrail:0000285:c3c26c9f-3278-4a52-baf9-b587d8d86dfe", "row_index": 285, "timestamp": "2017-05-26T22:27:21Z", "event_type": "DescribeTags", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAV9C03EHGEMJCOXEY", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 981, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c3c26c9f-3278-4a52-baf9-b587d8d86dfe", "eventTime": "2017-05-26T22:27:21Z", "eventName": "DescribeTags", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-south-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAV9C03EHGEMJCOXEY", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:19Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a7bc81eb-5cc2-4bf2-b47a-27e4adf372b2", "record_id": "flaws_cloudtrail:0000286:a7bc81eb-5cc2-4bf2-b47a-27e4adf372b2", "row_index": 286, "timestamp": "2017-05-26T22:27:21Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a7bc81eb-5cc2-4bf2-b47a-27e4adf372b2", "eventTime": "2017-05-26T22:27:21Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIA1YPK11Q9UDR1M49U", "expiration": "May 26, 2017 11:27:21 PM", "sessionToken": "FQoDYXdzECAaDIoArLj4QH0CeGvLKiLMAXW1QYRGDZs9T06JdyOAoqZlpYJd/GQIrIcfeR/o/C5SH4mjFhPMJWtQ2zqN7RQRKqt0G2klovHoY8MfxD5Sz4q+7TAgoRL9hDDQwLW6ZOG4bXbUCZiT2o84ChRVX3K0Qn3PZPdFin7oXa8DyoScDmNR2QQSzGo1cRcmnPbUpwLaN3yRcMRpRwrf4WveIMbC7NDkEzQlavEOHi4q48wRHmUA6dk/uOa5PygdsDUn6lTCk/qdOnPAqd+jWl3Ng8w24qMt2hrvF4hlC6ic7CjJ16LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ff265b4c-42e2-4dea-a6d8-0a5d6120f736", "record_id": "flaws_cloudtrail:0000287:ff265b4c-42e2-4dea-a6d8-0a5d6120f736", "row_index": 287, "timestamp": "2017-05-26T22:27:22Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA1YPK11Q9UDR1M49U", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1036, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ff265b4c-42e2-4dea-a6d8-0a5d6120f736", "eventTime": "2017-05-26T22:27:22Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "eu-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA1YPK11Q9UDR1M49U", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:21Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fb701f18-d5a3-481e-9a1f-989ee79b9646", "record_id": "flaws_cloudtrail:0000288:fb701f18-d5a3-481e-9a1f-989ee79b9646", "row_index": 288, "timestamp": "2017-05-26T22:27:23Z", "event_type": "DescribeTags", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA1YPK11Q9UDR1M49U", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 980, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fb701f18-d5a3-481e-9a1f-989ee79b9646", "eventTime": "2017-05-26T22:27:23Z", "eventName": "DescribeTags", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "eu-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA1YPK11Q9UDR1M49U", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:21Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f2b8c60c-3507-4f25-bbcd-b49be4789bfe", "record_id": "flaws_cloudtrail:0000289:f2b8c60c-3507-4f25-bbcd-b49be4789bfe", "row_index": 289, "timestamp": "2017-05-26T22:27:23Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA1YPK11Q9UDR1M49U", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1003, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f2b8c60c-3507-4f25-bbcd-b49be4789bfe", "eventTime": "2017-05-26T22:27:23Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "eu-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA1YPK11Q9UDR1M49U", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:21Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f1f3b304-50e5-42a7-87e3-8512ea6f3b48", "record_id": "flaws_cloudtrail:0000290:f1f3b304-50e5-42a7-87e3-8512ea6f3b48", "row_index": 290, "timestamp": "2017-05-26T22:27:23Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f1f3b304-50e5-42a7-87e3-8512ea6f3b48", "eventTime": "2017-05-26T22:27:23Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAUCRRALB71AC80I49", "expiration": "May 26, 2017 11:27:23 PM", "sessionToken": "FQoDYXdzECAaDPJpPCW7mIJQeMAZPiLMAQ7NmW2+SVUUXmK+3mKY7Bpw7hsbWowngPIO3C8PZr3RMFTtbAcWS/ThV+zj5WbH4NkMCU5PhzemlFuIJnAXihSCXsZaqL6YtXpWvLBC/pGA22NfP1XUPlssXXoB3Bdc2FhYwoQnXP/toBv97PfJWyVd8yNlPz8WiInenqY+9Dqg/7PVAq7So4o+Vok/DWqutcOvddr+t5eQ6rHR5yailWFeNafYf22vkgPIb8XHeKXm/talYkH1Dw0/OQsYjUt5TxqqGpfOodUgXw/vrCjL16LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "80c8ca8a-9560-4353-b99a-c932a9f0df27", "record_id": "flaws_cloudtrail:0000291:80c8ca8a-9560-4353-b99a-c932a9f0df27", "row_index": 291, "timestamp": "2017-05-26T22:27:23Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 882, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "80c8ca8a-9560-4353-b99a-c932a9f0df27", "eventTime": "2017-05-26T22:27:23Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7ad8bb05-56ac-4f65-8556-cd1cdb4c8984", "record_id": "flaws_cloudtrail:0000292:7ad8bb05-56ac-4f65-8556-cd1cdb4c8984", "row_index": 292, "timestamp": "2017-05-26T22:27:25Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAUCRRALB71AC80I49", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1041, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7ad8bb05-56ac-4f65-8556-cd1cdb4c8984", "eventTime": "2017-05-26T22:27:25Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAUCRRALB71AC80I49", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:23Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8c22d0b5-3b5f-4c52-8b15-e014c189fd0f", "record_id": "flaws_cloudtrail:0000293:8c22d0b5-3b5f-4c52-8b15-e014c189fd0f", "row_index": 293, "timestamp": "2017-05-26T22:27:25Z", "event_type": "DescribeTags", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAUCRRALB71AC80I49", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 985, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8c22d0b5-3b5f-4c52-8b15-e014c189fd0f", "eventTime": "2017-05-26T22:27:25Z", "eventName": "DescribeTags", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAUCRRALB71AC80I49", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:23Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0ca8cc23-b562-45de-b1c0-b6e540eab823", "record_id": "flaws_cloudtrail:0000294:0ca8cc23-b562-45de-b1c0-b6e540eab823", "row_index": 294, "timestamp": "2017-05-26T22:27:25Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAUCRRALB71AC80I49", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1008, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0ca8cc23-b562-45de-b1c0-b6e540eab823", "eventTime": "2017-05-26T22:27:25Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAUCRRALB71AC80I49", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:23Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f9412d55-f923-4d4b-8a95-6fb957e8bd91", "record_id": "flaws_cloudtrail:0000295:f9412d55-f923-4d4b-8a95-6fb957e8bd91", "row_index": 295, "timestamp": "2017-05-26T22:27:25Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f9412d55-f923-4d4b-8a95-6fb957e8bd91", "eventTime": "2017-05-26T22:27:25Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAZQODD4V3L8GKN0VG", "expiration": "May 26, 2017 11:27:25 PM", "sessionToken": "FQoDYXdzECAaDBuyaVBxK2gyp4rmiiLMAaxw+BPxFoRc+1g+QGG8SPpp2KeHpdJ3tmyjC+botFUe5ASj7X0uiK4SsQVcc03Pu/5O325K7aWqs5vmDZQnL6818FZdQtyAwzEdnMuE2OTAM+VEYxfXNFG6rzFD7bv603CG5jQL+2Pwb4Ki4rO+zff25N6cmc/n5wBQWU3BoKv0g4DLSsgf/QQxbv8e3Ur+bwYCTGpea+n1632P2XgvZ5GVFhWufZpkj24nfeXxrBBMv2r/vlx1ugJSUbBwIgLhxKNW2oNiiYgVN37Z7ijN16LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "714616a-5063-4f8b-8909-81c97ab69c64", "record_id": "flaws_cloudtrail:0000296:714616a-5063-4f8b-8909-81c97ab69c64", "row_index": 296, "timestamp": "2017-05-26T22:27:26Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAZQODD4V3L8GKN0VG", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1039, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "714616a-5063-4f8b-8909-81c97ab69c64", "eventTime": "2017-05-26T22:27:26Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAZQODD4V3L8GKN0VG", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:25Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f62113-f111-4285-9ae6-506aa01a3cd0", "record_id": "flaws_cloudtrail:0000297:f62113-f111-4285-9ae6-506aa01a3cd0", "row_index": 297, "timestamp": "2017-05-26T22:27:27Z", "event_type": "DescribeTags", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAZQODD4V3L8GKN0VG", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 984, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f62113-f111-4285-9ae6-506aa01a3cd0", "eventTime": "2017-05-26T22:27:27Z", "eventName": "DescribeTags", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAZQODD4V3L8GKN0VG", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:25Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bdbbe65f-16da-48aa-b9bc-e9462fbafc63", "record_id": "flaws_cloudtrail:0000298:bdbbe65f-16da-48aa-b9bc-e9462fbafc63", "row_index": 298, "timestamp": "2017-05-26T22:27:27Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAZQODD4V3L8GKN0VG", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1008, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bdbbe65f-16da-48aa-b9bc-e9462fbafc63", "eventTime": "2017-05-26T22:27:27Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAZQODD4V3L8GKN0VG", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:25Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "89615-42df-4a8c-bb44-ec1cceae57b0", "record_id": "flaws_cloudtrail:0000299:89615-42df-4a8c-bb44-ec1cceae57b0", "row_index": 299, "timestamp": "2017-05-26T22:27:27Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1446, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "89615-42df-4a8c-bb44-ec1cceae57b0", "eventTime": "2017-05-26T22:27:27Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIA4GRBQQF0BSDIPFIG", "expiration": "May 26, 2017 11:27:27 PM", "sessionToken": "FQoDYXdzECAaDPRwrsKxJi+8wTyaVCLMAUwdIuawzPU3uVVypgDXMMbFWrblqxAAfiko92IE9pfaXY5PlWr/dzpuu8zIUIJdniUBHiC2rg+FMxE2VjkhjSKN0RaYyIt8FpXI62wQO+FDtR6KjLxmH/xT8+HY4Bs1wEv8hWRv3R/7ygAQx0r42eCeIP9oZN2ElVzPbKeP3H8cZPi3uAPqukYkODbnx1Zk5aMy8DWqukcV7fDWkXHiMfiYUAOeKF8EJa2tHs2QtccAKSn8qsWjyOs3sFHIVITVQy1A7huIekiSU56/SCjP16LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "15dcc583-b94b-426b-840a-f9f18f76d234", "record_id": "flaws_cloudtrail:0000300:15dcc583-b94b-426b-840a-f9f18f76d234", "row_index": 300, "timestamp": "2017-05-26T22:27:28Z", "event_type": "DescribeTags", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA4GRBQQF0BSDIPFIG", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 978, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "15dcc583-b94b-426b-840a-f9f18f76d234", "eventTime": "2017-05-26T22:27:28Z", "eventName": "DescribeTags", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "sa-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA4GRBQQF0BSDIPFIG", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:27Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "389bf2ed-c4a7-4f37-b7c6-45d33bdc81ab", "record_id": "flaws_cloudtrail:0000301:389bf2ed-c4a7-4f37-b7c6-45d33bdc81ab", "row_index": 301, "timestamp": "2017-05-26T22:27:28Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA4GRBQQF0BSDIPFIG", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1036, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "389bf2ed-c4a7-4f37-b7c6-45d33bdc81ab", "eventTime": "2017-05-26T22:27:28Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "sa-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA4GRBQQF0BSDIPFIG", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:27Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "eaebd1f5-a2f9-4979-b2e4-689b2e807fed", "record_id": "flaws_cloudtrail:0000302:eaebd1f5-a2f9-4979-b2e4-689b2e807fed", "row_index": 302, "timestamp": "2017-05-26T22:27:29Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA4GRBQQF0BSDIPFIG", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1003, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "eaebd1f5-a2f9-4979-b2e4-689b2e807fed", "eventTime": "2017-05-26T22:27:29Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "sa-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA4GRBQQF0BSDIPFIG", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:27Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9847f3f7-dac8-4f5a-9316-c40bea810557d", "record_id": "flaws_cloudtrail:0000303:9847f3f7-dac8-4f5a-9316-c40bea810557d", "row_index": 303, "timestamp": "2017-05-26T22:27:29Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1455, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9847f3f7-dac8-4f5a-9316-c40bea810557d", "eventTime": "2017-05-26T22:27:29Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAVM2Q6LBUHIVZOBX9", "expiration": "May 26, 2017 11:27:29 PM", "sessionToken": "FQoDYXdzECAaDAB2HqDs2DnpY5YF2SLMAd8X85g8pDemg0c7+TXi2Buycwz1Z4LCFFm2MpJtpbnTCXfM14ORSG/bH1g1F89ezFlLXvo1qa1r20qxuwIaYBO1q/RvImdnxq1y8MpPFN6e9+0wfzcFN6iD37DDYxGkxZF0ZuQwgQiCnH59Q/9TPczSat9OsKBNeHNerx41elDGHB6v+Ptko7Y5Qaia4lXWEGusCKGCkt8oRjdNkjirRF8DdQF6j9Gix72fDZbmbVG52RikhICJflVxVQrqgzey9/XPl2Bw1eYxOdsQKyjR16LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5ab2dd6a-1522-4b29-b067-2acc9790d9fe", "record_id": "flaws_cloudtrail:0000304:5ab2dd6a-1522-4b29-b067-2acc9790d9fe", "row_index": 304, "timestamp": "2017-05-26T22:27:30Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAVM2Q6LBUHIVZOBX9", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1036, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5ab2dd6a-1522-4b29-b067-2acc9790d9fe", "eventTime": "2017-05-26T22:27:30Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ca-central-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAVM2Q6LBUHIVZOBX9", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:29Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b764ecd7-c94b-49db-bf5e-1c2c188300c3", "record_id": "flaws_cloudtrail:0000305:b764ecd7-c94b-49db-bf5e-1c2c188300c3", "row_index": 305, "timestamp": "2017-05-26T22:27:30Z", "event_type": "DescribeTags", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAVM2Q6LBUHIVZOBX9", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 983, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b764ecd7-c94b-49db-bf5e-1c2c188300c3", "eventTime": "2017-05-26T22:27:30Z", "eventName": "DescribeTags", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ca-central-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAVM2Q6LBUHIVZOBX9", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:29Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "240e1a0d-89bb-4647-8594-ce900ee1ae37", "record_id": "flaws_cloudtrail:0000306:240e1a0d-89bb-4647-8594-ce900ee1ae37", "row_index": 306, "timestamp": "2017-05-26T22:27:30Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAVM2Q6LBUHIVZOBX9", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1006, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "240e1a0d-89bb-4647-8594-ce900ee1ae37", "eventTime": "2017-05-26T22:27:30Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ca-central-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAVM2Q6LBUHIVZOBX9", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:29Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f00eae87-3764-445e-98c8-70c089ca0dc1", "record_id": "flaws_cloudtrail:0000307:f00eae87-3764-445e-98c8-70c089ca0dc1", "row_index": 307, "timestamp": "2017-05-26T22:27:30Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 881, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f00eae87-3764-445e-98c8-70c089ca0dc1", "eventTime": "2017-05-26T22:27:30Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "eb181cae-c6e1-43d9-8880-f277d0e2671a", "record_id": "flaws_cloudtrail:0000308:eb181cae-c6e1-43d9-8880-f277d0e2671a", "row_index": 308, "timestamp": "2017-05-26T22:27:31Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "eb181cae-c6e1-43d9-8880-f277d0e2671a", "eventTime": "2017-05-26T22:27:31Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAAB77VDFCYTJPJGAQ", "expiration": "May 26, 2017 11:27:31 PM", "sessionToken": "FQoDYXdzECAaDDJRuSq8aQj6Zp2l7CLMAakeQMRxv13ujE2xEsYt5QvnwQJQoEYL1OmAsaocIgtDAzNiqPQ9vgk5vkORL+RiB3bxytKafxMpSf1s9MicIKUQyq2eHTTAcgSpBCVtHDWOgJWamA96PG0UhEik5wlM5k+6iCd5m7cgfue9AMvz+BU/8CUI3vEh32cljl88zMzLXpH6WK+5xwZS21UfF6XpKFLMMr7mB8kC2IfHw+xAosyOhOw5l1tJGac5KNdUjr4NpyE46qmNPbLbtQ62gKrXsCoH+EeIRlLZy0lnMijT16LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "99a409689-1a70-447b-952f-1cbdbe0e30f0", "record_id": "flaws_cloudtrail:0000309:99a409689-1a70-447b-952f-1cbdbe0e30f0", "row_index": 309, "timestamp": "2017-05-26T22:27:32Z", "event_type": "DescribeTags", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAAB77VDFCYTJPJGAQ", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 986, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "99a409689-1a70-447b-952f-1cbdbe0e30f0", "eventTime": "2017-05-26T22:27:32Z", "eventName": "DescribeTags", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAAB77VDFCYTJPJGAQ", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:31Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c42534a4-0c3f-42a3-b5a1-5426e93d1e92", "record_id": "flaws_cloudtrail:0000310:c42534a4-0c3f-42a3-b5a1-5426e93d1e92", "row_index": 310, "timestamp": "2017-05-26T22:27:32Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAAB77VDFCYTJPJGAQ", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1008, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c42534a4-0c3f-42a3-b5a1-5426e93d1e92", "eventTime": "2017-05-26T22:27:32Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAAB77VDFCYTJPJGAQ", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:31Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "680027d1d-207a-471f-8cb2-f27e6b2ddcfc", "record_id": "flaws_cloudtrail:0000311:680027d1d-207a-471f-8cb2-f27e6b2ddcfc", "row_index": 311, "timestamp": "2017-05-26T22:27:32Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAAB77VDFCYTJPJGAQ", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1043, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "680027d1d-207a-471f-8cb2-f27e6b2ddcfc", "eventTime": "2017-05-26T22:27:32Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAAB77VDFCYTJPJGAQ", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:31Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a2abb978-f054-407c-84ff-0d978f56b02d", "record_id": "flaws_cloudtrail:0000312:a2abb978-f054-407c-84ff-0d978f56b02d", "row_index": 312, "timestamp": "2017-05-26T22:27:33Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a2abb978-f054-407c-84ff-0d978f56b02d", "eventTime": "2017-05-26T22:27:33Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIA9340DOP91ANFJXXE", "expiration": "May 26, 2017 11:27:33 PM", "sessionToken": "FQoDYXdzECAaDF2hXFitidFZXTn1biLMAef2Ci5GkuZjLPQ3FQBTUVxDsdNK5I8V92+uBTnqI0nzSbnWGbBTcljvWbYgMpdIXE5lNsa97lTp8YEGyZ3y+zl7rEb6DNDsYnO17TXGi0W6jooM8Ek1PcItPbRnPPdIdZn+bCD/wVufI0s5AKAGvsje0cPOM9HXtrlUkt6WixaQjyRgldMx7FfRfMYqYgqwHt5QG8Q/vJlFd70P3D5f3sR6oZrnBrU/8gRf9vjiihuU4SbjMP5dZ/HYhiqw+ZeMgzb9vY0jg3lYsnFUACjV16LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b6d4d3a0-72db-4ff4-ae91-f35225dd82", "record_id": "flaws_cloudtrail:0000313:b6d4d3a0-72db-4ff4-ae91-f35225dd82", "row_index": 313, "timestamp": "2017-05-26T22:27:34Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA9340DOP91ANFJXXE", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1037, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b6d4d3a0-72db-4ff4-ae91-f35225dd82", "eventTime": "2017-05-26T22:27:34Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "eu-central-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA9340DOP91ANFJXXE", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:33Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9f839fe5-e1f0-447f-8f04-ca724a1a2733", "record_id": "flaws_cloudtrail:0000314:9f839fe5-e1f0-447f-8f04-ca724a1a2733", "row_index": 314, "timestamp": "2017-05-26T22:27:34Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA9340DOP91ANFJXXE", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1006, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9f839fe5-e1f0-447f-8f04-ca724a1a2733", "eventTime": "2017-05-26T22:27:34Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "eu-central-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA9340DOP91ANFJXXE", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:33Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d3d4d141-6a2b-4331-a6d0-f238980aa20f", "record_id": "flaws_cloudtrail:0000315:d3d4d141-6a2b-4331-a6d0-f238980aa20f", "row_index": 315, "timestamp": "2017-05-26T22:27:34Z", "event_type": "DescribeTags", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA9340DOP91ANFJXXE", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 983, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d3d4d141-6a2b-4331-a6d0-f238980aa20f", "eventTime": "2017-05-26T22:27:34Z", "eventName": "DescribeTags", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "eu-central-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA9340DOP91ANFJXXE", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:33Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "717441-37f6-41ba-8c62-1945fa56d483", "record_id": "flaws_cloudtrail:0000316:717441-37f6-41ba-8c62-1945fa56d483", "row_index": 316, "timestamp": "2017-05-26T22:27:34Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1450, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "717441-37f6-41ba-8c62-1945fa56d483", "eventTime": "2017-05-26T22:27:34Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIA7XYPRR1VEX47CFY9", "expiration": "May 26, 2017 11:27:34 PM", "sessionToken": "FQoDYXdzECAaDHRmPCmWEXiTD4rqgSLMAbmVWUtwjhS7S1KVHAt0Y7sT5eHYzEidpFV0XgGMIZqNdykR5gCoe4MVHdrXM+MmYhnEB28XFcg8rEdNFTTZkQS7Q+AhP5rLrTt8sAmL5Q8hAptz8FYowbuI7UKNbW7f7ZxF2jF21c52lW2hZSPvfIjowpi7AjVHwoSXVrfpFn9Q3pb4pciZjjsWQEwn57CLcmNlpcpbwc10hauUAcaUL6ibdcx6Nw0TTpggA72AqDpS6IoE5AFCQkusC1QHdtXquXMp8k942ppFJhTLBijW16LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "079678d46-cb34-4723-ab85-3ebfc778513", "record_id": "flaws_cloudtrail:0000317:079678d46-cb34-4723-ab85-3ebfc778513", "row_index": 317, "timestamp": "2017-05-26T22:27:35Z", "event_type": "DescribeTags", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA7XYPRR1VEX47CFY9", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 979, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "079678d46-cb34-4723-ab85-3ebfc778513", "eventTime": "2017-05-26T22:27:35Z", "eventName": "DescribeTags", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA7XYPRR1VEX47CFY9", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "95ef52cd-018d-4fc9-b7b7-b67621e98", "record_id": "flaws_cloudtrail:0000318:95ef52cd-018d-4fc9-b7b7-b67621e98", "row_index": 318, "timestamp": "2017-05-26T22:27:35Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA7XYPRR1VEX47CFY9", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1033, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "95ef52cd-018d-4fc9-b7b7-b67621e98", "eventTime": "2017-05-26T22:27:35Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA7XYPRR1VEX47CFY9", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "26faefad-9ff8-416c-9688-2fc9e67205c0", "record_id": "flaws_cloudtrail:0000319:26faefad-9ff8-416c-9688-2fc9e67205c0", "row_index": 319, "timestamp": "2017-05-26T22:27:35Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA7XYPRR1VEX47CFY9", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1003, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "26faefad-9ff8-416c-9688-2fc9e67205c0", "eventTime": "2017-05-26T22:27:35Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA7XYPRR1VEX47CFY9", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8c427bf9-768d-4707-8ece-99e03d68a522", "record_id": "flaws_cloudtrail:0000320:8c427bf9-768d-4707-8ece-99e03d68a522", "row_index": 320, "timestamp": "2017-05-26T22:27:36Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 881, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8c427bf9-768d-4707-8ece-99e03d68a522", "eventTime": "2017-05-26T22:27:36Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1f09e777-82ce-4a7b-876e-7a2eef06b08c", "record_id": "flaws_cloudtrail:0000321:1f09e777-82ce-4a7b-876e-7a2eef06b08c", "row_index": 321, "timestamp": "2017-05-26T22:27:36Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 880, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1f09e777-82ce-4a7b-876e-7a2eef06b08c", "eventTime": "2017-05-26T22:27:36Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a5fc4b4a-26e5-4ece-956c-45845495fa5e", "record_id": "flaws_cloudtrail:0000322:a5fc4b4a-26e5-4ece-956c-45845495fa5e", "row_index": 322, "timestamp": "2017-05-26T22:27:36Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1451, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a5fc4b4a-26e5-4ece-956c-45845495fa5e", "eventTime": "2017-05-26T22:27:36Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAFLY635DS6T7MROT9", "expiration": "May 26, 2017 11:27:36 PM", "sessionToken": "FQoDYXdzECAaDC4NNEwwuy+a+wuBUyLMAQ6psEFJraAbSh+5auKk1BIeidhZKPqQhQC75jdz3pE/uc2G2zqZxARpqo3/bT8h6K2PXGn8pWLvpAegTn9vnciOFrrdirbgS0Od7qATZhVk689JnB/qOfNBY+aQarzYvBQTbAlJfCEa2a183/TxWZGBl0Pg9jlc5rG/TwMQeWankO7AlSEV4mtMmxQl1E53uA3y3ov+w2zYcIB2+q5ksPefsX2MfPUHTcO1rp/mxZqeLCDkIPnqdqZuFBpPGZrhVRY720kH93PtlTYEGSjY16LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4a1e59c4-93a9-42c3-bfdf-9108017a64b2", "record_id": "flaws_cloudtrail:0000323:4a1e59c4-93a9-42c3-bfdf-9108017a64b2", "row_index": 323, "timestamp": "2017-05-26T22:27:37Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAFLY635DS6T7MROT9", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1036, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4a1e59c4-93a9-42c3-bfdf-9108017a64b2", "eventTime": "2017-05-26T22:27:37Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAFLY635DS6T7MROT9", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:36Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3fb59cf2-b436-4392-b868-b9127ae00d92", "record_id": "flaws_cloudtrail:0000324:3fb59cf2-b436-4392-b868-b9127ae00d92", "row_index": 324, "timestamp": "2017-05-26T22:27:37Z", "event_type": "DescribeTags", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAFLY635DS6T7MROT9", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 980, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3fb59cf2-b436-4392-b868-b9127ae00d92", "eventTime": "2017-05-26T22:27:37Z", "eventName": "DescribeTags", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAFLY635DS6T7MROT9", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:36Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3c8ed2a9-8a86-49e1-a8fd-f7d820ef84ff", "record_id": "flaws_cloudtrail:0000325:3c8ed2a9-8a86-49e1-a8fd-f7d820ef84ff", "row_index": 325, "timestamp": "2017-05-26T22:27:37Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAFLY635DS6T7MROT9", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 998, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3c8ed2a9-8a86-49e1-a8fd-f7d820ef84ff", "eventTime": "2017-05-26T22:27:37Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAFLY635DS6T7MROT9", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:36Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "151622-df73-4b52-9a71-d98c5a742132", "record_id": "flaws_cloudtrail:0000326:151622-df73-4b52-9a71-d98c5a742132", "row_index": 326, "timestamp": "2017-05-26T22:27:38Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1450, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "151622-df73-4b52-9a71-d98c5a742132", "eventTime": "2017-05-26T22:27:38Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAXI4BDPVL4DVWZBUQ", "expiration": "May 26, 2017 11:27:38 PM", "sessionToken": "FQoDYXdzECAaDK29PNY8pPjJHNnCVyLMAen7ClIW+BFVQ3ODLEDevVhTtmLmbXzH1SV6+2yDzv6Q2pP8rd+0qrFP7bvV/hNSGjocIE9XUCg5rh53U0cbrESs0zgEc4TDoPzR+16sZP19Uny30uUQ7GctHfOaI57maBuSkbjnQ0nZh7lcXNUoyP1uf3PCQXE7KhCaVbAuEI+EDosbShqgm0oWKu1RbGGxByJlueluHfAbK/abd68ev34Jn9lp5p+u1P61Wrj3HLbqUmgFu9C4boiCfRynbiDngvRrBoLzIp0v0PsIySja16LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "119dfdac-bbed-4ac0-b324-d2f4b669e26d", "record_id": "flaws_cloudtrail:0000327:119dfdac-bbed-4ac0-b324-d2f4b669e26d", "row_index": 327, "timestamp": "2017-05-26T22:27:38Z", "event_type": "DescribeNetworkInterfaces", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAXI4BDPVL4DVWZBUQ", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto/2.47.0 Python/2.7.12 Linux/4.4.0-78-generic", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1004, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "119dfdac-bbed-4ac0-b324-d2f4b669e26d", "eventTime": "2017-05-26T22:27:38Z", "eventName": "DescribeNetworkInterfaces", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto/2.47.0 Python/2.7.12 Linux/4.4.0-78-generic", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAXI4BDPVL4DVWZBUQ", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:38Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"networkInterfaceIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a1c784e8-dd6a-49b5-99fe-d05dcae90631", "record_id": "flaws_cloudtrail:0000328:a1c784e8-dd6a-49b5-99fe-d05dcae90631", "row_index": 328, "timestamp": "2017-05-26T22:27:39Z", "event_type": "DescribeRegions", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA2FV77TX9PJYO0KNB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto/2.47.0 Python/2.7.12 Linux/4.4.0-78-generic", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 967, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a1c784e8-dd6a-49b5-99fe-d05dcae90631", "eventTime": "2017-05-26T22:27:39Z", "eventName": "DescribeRegions", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto/2.47.0 Python/2.7.12 Linux/4.4.0-78-generic", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA2FV77TX9PJYO0KNB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:39Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"regionSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "32bf2558-9cfb-4864-9624-437b6e7db749", "record_id": "flaws_cloudtrail:0000329:32bf2558-9cfb-4864-9624-437b6e7db749", "row_index": 329, "timestamp": "2017-05-26T22:27:39Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1453, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "32bf2558-9cfb-4864-9624-437b6e7db749", "eventTime": "2017-05-26T22:27:39Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAN76EQTTUPGMSJK4W", "expiration": "May 26, 2017 11:27:39 PM", "sessionToken": "FQoDYXdzECAaDFryMbRrQ3aOhPL6QyLMAT4/lHeRqg7WSUly52LkBcphaRRxgxP1xlWUZHOXFfm8qZTcMlbuVvdTzrtZx8pQ+RGxV9QrHE+Ykfj5xrlBz+0ygWyXeWKh8ta90Ai62XuXpVBrvnUItCpU+wET2xGGs7928VCblq340ymkc7N6chLiwF+wiJ5VBT1VXmAUNXHDtOMeAIk1jBohA4qgKbW0quFPt+hJicUGAG3AmXZZ1SmAYJNFTdVOovL9AEeulzpehwnnhWmfQ1tTInDo2VNkwPVCuLArwsoQROS52ijb16LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cfaf195d-8ff6-4c66-8b91-4214c06bbb49", "record_id": "flaws_cloudtrail:0000330:cfaf195d-8ff6-4c66-8b91-4214c06bbb49", "row_index": 330, "timestamp": "2017-05-26T22:27:39Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cfaf195d-8ff6-4c66-8b91-4214c06bbb49", "eventTime": "2017-05-26T22:27:39Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIA2FV77TX9PJYO0KNB", "expiration": "May 26, 2017 11:27:39 PM", "sessionToken": "FQoDYXdzECAaDDDDGybo4/F5J3C2RyLMAVtGSNbO7FfBM28f+c0Pbh3Ed2KmnExkRX8xbjIWnoPfoz05R2QP/LMOlF3KW0XLCC0e300wJZZLs5jjiwIi43XJo9y9hMs9t7jEGiO7udxFWn32N+E21O2nIci+TP7BtuvI1d1QwbYOv3AZjBpTs6t0AvCo3Rn8b5sFwxrMWzbhKa6ESzZ8bgVpkp+sdFgf/4Qls/eZQ/am4BmOvea/Pm1F0fpOyNID9fb27pA8/DoE6FFW01UcJu2Rmw0WD0Ujqv/rI4mUwS3K2ReJSijb16LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3bb715634-3e08-4c1c-9878-57ef95f4ca80", "record_id": "flaws_cloudtrail:0000331:3bb715634-3e08-4c1c-9878-57ef95f4ca80", "row_index": 331, "timestamp": "2017-05-26T22:27:41Z", "event_type": "DescribeKeyPairs", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAN76EQTTUPGMSJK4W", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 998, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3bb715634-3e08-4c1c-9878-57ef95f4ca80", "eventTime": "2017-05-26T22:27:41Z", "eventName": "DescribeKeyPairs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-south-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAN76EQTTUPGMSJK4W", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:39Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"keySet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4a2454a6-d26d-459e-a4de-4b7f5191e2dc", "record_id": "flaws_cloudtrail:0000332:4a2454a6-d26d-459e-a4de-4b7f5191e2dc", "row_index": 332, "timestamp": "2017-05-26T22:27:41Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1451, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4a2454a6-d26d-459e-a4de-4b7f5191e2dc", "eventTime": "2017-05-26T22:27:41Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIA1DOG8BLSF5V8GWXQ", "expiration": "May 26, 2017 11:27:41 PM", "sessionToken": "FQoDYXdzECAaDIutgJusVRPOzzWpCyLMAbwq8rvE0R9MhNpn4ylhDSpUJjxGXS9ka+czUq2YH5TnM/mQBnVf12hmBY1s72tEy5Pgk1IPfi+aSLcws7jwKwDLZ1kBgpQ9alVk3dN6PVUfYp+E9a8RedDU/YM2+g1L9zZHkDM4HNFiiXqIZ5OS2418LM+NLWK+3v6QFlxvgkuVQSruEsmk8ztJBSLJ68OoJyaybAkodA7vFNWFaOYbs+379ZBBsRQ3F8HXb7mhZOo0xfoVQmsZfIU2ZxgsG8ySyOaRgCaDsfSWxu0gBijd16LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2fa6e976-e59f-444e-8eea-8d3beb92a071", "record_id": "flaws_cloudtrail:0000333:2fa6e976-e59f-444e-8eea-8d3beb92a071", "row_index": 333, "timestamp": "2017-05-26T22:27:42Z", "event_type": "DescribeKeyPairs", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA1DOG8BLSF5V8GWXQ", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 996, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2fa6e976-e59f-444e-8eea-8d3beb92a071", "eventTime": "2017-05-26T22:27:42Z", "eventName": "DescribeKeyPairs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "eu-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA1DOG8BLSF5V8GWXQ", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:41Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"keySet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ace789864-75ce-4ae9-b9b1-aa7f3b34fe27", "record_id": "flaws_cloudtrail:0000334:ace789864-75ce-4ae9-b9b1-aa7f3b34fe27", "row_index": 334, "timestamp": "2017-05-26T22:27:42Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1455, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ace789864-75ce-4ae9-b9b1-aa7f3b34fe27", "eventTime": "2017-05-26T22:27:42Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIA087P12HVOQEMS2HQ", "expiration": "May 26, 2017 11:27:42 PM", "sessionToken": "FQoDYXdzECAaDBh9/VV2ekFWJCdjuyLMAf2ngrNierVLi+VNXRE3iPlifLTAcKW7KpQsKzSXF//mEFgfroX1PD1ugVtv9ZtTpYUlrX03ve0AK71sLJdyIRJgzR0EH23ZNuxr5NgzUsmtNPyzyPlHK8eufFFT8/O/F/aaz/ZFWxUf20DFMylxfgm6C7IapQNKOsiPSzHeTaZbuJ5JhG0+yXe5vgCqq07RveVveBBvgpTdrB2il499CnocnrOqDfU9bpmUWXNsxZVtKQ47x7sJyIBVHbloW3z5Z0lg3lA7k//0Kc9ioCje16LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "650959-d314-4dbe-a526-1e2a72714", "record_id": "flaws_cloudtrail:0000335:650959-d314-4dbe-a526-1e2a72714", "row_index": 335, "timestamp": "2017-05-26T22:27:43Z", "event_type": "DescribeKeyPairs", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA087P12HVOQEMS2HQ", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 991, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "650959-d314-4dbe-a526-1e2a72714", "eventTime": "2017-05-26T22:27:43Z", "eventName": "DescribeKeyPairs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "eu-west-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA087P12HVOQEMS2HQ", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:42Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"keySet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "767621fd0-8694-4216-a680-6993a2ffb552", "record_id": "flaws_cloudtrail:0000336:767621fd0-8694-4216-a680-6993a2ffb552", "row_index": 336, "timestamp": "2017-05-26T22:27:43Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 882, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "767621fd0-8694-4216-a680-6993a2ffb552", "eventTime": "2017-05-26T22:27:43Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "89e545dc-5aba-4550-8cd2-021a056b0a25", "record_id": "flaws_cloudtrail:0000337:89e545dc-5aba-4550-8cd2-021a056b0a25", "row_index": 337, "timestamp": "2017-05-26T22:27:44Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1455, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "89e545dc-5aba-4550-8cd2-021a056b0a25", "eventTime": "2017-05-26T22:27:44Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIA2C5GS7X04KDM073P", "expiration": "May 26, 2017 11:27:44 PM", "sessionToken": "FQoDYXdzECAaDGOZu5UCFtYgeTPjVSLMARmSd2ADY9B9dFCVG/CsCmow9ydQNQmq5Topg3UhTyCFcyin57ydGor0aD1Bhof1jcD3djPM9ShIfjJw1iQ9H3nNMx3iS/xXdnK8jbHC58hD17CrHd9bm02NvETKaAF9tXsKX7os1hDNmyRcm4AiQ2PvRLKFt4aa4MM5TmHlsYjk/idMCnI/XoCLHi2xrwxXxTUjKAtyfHeKMyC2dpWO94GoozKaCTpeicMMdhJ1xdTvoqdp9pzhySabJteeNPkMJYzAwKd03PenaLfwCijg16LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "72ef43cc-a2dc-4892-affb-885a82465487", "record_id": "flaws_cloudtrail:0000338:72ef43cc-a2dc-4892-affb-885a82465487", "row_index": 338, "timestamp": "2017-05-26T22:27:45Z", "event_type": "DescribeKeyPairs", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA2C5GS7X04KDM073P", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1002, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "72ef43cc-a2dc-4892-affb-885a82465487", "eventTime": "2017-05-26T22:27:45Z", "eventName": "DescribeKeyPairs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA2C5GS7X04KDM073P", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:44Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"keySet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "047078f5-ac65-4cf1-bdd8-87a2afd1552a", "record_id": "flaws_cloudtrail:0000339:047078f5-ac65-4cf1-bdd8-87a2afd1552a", "row_index": 339, "timestamp": "2017-05-26T22:27:45Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "047078f5-ac65-4cf1-bdd8-87a2afd1552a", "eventTime": "2017-05-26T22:27:45Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAWFY0BGPUGX3TCWPN", "expiration": "May 26, 2017 11:27:45 PM", "sessionToken": "FQoDYXdzECAaDFjfqUpnHr18SXI1GSLMAdAEKTxqeCpxkhm2W4RJ6jwYAuGvWdlGtWYg/egwChF71o5u/i5MI6M1L0fuL2RPm6aosNq3lf6rdOxJzlE3+xRnBtM1AWJr3p+7K5L7ZYgf2ZucxFMGzIFCnO+1KtPdUaBo8m9n46yqebUqtbX3mi7pKdfZ0G+z2ZN/ihHCrlKpCg2jG8iVFliv+HKW09JhjiCbDFb/bBt73hOUcEH3Vq9TArmu8hzf7oXGa25W4u+Mwut8+w8GR//0ndlP4f1cPwkYHU4lmQ9RasAMCijh16LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8122f778-c0e2-4aa0-805f-65ff5bc933d4", "record_id": "flaws_cloudtrail:0000340:8122f778-c0e2-4aa0-805f-65ff5bc933d4", "row_index": 340, "timestamp": "2017-05-26T22:27:46Z", "event_type": "DescribeKeyPairs", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAWFY0BGPUGX3TCWPN", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 996, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8122f778-c0e2-4aa0-805f-65ff5bc933d4", "eventTime": "2017-05-26T22:27:46Z", "eventName": "DescribeKeyPairs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "sa-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAWFY0BGPUGX3TCWPN", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:45Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"keySet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "385e1dc9-104d-4e6f-a6f0-c5d815c11c3f", "record_id": "flaws_cloudtrail:0000341:385e1dc9-104d-4e6f-a6f0-c5d815c11c3f", "row_index": 341, "timestamp": "2017-05-26T22:27:46Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 881, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "385e1dc9-104d-4e6f-a6f0-c5d815c11c3f", "eventTime": "2017-05-26T22:27:46Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e08c89c4-d410-4d57-8704-a854e1f8b289", "record_id": "flaws_cloudtrail:0000342:e08c89c4-d410-4d57-8704-a854e1f8b289", "row_index": 342, "timestamp": "2017-05-26T22:27:47Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1455, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e08c89c4-d410-4d57-8704-a854e1f8b289", "eventTime": "2017-05-26T22:27:47Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAVUFZ8AJIO1FZM1IN", "expiration": "May 26, 2017 11:27:47 PM", "sessionToken": "FQoDYXdzECAaDJbaDyozWwz9irG7eiLMAXBSo8MWp7nTbcy11AGCz4NypIHsMItaFkU6RhjK2vQaBVXa9VCPIb4lLXg31Os7L8hdfOAOu/3+N0pci0h3X39ddsuBLDRKXk+GxE+BP+NYfaCGNbLPRwQ4TB69P5PmBOB8vGu+cj8BulJ43a1KvU0Upy1tCfbR11GC79emUO8BoqyvwcNBgartspKgh21HgrWmDkwHj8TQrOqmSOniJse3H4pgneaZNnj6b1DNPnbInEIC6wg286xUoICz91YQyfW9E0N+/XRcm/wCaSjj16LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "376a635d-e7a9-4ff1-bb98-d13ae72b58c1", "record_id": "flaws_cloudtrail:0000343:376a635d-e7a9-4ff1-bb98-d13ae72b58c1", "row_index": 343, "timestamp": "2017-05-26T22:27:48Z", "event_type": "DescribeKeyPairs", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAVUFZ8AJIO1FZM1IN", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1001, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "376a635d-e7a9-4ff1-bb98-d13ae72b58c1", "eventTime": "2017-05-26T22:27:48Z", "eventName": "DescribeKeyPairs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAVUFZ8AJIO1FZM1IN", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:47Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"keySet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "77ae1967-3760-4979-bf33-45d8cab8688a", "record_id": "flaws_cloudtrail:0000344:77ae1967-3760-4979-bf33-45d8cab8688a", "row_index": 344, "timestamp": "2017-05-26T22:27:49Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "77ae1967-3760-4979-bf33-45d8cab8688a", "eventTime": "2017-05-26T22:27:49Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAC97NDWOJ8ZGHOL3N", "expiration": "May 26, 2017 11:27:48 PM", "sessionToken": "FQoDYXdzECAaDDOnXCqEdJ5r5iQIUiLMAfcT3VM66huAcM3vyYFjcJHG5IkkksTRYnIxCj8hJ6db/drtLt/hvAMMhbWemzu7joixFRthVgu96FA/sQu5EE+cfjWK4AiOJsRFJTAeCg+ocrixB1Q/oWLX280ajXHqzcb8uoJ4pdxmAFO6HR7/dkGhKMugndgx9j6Q9YzulsqwEj0Y+JZtTPD5glPdxiAGyQPGyofpIqld7pPlr1v+96gz4xzwp521uTS+qnLDScfbevhnKEIYVAWBINX9YajC73z+gz6nP15dpwkvUSjk16LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c061fdcc-ba24-4f8c-9ed9-249e33e9450c", "record_id": "flaws_cloudtrail:0000345:c061fdcc-ba24-4f8c-9ed9-249e33e9450c", "row_index": 345, "timestamp": "2017-05-26T22:27:50Z", "event_type": "DescribeKeyPairs", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAC97NDWOJ8ZGHOL3N", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1000, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c061fdcc-ba24-4f8c-9ed9-249e33e9450c", "eventTime": "2017-05-26T22:27:50Z", "eventName": "DescribeKeyPairs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAC97NDWOJ8ZGHOL3N", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:48Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"keySet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "18542ae4-87fc-4332-b8fa-40ea53ec4654", "record_id": "flaws_cloudtrail:0000346:18542ae4-87fc-4332-b8fa-40ea53ec4654", "row_index": 346, "timestamp": "2017-05-26T22:27:50Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "18542ae4-87fc-4332-b8fa-40ea53ec4654", "eventTime": "2017-05-26T22:27:50Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAYC95I1ITL1ZZPNQT", "expiration": "May 26, 2017 11:27:50 PM", "sessionToken": "FQoDYXdzECAaDLF6c6CsFpZ5KYYLfCLMAYm5rkYORiFiQLULjsnHB1MhhcBTGRVXD2hXlY+tTNTuN5baQYNCDiD/BpdbFCGf0jt3QwTpTIwsEr2ggqOTTXjEcPjFmiT/4NvkeTyU9R8mC1S2JFPl/YOS6pwWVLAReuoSN7q5twKQdMvYimyxNf2+/MxT10XLd9kxkSa7o2Vn/SAX8XiB82dI3+hUKjACgavdOsSUNUCqfRvjX+LS+Lfdk6wyBfktxwvI0zM1VLDF14CnTRw3kgUZrSGUAKA+cs6SvJjb+y8w6McIyijm16LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e61832b-d11a-4e4a-8124-9b1eb1858f83", "record_id": "flaws_cloudtrail:0000347:e61832b-d11a-4e4a-8124-9b1eb1858f83", "row_index": 347, "timestamp": "2017-05-26T22:27:51Z", "event_type": "DescribeKeyPairs", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAYC95I1ITL1ZZPNQT", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 999, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e61832b-d11a-4e4a-8124-9b1eb1858f83", "eventTime": "2017-05-26T22:27:51Z", "eventName": "DescribeKeyPairs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "eu-central-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAYC95I1ITL1ZZPNQT", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:50Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"keySet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2174b238-6eb0-4d4f-a2f3-5b885ff0eaa4", "record_id": "flaws_cloudtrail:0000348:2174b238-6eb0-4d4f-a2f3-5b885ff0eaa4", "row_index": 348, "timestamp": "2017-05-26T22:27:51Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2174b238-6eb0-4d4f-a2f3-5b885ff0eaa4", "eventTime": "2017-05-26T22:27:51Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIACMQH4HM0PQ9D59OV", "expiration": "May 26, 2017 11:27:51 PM", "sessionToken": "FQoDYXdzECAaDOoq1SVkVOLXbDJOXSLMAYC4droVZS0KZey2GcjzocHblqDA1gaH1dZhzKAbJ0r2fY735E1KukDR9WamYhbBzU5yXUaH2Xsuk09azdfzXNdIRyItq8FVpyHV8bNBkPzPC4+KhVuR3d/K6Fu7MvLoSdVnEI/yPocffREPkqx+wNPVShxzpZqAiOmWI47C+g/o20FHcjjpnX3l8PgbycMy7JtpRtqza52gDxZFWU7CuDMa3l+4KsMN2MMwjzi1X4HArqqK+DS44dmfUSGDoeKf5lAXKqGJO8+4QHuceSjn16LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "962f244c-b110-4938-876e-7375fcb1405e", "record_id": "flaws_cloudtrail:0000349:962f244c-b110-4938-876e-7375fcb1405e", "row_index": 349, "timestamp": "2017-05-26T22:27:52Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 881, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "962f244c-b110-4938-876e-7375fcb1405e", "eventTime": "2017-05-26T22:27:52Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0a90df6c-91a0-45c6-9d8b-7f30a56b7028", "record_id": "flaws_cloudtrail:0000350:0a90df6c-91a0-45c6-9d8b-7f30a56b7028", "row_index": 350, "timestamp": "2017-05-26T22:27:52Z", "event_type": "DescribeKeyPairs", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIACMQH4HM0PQ9D59OV", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 996, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0a90df6c-91a0-45c6-9d8b-7f30a56b7028", "eventTime": "2017-05-26T22:27:52Z", "eventName": "DescribeKeyPairs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIACMQH4HM0PQ9D59OV", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:51Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"keySet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "75411f0c-660e-4fc5-97a1-04a42ba7eb7e", "record_id": "flaws_cloudtrail:0000351:75411f0c-660e-4fc5-97a1-04a42ba7eb7e", "row_index": 351, "timestamp": "2017-05-26T22:27:53Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1449, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "75411f0c-660e-4fc5-97a1-04a42ba7eb7e", "eventTime": "2017-05-26T22:27:53Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIA9HR311TEKYD2ZKZJ", "expiration": "May 26, 2017 11:27:53 PM", "sessionToken": "FQoDYXdzECAaDHs4GyLq6n24V0Y1OiLMAS7nKhBzgSFQRdxBNAFwv7+EiMf2To+8wDoa5WiSTRnKsb054U7qim1ptGN9sXEWldY3w8wlnC+253VGg/jcSxLmBFbE7l4/NB2zpiTTxMECqJZRm00DMSJ+cdDwcK9/R/cD7IgeNaKk0g760WBxB/M5hSK1uSTN2J/0gzzbGaFmJ0JMNsmj+2Tay/R0Mz+D5P/cptYYxDT+V/uB01kJpjbB9ISBwejpNL5GR4X8H65ciZMWifgPb5xNm3eUUZ/vhYNptdLi7bo34FafnSjp16LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e965407-c818-4b58-9b79-3ee4823c08de", "record_id": "flaws_cloudtrail:0000352:e965407-c818-4b58-9b79-3ee4823c08de", "row_index": 352, "timestamp": "2017-05-26T22:27:53Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e965407-c818-4b58-9b79-3ee4823c08de", "eventTime": "2017-05-26T22:27:53Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIA10P9TYLPZLCORZ2M", "expiration": "May 26, 2017 11:27:53 PM", "sessionToken": "FQoDYXdzECAaDJUQ3Z8Gob+Gb3fn2SLMAcALeLPq+1zGIJiCWacFGQLSx1avXjhKfQOAgO96cGcQjmhaBcUx82y4GiQ/Pyns2AMTg4CuCbChiYKG31u7YgERpi8D3gDq9p+zDznFDqAZZHmQFg17TGXrY1NFh6Q0J8mJ6eJcfsVO0vdoSmfQHMP0GHf51YiaUxnnf5CYR/LUvAp1xkklNAA60aLV9+ISgdzIxMf3pTLuoV/q2p98Lbfo69PiWOk+VhehxW34wTMeLcX0/8Wd5F5Xe/7Etj4vqHNwSItDVZfFbthiUSjp16LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "57321cd3-31d9-45ef-9950-fc9a381fd89d", "record_id": "flaws_cloudtrail:0000353:57321cd3-31d9-45ef-9950-fc9a381fd89d", "row_index": 353, "timestamp": "2017-05-26T22:27:53Z", "event_type": "DescribeKeyPairs", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA9HR311TEKYD2ZKZJ", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 994, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "57321cd3-31d9-45ef-9950-fc9a381fd89d", "eventTime": "2017-05-26T22:27:53Z", "eventName": "DescribeKeyPairs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-west-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA9HR311TEKYD2ZKZJ", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:53Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"keySet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c44083-a2b4-45d9-822c-d9cb3ef86ce9", "record_id": "flaws_cloudtrail:0000354:c44083-a2b4-45d9-822c-d9cb3ef86ce9", "row_index": 354, "timestamp": "2017-05-26T22:27:54Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1452, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c44083-a2b4-45d9-822c-d9cb3ef86ce9", "eventTime": "2017-05-26T22:27:54Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIA49WIBXVBPAMDKHD6", "expiration": "May 26, 2017 11:27:54 PM", "sessionToken": "FQoDYXdzECAaDBvMkRmRDLYJmE26xyLMAeCVIR9mXdDh/midkwmzDJLrewAl+h/mPmKeWUFRLV/3g71xmRBNoObdstyBvU0I1e4Ldf+tfyUwbHq7uowc1JVcM5mcfNPuMPgjYsVfQ+k8Cs72lSvWEMSA5GG0r66BvWzd6zOTvA7pC5KmNtMZtQ9TF3soBmIuVvzPjXBGrKY8P+KqX11iMIqI2V6AweK0vxLtOlk6MkxTxzpZepiSbUKHsRktW4YPZfEGadjUmJgic5bgsa8bpSVz5mVznVLu3NW0M6U5+FMj6jNosijq16LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "05c6a880-8262-4be9-bff4-184259c954", "record_id": "flaws_cloudtrail:0000355:05c6a880-8262-4be9-bff4-184259c954", "row_index": 355, "timestamp": "2017-05-26T22:27:54Z", "event_type": "DescribeKeyPairs", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA10P9TYLPZLCORZ2M", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 994, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "05c6a880-8262-4be9-bff4-184259c954", "eventTime": "2017-05-26T22:27:54Z", "eventName": "DescribeKeyPairs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA10P9TYLPZLCORZ2M", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:53Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"keySet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bfde4a68-5cae-45c0-b78a-70b0a71b4775", "record_id": "flaws_cloudtrail:0000356:bfde4a68-5cae-45c0-b78a-70b0a71b4775", "row_index": 356, "timestamp": "2017-05-26T22:27:55Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1452, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bfde4a68-5cae-45c0-b78a-70b0a71b4775", "eventTime": "2017-05-26T22:27:55Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAMLD59YGD163N3LP2", "expiration": "May 26, 2017 11:27:55 PM", "sessionToken": "FQoDYXdzECAaDJ/sdgok4ZUhvKyneiLMARqUUpZ5WwZaqgTzBA2BJ2kCiF68knYuCMGSpoReCkINQ7+6bC6P7lynWWLgC5+eR8MJNkqeVzhFWApRHd/46YU0R4sJCUE2YadBTVsAlKAuoPj75auzrlfCknXsXW4ECpCHPrlJcndf9V5yN9CIraxRUM3Bzoa6AjFV16Qye1O9By79/RHwmRyQ8OiFtWj3vbtQdvc5CBL2pkm6DU7jQRQAsf9Q608RzUtFVxS03fiOMXRpmDdbVdP4KUp0OrCjhpEBEJ99EB5SncXoXSjr16LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "079094d0-9b66-4fbb-b6d0-a4effd26cc64", "record_id": "flaws_cloudtrail:0000357:079094d0-9b66-4fbb-b6d0-a4effd26cc64", "row_index": 357, "timestamp": "2017-05-26T22:27:55Z", "event_type": "DescribeDBSnapshots", "event_source": "rds.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA49WIBXVBPAMDKHD6", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1029, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "079094d0-9b66-4fbb-b6d0-a4effd26cc64", "eventTime": "2017-05-26T22:27:55Z", "eventName": "DescribeDBSnapshots", "eventSource": "rds.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-west-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA49WIBXVBPAMDKHD6", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:54Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"includePublic": false, "marker": "", "includeShared": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "45abdad2-b61e-4947-8e01-d16fe6d7c2bc", "record_id": "flaws_cloudtrail:0000358:45abdad2-b61e-4947-8e01-d16fe6d7c2bc", "row_index": 358, "timestamp": "2017-05-26T22:27:56Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "45abdad2-b61e-4947-8e01-d16fe6d7c2bc", "eventTime": "2017-05-26T22:27:56Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIABKXFUQUTPXNMD3JM", "expiration": "May 26, 2017 11:27:56 PM", "sessionToken": "FQoDYXdzECAaDBGyGTDwER4z0FooJiLMAYGVGenho6M/tni2/7hiu5/JKuRwywns6xnW6uzbF3hnKFZrdVMb59J3GFihsBIr2g7KR2dkHEVN3iUfPUuqelyKwnhPwD0IbQm0eH7o69tHrAd7h/AsqmZM0VoY2zwkWJwIZe5dH6NjO/SBpOB1Hsbckk2jcO+pqLYFVWlXpoZ64sWPGlp5ZGOq+yAAZ8RfrYBPUHowQ22edoVZvxkqf/CzFKm1J0C77maQ4PG3/VlonChHySBlXqYyOLkD0DApWB8qwhPQ42RDYFT31Sjs16LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5ee463b5-282c-44e5-b474-3cb9eeb14241", "record_id": "flaws_cloudtrail:0000359:5ee463b5-282c-44e5-b474-3cb9eeb14241", "row_index": 359, "timestamp": "2017-05-26T22:27:56Z", "event_type": "DescribeDBSnapshots", "event_source": "rds.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAMLD59YGD163N3LP2", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1028, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5ee463b5-282c-44e5-b474-3cb9eeb14241", "eventTime": "2017-05-26T22:27:56Z", "eventName": "DescribeDBSnapshots", "eventSource": "rds.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAMLD59YGD163N3LP2", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:55Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"includePublic": false, "marker": "", "includeShared": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "df14cf51-866a-4b6b-a3c4-110f363af849", "record_id": "flaws_cloudtrail:0000360:df14cf51-866a-4b6b-a3c4-110f363af849", "row_index": 360, "timestamp": "2017-05-26T22:27:57Z", "event_type": "DescribeDBSnapshots", "event_source": "rds.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIABKXFUQUTPXNMD3JM", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1033, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "df14cf51-866a-4b6b-a3c4-110f363af849", "eventTime": "2017-05-26T22:27:57Z", "eventName": "DescribeDBSnapshots", "eventSource": "rds.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIABKXFUQUTPXNMD3JM", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:56Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"includePublic": false, "marker": "", "includeShared": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1d0a2a4e-bc36-4d4f-bca6-7d51466a039d", "record_id": "flaws_cloudtrail:0000361:1d0a2a4e-bc36-4d4f-bca6-7d51466a039d", "row_index": 361, "timestamp": "2017-05-26T22:27:57Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 881, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1d0a2a4e-bc36-4d4f-bca6-7d51466a039d", "eventTime": "2017-05-26T22:27:57Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7dfe503a-fb3e-4b07-8991-7a17de5c9f05", "record_id": "flaws_cloudtrail:0000362:7dfe503a-fb3e-4b07-8991-7a17de5c9f05", "row_index": 362, "timestamp": "2017-05-26T22:27:58Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1455, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7dfe503a-fb3e-4b07-8991-7a17de5c9f05", "eventTime": "2017-05-26T22:27:58Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIASUXF2CZ0SQ3O2QDL", "expiration": "May 26, 2017 11:27:58 PM", "sessionToken": "FQoDYXdzECAaDMJFakBpkVLydP5qViLMAYPjYlNwX/fzhfSQSy3tJUBxrBXJl3D3iimS86nB71PUabiNJuB3UIaVTX7Xx9qibuYAETu+bTe18NymRwkRb+Dkh5jnCXweUoyVQS0pVrI3vAgwTmFZ2WBqtCInaGoBNVQcave9b3y6XIFonhmkoR/Q/ifkU652AwCZgthZQAtNkgq4MnFckVhh05Y5ylS9R+RgUudtGKiaYzz5fKWFi+SrTJad03UfYV4VhRYDn7pBi8Z8JkSIISsrOlLNqW4PpUY8GNE9jfpriwzT5Sju16LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8c4098c8-af21-4dba-873e-3ff49073137b", "record_id": "flaws_cloudtrail:0000363:8c4098c8-af21-4dba-873e-3ff49073137b", "row_index": 363, "timestamp": "2017-05-26T22:27:59Z", "event_type": "DescribeDBSnapshots", "event_source": "rds.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIASUXF2CZ0SQ3O2QDL", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1028, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8c4098c8-af21-4dba-873e-3ff49073137b", "eventTime": "2017-05-26T22:27:59Z", "eventName": "DescribeDBSnapshots", "eventSource": "rds.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "sa-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIASUXF2CZ0SQ3O2QDL", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:58Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"includePublic": false, "marker": "", "includeShared": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f55fc31e-e96b-476c-9218-0d6b70a7fdec", "record_id": "flaws_cloudtrail:0000364:f55fc31e-e96b-476c-9218-0d6b70a7fdec", "row_index": 364, "timestamp": "2017-05-26T22:27:59Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f55fc31e-e96b-476c-9218-0d6b70a7fdec", "eventTime": "2017-05-26T22:27:59Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAU0DCR6XZANH986PH", "expiration": "May 26, 2017 11:27:59 PM", "sessionToken": "FQoDYXdzECAaDOeuQoej+SEE2ZsAFSLMAXrwMlilLBVQ2shFtNTWKKp9wHhpGbzHlJ/aRQMrjZ6GUd9qkeVSuReasWEQAfRPIR5E7bcXAEAvEMAvkhQ1qdzDAeY4OiEXF6THCs1MDy7Rj326P2ZV7mJTki0AZFOl3NohaniF0WFZNL225RME2hStlAl8y4od3R5a57luyniAPucDFo1ckPV6eKIUbAOp3ukXZX2roTJo3KkvMtTZPayi0EDWQMZKTEW4O5yEwaWy6fYnryKxQagONk/zPIrVNR2N8UZPeCt+n7Udvyjv16LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8d6b709f-ee3a-4fcc-9410-40d5b9670e56", "record_id": "flaws_cloudtrail:0000365:8d6b709f-ee3a-4fcc-9410-40d5b9670e56", "row_index": 365, "timestamp": "2017-05-26T22:27:59Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 882, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8d6b709f-ee3a-4fcc-9410-40d5b9670e56", "eventTime": "2017-05-26T22:27:59Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "569c7997-4d95-4252-9811-5098d547f667", "record_id": "flaws_cloudtrail:0000366:569c7997-4d95-4252-9811-5098d547f667", "row_index": 366, "timestamp": "2017-05-26T22:28:00Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 881, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "569c7997-4d95-4252-9811-5098d547f667", "eventTime": "2017-05-26T22:28:00Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e3686ed5-da8a-4f6f-9d1b-0c586ae0de32", "record_id": "flaws_cloudtrail:0000367:e3686ed5-da8a-4f6f-9d1b-0c586ae0de32", "row_index": 367, "timestamp": "2017-05-26T22:28:00Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e3686ed5-da8a-4f6f-9d1b-0c586ae0de32", "eventTime": "2017-05-26T22:28:00Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIANADYVQBQX9Y6ZAF7", "expiration": "May 26, 2017 11:28:00 PM", "sessionToken": "FQoDYXdzECAaDO/g/EJhtfW0FJF7fyLMAVMCDHM6Wvq8FJhP9G24GMlj3d6JksZ9jW0d4l0qjhGtmHASaw9zkG3AOZc7dejj6Qy6N4PNiGFzdRL7iY5GowujLBSZTyuGoIUT4MdvK7Tku2U8S7WMl+Ys+mNT2iLO3f3Y/OxDlvTLz+KG+u5sAS8ZgR0yqKpkcDghvKFRpTWfNuphYgtJm6SF2k+VV1fbEFaRbthUKekxGsoXikbLZ9uoi8ccZGX+UfD5jnkErse4k+9Dh6b5hqcJ+jzJvn6JRPQj/q+ptQQRG45+gSjw16LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "92baf3dd-a0fd-4369-9432-67c967589fbb", "record_id": "flaws_cloudtrail:0000368:92baf3dd-a0fd-4369-9432-67c967589fbb", "row_index": 368, "timestamp": "2017-05-26T22:28:00Z", "event_type": "DescribeDBSnapshots", "event_source": "rds.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAU0DCR6XZANH986PH", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1028, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "92baf3dd-a0fd-4369-9432-67c967589fbb", "eventTime": "2017-05-26T22:28:00Z", "eventName": "DescribeDBSnapshots", "eventSource": "rds.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAU0DCR6XZANH986PH", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:27:59Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"includePublic": false, "marker": "", "includeShared": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3d3e74ae-305a-4bb1-acb0-af18301", "record_id": "flaws_cloudtrail:0000369:3d3e74ae-305a-4bb1-acb0-af18301", "row_index": 369, "timestamp": "2017-05-26T22:28:01Z", "event_type": "DescribeDBSnapshots", "event_source": "rds.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIANADYVQBQX9Y6ZAF7", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1026, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3d3e74ae-305a-4bb1-acb0-af18301", "eventTime": "2017-05-26T22:28:01Z", "eventName": "DescribeDBSnapshots", "eventSource": "rds.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ca-central-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIANADYVQBQX9Y6ZAF7", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:28:00Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"includePublic": false, "marker": "", "includeShared": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2e42b03b-889e-413f-9984-309e252dd884", "record_id": "flaws_cloudtrail:0000370:2e42b03b-889e-413f-9984-309e252dd884", "row_index": 370, "timestamp": "2017-05-26T22:28:01Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2e42b03b-889e-413f-9984-309e252dd884", "eventTime": "2017-05-26T22:28:01Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIACWXLG2T3DMUQYOCG", "expiration": "May 26, 2017 11:28:01 PM", "sessionToken": "FQoDYXdzECAaDNtw+tpCtYL/hsLEHCLMAUVAxSj32gu6uk0xHQtOByxSKV6DSgd7mhffvS7x5UhLzFVWL9ciBo6Zn+dDXIxZgEnA4iEcqmIi0hn9aWJW9Jdtxc86yqGdKtBOMUh8XDVDYm60NPNjobUj7xtpvoykFVjy5qLDRQ0PIkLAlPSlm+gd+CgotxZOYO78WZ/nBIxHXLklnfiYULYVJyUAFspRnTDxr/vcIQOExI0Y3hF1i10spxRm64FMq/psgr+xtBxMjxYBUdlIA0SxUX1Zkw6kFakbNOpFzurl5v4q2Sjx16LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5e2fbc19-2153-4d4e-a775-4663bc14e283", "record_id": "flaws_cloudtrail:0000371:5e2fbc19-2153-4d4e-a775-4663bc14e283", "row_index": 371, "timestamp": "2017-05-26T22:28:03Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5e2fbc19-2153-4d4e-a775-4663bc14e283", "eventTime": "2017-05-26T22:28:03Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIA8TBJU6YL0RN5NWMD", "expiration": "May 26, 2017 11:28:03 PM", "sessionToken": "FQoDYXdzECAaDOAQB0Cugj+dusbIFiLMAS7XGL3LcdcPzAEihzyCn4yM5atsVAUnVqYSkZZspSWXPxJSSUQRm5PUWLeEEIGirr+ne6CE8f8slbAschGYAy7kNEqKxbFaCMTwbVied4TVLxK9OAcdxjdZGXTuFBx3YbNR6YiTnideMVvF+G8bEonB734qWrZWL7wmu8KhzjFg0K89exgng0EOTg783bRx8hCZY+NbdZ98RNx4Y1AlwxdkB/zvGFgaqzo4ZMKY9FyphyzXL3/PDnIHQE/ReyCFWrK4sqev7NufdFwFjijz16LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "103dbbb0-9b69-465e-a311-d741796cdb7", "record_id": "flaws_cloudtrail:0000372:103dbbb0-9b69-465e-a311-d741796cdb7", "row_index": 372, "timestamp": "2017-05-26T22:28:03Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1445, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "103dbbb0-9b69-465e-a311-d741796cdb7", "eventTime": "2017-05-26T22:28:03Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIA4LB47D88YMDJCXT0", "expiration": "May 26, 2017 11:28:03 PM", "sessionToken": "FQoDYXdzECAaDP9eD/1+Q+vyYZen1CLMASy5PuKMo2MsuX/oRcZGzjNOa9+V2nPLGCrVLzU/5Z9JCobWEUbAnMn+e8Z1Wn9OQeGPLnhz0DuwomquLzw8EyXZVtLEJhpHug6B7cctMKwxtUyzKTTRo66Ft0beJqwiuhMzF0Lfg/og50adcsT49golx4UzckYBgJ3v4MgMs20bAg7kjPZjTO9UT/gOG+JOwuEBVqFnNBGooug4Ju4TXZrsqDrinVduuPtkCv+7aw+eIDhu5JQlt7s4xus+0lk3Hcf/CZf7HsUQ7OQQhijz16LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "25e1df4b-817b-4c04-9878-cd9a7dd0a64e", "record_id": "flaws_cloudtrail:0000373:25e1df4b-817b-4c04-9878-cd9a7dd0a64e", "row_index": 373, "timestamp": "2017-05-26T22:28:03Z", "event_type": "DescribeDBSnapshots", "event_source": "rds.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA8TBJU6YL0RN5NWMD", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1028, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "25e1df4b-817b-4c04-9878-cd9a7dd0a64e", "eventTime": "2017-05-26T22:28:03Z", "eventName": "DescribeDBSnapshots", "eventSource": "rds.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA8TBJU6YL0RN5NWMD", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:28:03Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"includePublic": false, "marker": "", "includeShared": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8587bb2e-00e7-4091-a752-9d26dac1e1dc", "record_id": "flaws_cloudtrail:0000374:8587bb2e-00e7-4091-a752-9d26dac1e1dc", "row_index": 374, "timestamp": "2017-05-26T22:28:04Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8587bb2e-00e7-4091-a752-9d26dac1e1dc", "eventTime": "2017-05-26T22:28:04Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIA2UC4F3KTXQP0OLXP", "expiration": "May 26, 2017 11:28:04 PM", "sessionToken": "FQoDYXdzECAaDGZ9sFhn1iWCs6A7biLMAREJcLYgBcnxu1Oa9LgeHArfTNt+iO8uG0HR52T7Nd5o8CFGXBmuJ7tMAxgwqbyyjASY0JbHs2x0l3snll/7L5xP64ELXbHOrFz0gY1mi6YOovm0UGgI6SbsdAC1Nv1qyaEBuqj20+jJF+KW7qBchcd+T1+MIMgdntM+emj+lTGyeNGRKfs0VEl03YF86XBCsILRCyZUwNnv11dnQ1sMZlsrNeyROCvEasRThUD2v1bZ2FaZCL5Z9P415lxjJkq3YPzNI9JodhYect+7+Cj016LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3b0e3499-5f38-496a-bacc-1c9f0c82c38d", "record_id": "flaws_cloudtrail:0000375:3b0e3499-5f38-496a-bacc-1c9f0c82c38d", "row_index": 375, "timestamp": "2017-05-26T22:28:05Z", "event_type": "DescribeDBSnapshots", "event_source": "rds.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA2UC4F3KTXQP0OLXP", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 1029, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3b0e3499-5f38-496a-bacc-1c9f0c82c38d", "eventTime": "2017-05-26T22:28:05Z", "eventName": "DescribeDBSnapshots", "eventSource": "rds.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-south-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA2UC4F3KTXQP0OLXP", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:28:04Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"includePublic": false, "marker": "", "includeShared": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5ba7ae20-0ab4-4081-927a-c11d1d25f13d", "record_id": "flaws_cloudtrail:0000376:5ba7ae20-0ab4-4081-927a-c11d1d25f13d", "row_index": 376, "timestamp": "2017-05-26T22:28:06Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1456, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5ba7ae20-0ab4-4081-927a-c11d1d25f13d", "eventTime": "2017-05-26T22:28:06Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAEBDC8S3D8ZDXF4DC", "expiration": "May 26, 2017 11:28:06 PM", "sessionToken": "FQoDYXdzECAaDM9YgMa9CVRkst1/byLMAbj27pxIFMYCMXsZ2/dLOTlj98zUpn/aYcxCFeeGMfwnSajJBo/hzJXpNPEBV26/UlLssA6lOk/enkCRNEpDOjON8xrrO3CyL5Tk8e6UW2qoZxZFDYl0FxjG0GrgVPN0/8gqLy9zvS5AzurCbUlv724rwqFh/HmYocHnQoiXvkYcnvyq3oxpGckya1HQF470VjRw+pYIKx+LJI2nr5xvCWBSL7NZ8JZyDdZnUfcjeJaL5Fsygxgw6fK7fsYNt5mq9lPsS55p2V88T1J9uij216LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3b020ad0-9ca4-470f-ba3b-4558e12568b5", "record_id": "flaws_cloudtrail:0000377:3b020ad0-9ca4-470f-ba3b-4558e12568b5", "row_index": 377, "timestamp": "2017-05-26T22:28:07Z", "event_type": "DescribeDBSnapshots", "event_source": "rds.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAEBDC8S3D8ZDXF4DC", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1029, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3b020ad0-9ca4-470f-ba3b-4558e12568b5", "eventTime": "2017-05-26T22:28:07Z", "eventName": "DescribeDBSnapshots", "eventSource": "rds.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "eu-central-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAEBDC8S3D8ZDXF4DC", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:28:06Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"includePublic": false, "marker": "", "includeShared": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "92a9569c-9644-42af-aa6c-465ae9cf40e3", "record_id": "flaws_cloudtrail:0000378:92a9569c-9644-42af-aa6c-465ae9cf40e3", "row_index": 378, "timestamp": "2017-05-26T22:28:07Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1453, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "92a9569c-9644-42af-aa6c-465ae9cf40e3", "eventTime": "2017-05-26T22:28:07Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAZPAVIRXPPRW9GYWA", "expiration": "May 26, 2017 11:28:07 PM", "sessionToken": "FQoDYXdzECAaDL7ksee6rB6nyq3EriLMAYOnR6LnXsei0hCavtzHrXt6p0rv5+gNVx99XgJQkwpr/VHB4o+018XVCMMqwSbjYCcTxUik2qcHOOLgPiBmupp0wm3imjGsH66mTkBZs7Yo/e3TE8yH1tdLwiY6cV5U1u57NfTQcTNt6AUbOnJNtZxaapci2NxTYFzolNf4wp44Uc8nign8Heob9EZVwDWMR2JSaOa0eC8d6Qb+m76E+tmq/nmsoxrFFTI3cBKsVjj5nHQFG5lg6daDieIucBc0IsNxy3N9oRSZgZPmzij316LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "36a0bab9-9972-409b-8d01-2f1071f2c644", "record_id": "flaws_cloudtrail:0000379:36a0bab9-9972-409b-8d01-2f1071f2c644", "row_index": 379, "timestamp": "2017-05-26T22:28:08Z", "event_type": "DescribeDBSnapshots", "event_source": "rds.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAZPAVIRXPPRW9GYWA", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1028, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "36a0bab9-9972-409b-8d01-2f1071f2c644", "eventTime": "2017-05-26T22:28:08Z", "eventName": "DescribeDBSnapshots", "eventSource": "rds.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "eu-west-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAZPAVIRXPPRW9GYWA", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:28:07Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"includePublic": false, "marker": "", "includeShared": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "796bd220-e3fa-4101-b298-c4c33fbd6a33", "record_id": "flaws_cloudtrail:0000380:796bd220-e3fa-4101-b298-c4c33fbd6a33", "row_index": 380, "timestamp": "2017-05-26T22:28:08Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 881, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "796bd220-e3fa-4101-b298-c4c33fbd6a33", "eventTime": "2017-05-26T22:28:08Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "055ad5d6-92d0-4916-97d2-51d045b5eaf0", "record_id": "flaws_cloudtrail:0000381:055ad5d6-92d0-4916-97d2-51d045b5eaf0", "row_index": 381, "timestamp": "2017-05-26T22:28:09Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "055ad5d6-92d0-4916-97d2-51d045b5eaf0", "eventTime": "2017-05-26T22:28:09Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAPDHYN6PUI8HFCULN", "expiration": "May 26, 2017 11:28:09 PM", "sessionToken": "FQoDYXdzECAaDADAldQPQ+DLOtOj3yLMAX+DyCL/nCKGE9VgWhwtvwM22Kln/xmAMcnT5yJS39a7/r9m0K8O0bStfQhaoXnK7m2rxzhfB5yaNZKdugoO9B9xfMBj/f57hXvNBXRhgWkr8pW6HmWZONKNO3BrdEkA2wTl3GMOGkl2X0tMsLgST1zPfpYHWWktdeXeVciVhkseNGiJYNsDPcEouBNX5BukVzqbVinj7N0Y6zUygNNuBstF0hRrDtkLS2KB4wxnxy9P/0Gwj3SqKNMUMx8VPW0VMCcGZjQYYb7HQglEQSj516LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "91c03b1e-00a2-4bc3-bffb-4e3e23d34857", "record_id": "flaws_cloudtrail:0000382:91c03b1e-00a2-4bc3-bffb-4e3e23d34857", "row_index": 382, "timestamp": "2017-05-26T22:28:09Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "91c03b1e-00a2-4bc3-bffb-4e3e23d34857", "eventTime": "2017-05-26T22:28:09Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIA0I09L2HE8Z6AVK3X", "expiration": "May 26, 2017 11:28:09 PM", "sessionToken": "FQoDYXdzECAaDH8nVOmM+H2FntKFLiLMAUlbdPHTCHLR7J0kxi3gqUwimZtr9C/ZLeuA8inUmKXPkLf5SKjQfTGdxEdiRDaewi+ULQmtEdYVy6SfjpBSMjI6sQd74caPBup2xzWICDbQh6jeyDfJyjtOMZQBVI7VkitvEYNLkoshVWz/oZCmKGgaaPyoHPsw4Lw2+numer7LpvUyuByu9lKRp51FZSkHG7uslq1BXVi5L2t/FhVYOh6hhnpNEXIxFm4MSfaeB2J91cW6q1c6tB4pHCAn/wIDfjzaeTZoafFzDyLahyj516LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b9e81fa1-d4c1-409e-9db1-9c01e8d9805e", "record_id": "flaws_cloudtrail:0000383:b9e81fa1-d4c1-409e-9db1-9c01e8d9805e", "row_index": 383, "timestamp": "2017-05-26T22:28:09Z", "event_type": "DescribeNatGateways", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA0I09L2HE8Z6AVK3X", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1004, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b9e81fa1-d4c1-409e-9db1-9c01e8d9805e", "eventTime": "2017-05-26T22:28:09Z", "eventName": "DescribeNatGateways", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-west-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA0I09L2HE8Z6AVK3X", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:28:09Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"DescribeNatGatewaysRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6986c061-0997-4aa7-8d5d-240559cdb355", "record_id": "flaws_cloudtrail:0000384:6986c061-0997-4aa7-8d5d-240559cdb355", "row_index": 384, "timestamp": "2017-05-26T22:28:10Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6986c061-0997-4aa7-8d5d-240559cdb355", "eventTime": "2017-05-26T22:28:10Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIA8PKLGIW3QK1LBF8V", "expiration": "May 26, 2017 11:28:10 PM", "sessionToken": "FQoDYXdzECAaDA+Y4001sjofZ5FkRiLMATTnCknquEOBgEaLjbOsGAlTuP6J3YffQXyuUgqR1u2mSXiv1vbbd8i07rOTKBmIvi7FSlhXoBLtgmCVc8/QEryd/60uX8TlsQW/gKm28PkSKahnugq1N+uH4tZ68Be5pvJe2etRXsAzH76USyEzbuzmDo4wgRv6UZbscvlWAgN+RWeUyZvJh+pgGbOaHH7cFfF9xz/kEqGtBeE7Qfw/Xx34gbUH9+zuN1UqmEJe8WzhipPWlrUkhpDP08ADG4njUCOahjHnJKwsoENVSCj616LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f61592-3bbd-4fec-9331-f093bd7ccc1e", "record_id": "flaws_cloudtrail:0000385:f61592-3bbd-4fec-9331-f093bd7ccc1e", "row_index": 385, "timestamp": "2017-05-26T22:28:10Z", "event_type": "DescribeNatGateways", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPDHYN6PUI8HFCULN", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1002, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f61592-3bbd-4fec-9331-f093bd7ccc1e", "eventTime": "2017-05-26T22:28:10Z", "eventName": "DescribeNatGateways", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPDHYN6PUI8HFCULN", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:28:09Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"DescribeNatGatewaysRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f3e1aeb7-d1f9-4ad7-bd69-e4eaf88f0cba", "record_id": "flaws_cloudtrail:0000386:f3e1aeb7-d1f9-4ad7-bd69-e4eaf88f0cba", "row_index": 386, "timestamp": "2017-05-26T22:28:11Z", "event_type": "DescribeNatGateways", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA8PKLGIW3QK1LBF8V", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1009, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f3e1aeb7-d1f9-4ad7-bd69-e4eaf88f0cba", "eventTime": "2017-05-26T22:28:11Z", "eventName": "DescribeNatGateways", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA8PKLGIW3QK1LBF8V", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:28:10Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"DescribeNatGatewaysRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dc21b803-8550-4651-9506-8b7fd9c1d96c", "record_id": "flaws_cloudtrail:0000387:dc21b803-8550-4651-9506-8b7fd9c1d96c", "row_index": 387, "timestamp": "2017-05-26T22:28:11Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1456, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dc21b803-8550-4651-9506-8b7fd9c1d96c", "eventTime": "2017-05-26T22:28:11Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAEOK8PVS9AM0KRD1J", "expiration": "May 26, 2017 11:28:11 PM", "sessionToken": "FQoDYXdzECAaDHFCNOO4RFu3Mq2lSiLMASM990whAOCDsmV7GrtaYnuQx48CZchcUS1vth0fWhvdbblBE6guVAd0pWtgF49pfr9Dm0jWfY068141Yj0nAjQptEMiZy2xXsQqdfWwXeWFxN5FKscSWqrhsr1wERxQtwovwqxKFAgOxGL+v9gJdJ4fUPAQH6EZLQYb4n1taGBifJQPy4kKIWMJEPVZihNLPWsiK7CWaLD4sJ1cr6xt0gxo0PrZCrBN06rpq//P3ZkYbfX1yWYMis7G6a5y6m/xuQMahmozvQkooSsZunCj716LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "19e846567-7651-493a-b45e-55850c805c5d", "record_id": "flaws_cloudtrail:0000388:19e846567-7651-493a-b45e-55850c805c5d", "row_index": 388, "timestamp": "2017-05-26T22:28:12Z", "event_type": "DescribeNatGateways", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAEOK8PVS9AM0KRD1J", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1011, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "19e846567-7651-493a-b45e-55850c805c5d", "eventTime": "2017-05-26T22:28:12Z", "eventName": "DescribeNatGateways", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAEOK8PVS9AM0KRD1J", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:28:11Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"DescribeNatGatewaysRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4ed5a81d-f857-45fc-b2c3-6669c78db316", "record_id": "flaws_cloudtrail:0000389:4ed5a81d-f857-45fc-b2c3-6669c78db316", "row_index": 389, "timestamp": "2017-05-26T22:28:13Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1455, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4ed5a81d-f857-45fc-b2c3-6669c78db316", "eventTime": "2017-05-26T22:28:13Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAO37N2OX30OI5U2WH", "expiration": "May 26, 2017 11:28:13 PM", "sessionToken": "FQoDYXdzECAaDFNjvJoX7cKIoPUBXSLMASM2ckWGENTT8bsQWGud5q9R4wl9r8d4JShVcOMHF8NXbrLMl5mzE9fpajUzRRDMD4NqWJsMeSb/hX38w32/kjKmhC3UOutMJpSJb9fnvse/00x2j9E37Dj3b0SWXElL/yA+TwHHksGbmpEUW+vkM6Z+FRezIjsrwdd9PmU5HYaY0fNNVKvmBIo9SiPsreTwmMcSrMHnfvxva1g2n6Bvzy+IoWICeUpY92b6ALVNVTZaRutfr0O24m6QLYMSnEbZBWDBNVoncqQ5f7Q1FSj916LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2865f9bc-07da-4d6b-9824-386c85aec554", "record_id": "flaws_cloudtrail:0000390:2865f9bc-07da-4d6b-9824-386c85aec554", "row_index": 390, "timestamp": "2017-05-26T22:28:14Z", "event_type": "DescribeNatGateways", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAO37N2OX30OI5U2WH", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1004, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2865f9bc-07da-4d6b-9824-386c85aec554", "eventTime": "2017-05-26T22:28:14Z", "eventName": "DescribeNatGateways", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "sa-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAO37N2OX30OI5U2WH", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:28:13Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"DescribeNatGatewaysRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "be42510-78c5-44f1-ae64-3aff756e2f50", "record_id": "flaws_cloudtrail:0000391:be42510-78c5-44f1-ae64-3aff756e2f50", "row_index": 391, "timestamp": "2017-05-26T22:28:14Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 880, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "be42510-78c5-44f1-ae64-3aff756e2f50", "eventTime": "2017-05-26T22:28:14Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e4adbbc8-8bc5-4eeb-8d60-dea01ee491e5", "record_id": "flaws_cloudtrail:0000392:e4adbbc8-8bc5-4eeb-8d60-dea01ee491e5", "row_index": 392, "timestamp": "2017-05-26T22:28:15Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 881, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e4adbbc8-8bc5-4eeb-8d60-dea01ee491e5", "eventTime": "2017-05-26T22:28:15Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d267f874-e66c-4eed-86af-c0a2f75f73a2", "record_id": "flaws_cloudtrail:0000393:d267f874-e66c-4eed-86af-c0a2f75f73a2", "row_index": 393, "timestamp": "2017-05-26T22:28:15Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d267f874-e66c-4eed-86af-c0a2f75f73a2", "eventTime": "2017-05-26T22:28:15Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIA2YET6DL55VE2S357", "expiration": "May 26, 2017 11:28:15 PM", "sessionToken": "FQoDYXdzECAaDBj9uM0oEjJcDXl/SSLMAcQ6yRV6F0pZD9AQy6gfR9UBp1MQENlc564yQYaFAuPNqJoc2gUnQtZg+kriQZdHT/WE/izMO3avn0CBNhEG/zfjofNSpMeVWQoHo7Fk+mCmWoFHK1LvLRfiVXXl+xEOPn2IpOA+WIkYJqIFok4dSuUokCRlAcRZR+XP23fM/Gs16Ks5IC0DJpg5zOLy+qRreM5/7H+2sjzEZHHp752Qd6SIsPEUIPdXsRaruJAFBL84LrwmdXmGzt4q2EHrwTBjrpMarvucJRjBxCejuSj/16LJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4868a509-e147-4ad3-9e3b-6f910e16d13b", "record_id": "flaws_cloudtrail:0000394:4868a509-e147-4ad3-9e3b-6f910e16d13b", "row_index": 394, "timestamp": "2017-05-26T22:28:16Z", "event_type": "DescribeNatGateways", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA2YET6DL55VE2S357", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1009, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4868a509-e147-4ad3-9e3b-6f910e16d13b", "eventTime": "2017-05-26T22:28:16Z", "eventName": "DescribeNatGateways", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA2YET6DL55VE2S357", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:28:15Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"DescribeNatGatewaysRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "591883ba2-ff69-43fc-a53d-6842504308ca", "record_id": "flaws_cloudtrail:0000395:591883ba2-ff69-43fc-a53d-6842504308ca", "row_index": 395, "timestamp": "2017-05-26T22:28:16Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1455, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "591883ba2-ff69-43fc-a53d-6842504308ca", "eventTime": "2017-05-26T22:28:16Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAEKIMHWX6DGCZUHUG", "expiration": "May 26, 2017 11:28:16 PM", "sessionToken": "FQoDYXdzECAaDD+877mnPbePV1F+6CLMAc367a79tO3S+9V6ExVy3yYdmrp3Mf+cd4qeoSU4up1jeWYuZtQnpfZ4TDSa9zzkV3eYxdfHFtPUMBBsXGn5MCZwWmBcbXrMKqCKuz999kH7lM6iLTz8BBnU430gPVbgSDrd3Kf+Gk0aK9zQQutcuS9s/DfpF+SN+OOck3vlnHotDB1zaJC2RnOQeQ6KkrlcxLaxEkX8yS5Cqp9GxWTxDuT+tlKzwpIK2nVhqYBJTg8L3svI+eoVGQ4dNxu3GLyuTCfH8OWy8Y8qmCTdZCiA2KLJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ed38ae85-6164-4302-acec-2f41f797a651", "record_id": "flaws_cloudtrail:0000396:ed38ae85-6164-4302-acec-2f41f797a651", "row_index": 396, "timestamp": "2017-05-26T22:28:17Z", "event_type": "DescribeNatGateways", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAEKIMHWX6DGCZUHUG", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1005, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ed38ae85-6164-4302-acec-2f41f797a651", "eventTime": "2017-05-26T22:28:17Z", "eventName": "DescribeNatGateways", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ca-central-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAEKIMHWX6DGCZUHUG", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:28:16Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"DescribeNatGatewaysRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "408ca7b5-ce3c-4a49-8565-d58fedfeff07", "record_id": "flaws_cloudtrail:0000397:408ca7b5-ce3c-4a49-8565-d58fedfeff07", "row_index": 397, "timestamp": "2017-05-26T22:28:17Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "408ca7b5-ce3c-4a49-8565-d58fedfeff07", "eventTime": "2017-05-26T22:28:17Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIANGY36837NFHI2RT7", "expiration": "May 26, 2017 11:28:17 PM", "sessionToken": "FQoDYXdzECAaDG8JpdNr0Fms1xliJCLMAZeMeOXmviBjLIwuvRgtEvR2c6wB4qYQ6s+slzCjAiq6UWDi2pv9flyXqTAwW5yUkO7FjbtasZygG1GMYkeTENYbOFeeUgeG6KMB8w5MjdbCg+t+rxAhJ6P9lO59eIVMxkG41Ytnc7bkbwY5HgSIA69iNZto6bTWDo8BEgn4cRE937pVA4vc2vY+tj/MaujPuJgz4lM/iBiSqFBJlpYZzPzJ3gA9YDHRtNtKFjUzdJTcDNTv0VCk+JrYkUmVg8/HKyY/gqajlrfiXSL8jiiB2KLJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b10d50e1-bd11-448e-85bd-891fbf192641", "record_id": "flaws_cloudtrail:0000398:b10d50e1-bd11-448e-85bd-891fbf192641", "row_index": 398, "timestamp": "2017-05-26T22:28:19Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b10d50e1-bd11-448e-85bd-891fbf192641", "eventTime": "2017-05-26T22:28:19Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIA46JZSMDVRTUF7I9D", "expiration": "May 26, 2017 11:28:19 PM", "sessionToken": "FQoDYXdzECAaDLiApcaLTNZWojyl5SLMAdbD/KcoLSv9ZU6YpN6HDpLDsxhTO4Tz7ZMfsNr5sWNjUrBCrk0kxMO9kykRPVwqeUC6dzM4uYO/DKnxonTPgwqglJVF+TbEoRW7S4qT3iI+FTI4WfeReYOPhJgKAcCSEZHNquE5SGFSXZwMjhVqN7rjg6fVnZN8RuKeMJJytc4vHo5tJFAn2+VmfCK5v5d9SmrapDpWdNpLeAfJgiG5mi+Gf+zaSibCkFmznaxXhlbFIwFj9/gAhO1A3IqdIUNklNLkaFvAmV2DfMk4ZCiD2KLJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "95ad86bb-2fb3-4b97-9ffa-155f1f08fe3f", "record_id": "flaws_cloudtrail:0000399:95ad86bb-2fb3-4b97-9ffa-155f1f08fe3f", "row_index": 399, "timestamp": "2017-05-26T22:28:19Z", "event_type": "DescribeNatGateways", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA46JZSMDVRTUF7I9D", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1004, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "95ad86bb-2fb3-4b97-9ffa-155f1f08fe3f", "eventTime": "2017-05-26T22:28:19Z", "eventName": "DescribeNatGateways", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA46JZSMDVRTUF7I9D", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:28:19Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"DescribeNatGatewaysRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c40e4909-b807-4077-b335-858212a7dc7c7", "record_id": "flaws_cloudtrail:0000400:c40e4909-b807-4077-b335-858212a7dc7c7", "row_index": 400, "timestamp": "2017-05-26T22:28:20Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1455, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c40e4909-b807-4077-b335-858212a7dc7c7", "eventTime": "2017-05-26T22:28:20Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAE2ICV7NBJGUUTD2Z", "expiration": "May 26, 2017 11:28:20 PM", "sessionToken": "FQoDYXdzECAaDNBR5z8+Sm65dBVBFiLMAWa2hob+DvwfUX0oHfaayzKtQ2jpl0EF/Pbr4QcEGM38KlcbKLEIATYwQnQmK8sK0KE4rd821FCe5t9WEHpdLRn7Af51YGKeCN2VwJOfIWVkCzfnM3K631Jcsdd9i48MClrv/P+lr/OmZd3a7IrByyU6tOHPGLIb3hs+dVV54+kyjkiaiVzQROeRFydsRDUGAQHDvKfo+CVjkeIE5MU52kyVZ5lUrcdE1P/6iLLulrTgJhD37UTVGzjC/RTK+5Vjq0RYJzXh3diNmmMnoyiE2KLJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "db861462d-79b8-4505-898e-4b0b317c749c", "record_id": "flaws_cloudtrail:0000401:db861462d-79b8-4505-898e-4b0b317c749c", "row_index": 401, "timestamp": "2017-05-26T22:28:21Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1455, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "db861462d-79b8-4505-898e-4b0b317c749c", "eventTime": "2017-05-26T22:28:21Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAQYGF3J6C6EPBTIZ0", "expiration": "May 26, 2017 11:28:21 PM", "sessionToken": "FQoDYXdzECAaDL923pfUwNCbm32F+yLMAepRAz0biyb6n2SUgUYmCM9bFuyZEZkvyS/rxPb1gI0C75R1qsx6dJrFeIlYYlmjNBeErPDhlQlrHwqU6c0hVjZwQhwC2IkIIXDOOfmRvLKUmV6PRwko3YS10bto6bC9/YHXC17c9UEBk4+tcpYm2eRaodsQpaziiM8nIkbvn/hwlVpi4norbSGA7aANsYf8C9Jl49cN6RTHnyKUMa8EmQXu7g255p6WQgtK6JLINx5hv0IOwdX1STb+fcg7nOT+RMu5bcOXYVL4f3uMhSiF2KLJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "aa79acf4-9ec5-4f6e-b774-29c15701a2a", "record_id": "flaws_cloudtrail:0000402:aa79acf4-9ec5-4f6e-b774-29c15701a2a", "row_index": 402, "timestamp": "2017-05-26T22:28:21Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 880, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "aa79acf4-9ec5-4f6e-b774-29c15701a2a", "eventTime": "2017-05-26T22:28:21Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8c08ce68-85bb-4bfd-a884-8c4eeffd8185", "record_id": "flaws_cloudtrail:0000403:8c08ce68-85bb-4bfd-a884-8c4eeffd8185", "row_index": 403, "timestamp": "2017-05-26T22:28:22Z", "event_type": "DescribeNatGateways", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAQYGF3J6C6EPBTIZ0", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1006, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8c08ce68-85bb-4bfd-a884-8c4eeffd8185", "eventTime": "2017-05-26T22:28:22Z", "eventName": "DescribeNatGateways", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "eu-central-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAQYGF3J6C6EPBTIZ0", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:28:21Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"DescribeNatGatewaysRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "01aff6d0-b032-455d-9839-fbe0df9a5cae", "record_id": "flaws_cloudtrail:0000404:01aff6d0-b032-455d-9839-fbe0df9a5cae", "row_index": 404, "timestamp": "2017-05-26T22:28:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "01aff6d0-b032-455d-9839-fbe0df9a5cae", "eventTime": "2017-05-26T22:28:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAMTCEMFMH4KNVEP5Y", "expiration": "May 26, 2017 11:28:22 PM", "sessionToken": "FQoDYXdzECAaDJfeDpS48+JLKHCouCLMAX3LtIo4XTfq2C67bqperxRLqA+4NtmlyQtmerm9NTTm5Zp5dgxydGvJXzeVcQv8i7U25GzrPIzR3I+q88hygglFoMYqXalx0AmTcnpcU6pX0Fi5mAZwWABwWrhhS8c+bpLNdydOjmJKDNTMyI516TM1qzXL6Mee7SW7MVfJhcxIe5BFNLw17PrxVXuS8w6t/JuU2/ekIkCQyQKhVu6AqdR+RVTQqu7P03wokt8ODwTq4IwfrcypGV4okvYuxH+VHsb1Hn0ZWUFfUZz+1SiG2KLJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "416bd368-1adf-4cc3-b70b-0937f4095688", "record_id": "flaws_cloudtrail:0000405:416bd368-1adf-4cc3-b70b-0937f4095688", "row_index": 405, "timestamp": "2017-05-26T22:28:23Z", "event_type": "DescribeNatGateways", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAMTCEMFMH4KNVEP5Y", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1004, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "416bd368-1adf-4cc3-b70b-0937f4095688", "eventTime": "2017-05-26T22:28:23Z", "eventName": "DescribeNatGateways", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "eu-west-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAMTCEMFMH4KNVEP5Y", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:28:22Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"DescribeNatGatewaysRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "753640f63-cbee-476b-b741-f5a0c60b8f05", "record_id": "flaws_cloudtrail:0000406:753640f63-cbee-476b-b741-f5a0c60b8f05", "row_index": 406, "timestamp": "2017-05-26T22:28:24Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1456, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "753640f63-cbee-476b-b741-f5a0c60b8f05", "eventTime": "2017-05-26T22:28:24Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIA3RJTAMN9V3FFD52W", "expiration": "May 26, 2017 11:28:24 PM", "sessionToken": "FQoDYXdzECAaDDy1nNXMR8nzqf+1PSLMAWP130NoKMvpc+akWWqQHa9RGJcwxvQyNYtwBu4c8QzS7IIpv28E3s1YnQhYF0au1N/rdcPNPpbuG9h5ocBh9mL6k+it660148hVKtSa0gxbiFUSNcdD0ah+MQbcEk+DYR97wdo1VaYKmNwXgigAkMQpxHLL5rxFMk91PnJY5ZVndGWmF7bkZlwDLWKwNRJNtbqAP99sZUJLJ5xdYW9EYFo/n1O3G+lqaPRCbPCj+7LQuBb9LDfNWdiyDGawdmXpZag8kX5nG6+4nok5fBSiI2KLJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b1889ea7-07c0-4edd-b21a-3e878991b7b5", "record_id": "flaws_cloudtrail:0000407:b1889ea7-07c0-4edd-b21a-3e878991b7b5", "row_index": 407, "timestamp": "2017-05-26T22:28:25Z", "event_type": "DescribeNatGateways", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA3RJTAMN9V3FFD52W", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1002, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b1889ea7-07c0-4edd-b21a-3e878991b7b5", "eventTime": "2017-05-26T22:28:25Z", "eventName": "DescribeNatGateways", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "eu-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA3RJTAMN9V3FFD52W", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:28:24Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"DescribeNatGatewaysRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9fd9486b-efdc-4165-970f-49494e9e1fd5", "record_id": "flaws_cloudtrail:0000408:9fd9486b-efdc-4165-970f-49494e9e1fd5", "row_index": 408, "timestamp": "2017-05-26T22:28:25Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9fd9486b-efdc-4165-970f-49494e9e1fd5", "eventTime": "2017-05-26T22:28:25Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAZHIWRWH08FGWO3O4", "expiration": "May 26, 2017 11:28:25 PM", "sessionToken": "FQoDYXdzECAaDNJiwbn5+SAqw37j2CLMAbkXnfksPBJSQkAh+4FWUFH7BFIiq/u5nwEAriRW1rNgzhhnNF/RxEhjrqEzQ/YvCyztuaCbLTLlg/yFWn28u4MiLXetFarUYNwTXEFn78RtKXmrwt3JIS7P7C+hQAH3VYACEXlF0BVrJ/UOomuTjScNHILmtum+JMkxLLQtm+SeWKiaOg5w8XfzFMVXNmBuFBnjoCkD+pDW3GyE4BqDqvHOJRM/lgkDwusVgKMnUUYuHLXkqWSMU3n/OZPzxZOoK3QXXi3COV47LSNyGCiJ2KLJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "870dbe66-b919-4b0b-bdf2-657ed774c734", "record_id": "flaws_cloudtrail:0000409:870dbe66-b919-4b0b-bdf2-657ed774c734", "row_index": 409, "timestamp": "2017-05-26T22:28:25Z", "event_type": "DescribeFlowLogs", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAE6I7PR7F7ZNFX2MW", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "ec2-frontend-api.amazonaws.com", "user_agent": "ec2-frontend-api.amazonaws.com", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1011, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "870dbe66-b919-4b0b-bdf2-657ed774c734", "eventTime": "2017-05-26T22:28:25Z", "eventName": "DescribeFlowLogs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2-frontend-api.amazonaws.com", "userAgent": "ec2-frontend-api.amazonaws.com", "awsRegion": "us-west-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAE6I7PR7F7ZNFX2MW", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:28:25Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}, "invokedBy": "ec2-frontend-api.amazonaws.com"}, "responseElements": {"flowLogSet": []}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "752c1e03-fddf-43a1-ad99-e4bd9ff690325", "record_id": "flaws_cloudtrail:0000410:752c1e03-fddf-43a1-ad99-e4bd9ff690325", "row_index": 410, "timestamp": "2017-05-26T22:28:26Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1455, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "752c1e03-fddf-43a1-ad99-e4bd9ff690325", "eventTime": "2017-05-26T22:28:26Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIA36U8V6HIUIG4V5GW", "expiration": "May 26, 2017 11:28:26 PM", "sessionToken": "FQoDYXdzECAaDH8kwnSkyGGdPnAhMiLMAU2PUYow3EEDYGE4SE6MsusMSuwvowY/Wx3lh6es8vGgXOjivCfAIljsuWWEosGCNWJ+h+0r5de8T7EYNPAexUMrqcS3IGvTc+3nmxfTbltsip9Sl+MesiHfuQcP5/KAFVV5Suy1rV0zSFfOzn3iB3GcV9UjfDSnGQmtaft003DaRkV3Jtfj1FzW/yibT4vXzax3+3gq70T61bJ2CN4NRmIdw/lH+B5XmgTswxxrpIDAyPCUiV9qMotakPgqWROURckE8b3WHQv6LowT/CiK2KLJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0d0a7dcb-fb77-4d1e-9ded-aaf14f772e25", "record_id": "flaws_cloudtrail:0000411:0d0a7dcb-fb77-4d1e-9ded-aaf14f772e25", "row_index": 411, "timestamp": "2017-05-26T22:28:26Z", "event_type": "DescribeFlowLogs", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAP4J01P2QEWA3KAVY", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "ec2-frontend-api.amazonaws.com", "user_agent": "ec2-frontend-api.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1011, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0d0a7dcb-fb77-4d1e-9ded-aaf14f772e25", "eventTime": "2017-05-26T22:28:26Z", "eventName": "DescribeFlowLogs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2-frontend-api.amazonaws.com", "userAgent": "ec2-frontend-api.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAP4J01P2QEWA3KAVY", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:28:26Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}, "invokedBy": "ec2-frontend-api.amazonaws.com"}, "responseElements": {"flowLogSet": []}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "14448edf-eac7-46e8-a65d-e51f183ad302", "record_id": "flaws_cloudtrail:0000412:14448edf-eac7-46e8-a65d-e51f183ad302", "row_index": 412, "timestamp": "2017-05-26T22:28:27Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 880, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "14448edf-eac7-46e8-a65d-e51f183ad302", "eventTime": "2017-05-26T22:28:27Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "96bfc2f2-342a-468c-8ddd-74d81bd65619", "record_id": "flaws_cloudtrail:0000413:96bfc2f2-342a-468c-8ddd-74d81bd65619", "row_index": 413, "timestamp": "2017-05-26T22:28:27Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1451, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "96bfc2f2-342a-468c-8ddd-74d81bd65619", "eventTime": "2017-05-26T22:28:27Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIA2NGHIFF03U3427LE", "expiration": "May 26, 2017 11:28:27 PM", "sessionToken": "FQoDYXdzECAaDLqjlT1jMxqtOv7PHSLMAeQoWBFV9IO5B/dBYPFpSOFTb0nx/bPBlGes9FtWwSqKL5Ogsh69mY3tVdvkLyvASs9tjlhjttNwIVQUDG/uW3BzKRszeu+QrKtbOc3CpOfUIZe7KyhPpp2pfwX3LDjKIwC+GHgg88bs8Vhfg9/2Bhj6op6SrXSi672zojDEabm6OGbARWJYEftpC1sOR45xahxrHOxTr7eyYc3EYgXy9JkpnGAWhuLjfBZpHKKoJNfJfUyHgwxiWP9e6aKZHA01O0RJNQ653yGRJHSSKyiL2KLJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d3f4a33d-ec97-42d5-b509-f64f2932ceb8", "record_id": "flaws_cloudtrail:0000414:d3f4a33d-ec97-42d5-b509-f64f2932ceb8", "row_index": 414, "timestamp": "2017-05-26T22:28:28Z", "event_type": "DescribeFlowLogs", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAEC13C3T6W2BALIK8", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "ec2-frontend-api.amazonaws.com", "user_agent": "ec2-frontend-api.amazonaws.com", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1016, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d3f4a33d-ec97-42d5-b509-f64f2932ceb8", "eventTime": "2017-05-26T22:28:28Z", "eventName": "DescribeFlowLogs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2-frontend-api.amazonaws.com", "userAgent": "ec2-frontend-api.amazonaws.com", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAEC13C3T6W2BALIK8", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:28:27Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}, "invokedBy": "ec2-frontend-api.amazonaws.com"}, "responseElements": {"flowLogSet": []}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a4e065718-7ab1-453c-9bbc-96216b805967", "record_id": "flaws_cloudtrail:0000415:a4e065718-7ab1-453c-9bbc-96216b805967", "row_index": 415, "timestamp": "2017-05-26T22:28:28Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1455, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a4e065718-7ab1-453c-9bbc-96216b805967", "eventTime": "2017-05-26T22:28:28Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIA845M58D4XYDHQVEG", "expiration": "May 26, 2017 11:28:28 PM", "sessionToken": "FQoDYXdzECAaDO7ci16jPFwnsB3xwiLMAXZCBbejiO/s/wtYAD/X0nzVaOfk+uVJOf9lztfpNMu0pVq7ZFMHR60AF2rwYIpMBE7TLkmif3Z8XiBo5dO9Fr7pNf00U8TG5FvqmK9cXgmj9AOIDwGStHyemNCtTp/zURZvwGwKPeHelD1KPNvQQG1CIhsYiMSjXvfP+WnAQafwz1BwZaM+wiv0aC3TUGPtf5ly0G/CIWs/rzBHuZdiL7/zlFoKgiLWago5eLI+wYAqgVvJ6BQ/D7GkZW4y5xc+dIn2wwTq2F92BxjidiiM2KLJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5aa85eeb-e2f9-423e-943f-9207b02e4a6f", "record_id": "flaws_cloudtrail:0000416:5aa85eeb-e2f9-423e-943f-9207b02e4a6f", "row_index": 416, "timestamp": "2017-05-26T22:28:29Z", "event_type": "DescribeFlowLogs", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAJSUWU3M7FKKCTGMD", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "ec2-frontend-api.amazonaws.com", "user_agent": "ec2-frontend-api.amazonaws.com", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1011, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5aa85eeb-e2f9-423e-943f-9207b02e4a6f", "eventTime": "2017-05-26T22:28:29Z", "eventName": "DescribeFlowLogs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2-frontend-api.amazonaws.com", "userAgent": "ec2-frontend-api.amazonaws.com", "awsRegion": "sa-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAJSUWU3M7FKKCTGMD", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:28:28Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}, "invokedBy": "ec2-frontend-api.amazonaws.com"}, "responseElements": {"flowLogSet": []}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cccc0338-8059-4ec0-bf40-47cfa57d8ac5", "record_id": "flaws_cloudtrail:0000417:cccc0338-8059-4ec0-bf40-47cfa57d8ac5", "row_index": 417, "timestamp": "2017-05-26T22:28:30Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cccc0338-8059-4ec0-bf40-47cfa57d8ac5", "eventTime": "2017-05-26T22:28:30Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAB6X1Y4V4FEF7APYC", "expiration": "May 26, 2017 11:28:30 PM", "sessionToken": "FQoDYXdzECAaDIO5FK+9UKlp3cypFSLMARaRNqWzoouSYtGyNtmNH8UG2AO08EfG9E6sClobweDNt+CuzrBzCS2ifSOrSEFed9LSw1Dt3W6XL7yBnt73K3IPaHfhvglF4aVHQ4bhK4POOYiG4ResGKvq9Ou4kcRr5wYLDJdLdqmkUteXRU71UH4xPW0KLG9jg4n3tQ9KYBsij9ni2vIN+YqoAzBpOZI7TGfOndh7lwP6OnM4CHIQBMLeEMDAeC/PWfuvZwnaM4z0z00pr/xvL2GAQUAji1oz3m6ve8SQR1LNmQwsFyiO2KLJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "489c7d60-d6b0-4c4b-9c79-9e8c19282a", "record_id": "flaws_cloudtrail:0000418:489c7d60-d6b0-4c4b-9c79-9e8c19282a", "row_index": 418, "timestamp": "2017-05-26T22:28:31Z", "event_type": "DescribeFlowLogs", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA81Q1WATVUYIYKK74", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "ec2-frontend-api.amazonaws.com", "user_agent": "ec2-frontend-api.amazonaws.com", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1014, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "489c7d60-d6b0-4c4b-9c79-9e8c19282a", "eventTime": "2017-05-26T22:28:31Z", "eventName": "DescribeFlowLogs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2-frontend-api.amazonaws.com", "userAgent": "ec2-frontend-api.amazonaws.com", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA81Q1WATVUYIYKK74", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:28:30Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}, "invokedBy": "ec2-frontend-api.amazonaws.com"}, "responseElements": {"flowLogSet": []}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "12fc8e0a-54cf-4ec0-b08a-f492ab6ff630", "record_id": "flaws_cloudtrail:0000419:12fc8e0a-54cf-4ec0-b08a-f492ab6ff630", "row_index": 419, "timestamp": "2017-05-26T22:28:31Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "12fc8e0a-54cf-4ec0-b08a-f492ab6ff630", "eventTime": "2017-05-26T22:28:31Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIASB49U4WN06B3ECL8", "expiration": "May 26, 2017 11:28:31 PM", "sessionToken": "FQoDYXdzECAaDDO68DsTlQee53uVSyLMAYQXPpS2BkBdqU7u36S46HIlRIwoq4Z/Z5cg8PR57WIVR/nC194912lWP+3ZTDXFmZUqRE7f+Go/OW/imjnpCEVL3eIUc/yG9j+nZoFD6blQbAO/2Wi2k9gZlPjQQXw+fq7GvyNx1axs5NQpB8liC2lu2LcAXzSr/A9YfghHqabnOKG1FhzrLYJfoH1XRVHTyoX4v4yx3nV33pVENp+X1sbQeFp3uvDnV1u9rxRN2q4sqB6k7NsklaOdsNjyfJd+sxYYxoHfJE17dv3/7CiP2KLJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "73fbf448-81f3-4876-a7f2-4755adc61f86", "record_id": "flaws_cloudtrail:0000420:73fbf448-81f3-4876-a7f2-4755adc61f86", "row_index": 420, "timestamp": "2017-05-26T22:28:32Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "73fbf448-81f3-4876-a7f2-4755adc61f86", "eventTime": "2017-05-26T22:28:32Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAOSPXJ6C88HYLAJWV", "expiration": "May 26, 2017 11:28:32 PM", "sessionToken": "FQoDYXdzECAaDPcxl5dd6el0rgrDCiLMAWxp108AWXS6oVOV6RSxuGjky4AbKooRAnmTLLzWTYnTJ4VNRZCIq5sf2yCZclBdnA2watUzW64BwGgHveQ7KqAW5r2Ja2pxkA+PIxpT7HKteiVIk5RUcgpvnHA1o40TSKWZuF/vTdgCWppgkdct1JxsU9VKy/57IgJT8iYrDDACjsJXlfwwqreUniY3PrIMe0eSNARhtP2UQxgA7USmXOyElPISgyavOqvEY+a4KP4Jg70osroNvhnJh1H9dG5M/Vm7uZBQW5yc/VMtrSiQ2KLJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4df48d6f-f68d-4f7c-b59a-1cecfa1b1733", "record_id": "flaws_cloudtrail:0000421:4df48d6f-f68d-4f7c-b59a-1cecfa1b1733", "row_index": 421, "timestamp": "2017-05-26T22:28:32Z", "event_type": "DescribeFlowLogs", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA5P6Z62KE174HSZGW", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "ec2-frontend-api.amazonaws.com", "user_agent": "ec2-frontend-api.amazonaws.com", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1011, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4df48d6f-f68d-4f7c-b59a-1cecfa1b1733", "eventTime": "2017-05-26T22:28:32Z", "eventName": "DescribeFlowLogs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2-frontend-api.amazonaws.com", "userAgent": "ec2-frontend-api.amazonaws.com", "awsRegion": "us-east-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA5P6Z62KE174HSZGW", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:28:31Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}, "invokedBy": "ec2-frontend-api.amazonaws.com"}, "responseElements": {"flowLogSet": []}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "99a8265f-14ef-4349-898a-47f927661edb", "record_id": "flaws_cloudtrail:0000422:99a8265f-14ef-4349-898a-47f927661edb", "row_index": 422, "timestamp": "2017-05-26T22:28:33Z", "event_type": "DescribeFlowLogs", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAFXG4RI1BNB60C7LF", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "ec2-frontend-api.amazonaws.com", "user_agent": "ec2-frontend-api.amazonaws.com", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1016, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "99a8265f-14ef-4349-898a-47f927661edb", "eventTime": "2017-05-26T22:28:33Z", "eventName": "DescribeFlowLogs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2-frontend-api.amazonaws.com", "userAgent": "ec2-frontend-api.amazonaws.com", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAFXG4RI1BNB60C7LF", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:28:32Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}, "invokedBy": "ec2-frontend-api.amazonaws.com"}, "responseElements": {"flowLogSet": []}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "12e08c97-a315-4284-b363-a73cd65f7ccb", "record_id": "flaws_cloudtrail:0000423:12e08c97-a315-4284-b363-a73cd65f7ccb", "row_index": 423, "timestamp": "2017-05-26T22:28:33Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "12e08c97-a315-4284-b363-a73cd65f7ccb", "eventTime": "2017-05-26T22:28:33Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAZXBQJLWKQCBWGABI", "expiration": "May 26, 2017 11:28:33 PM", "sessionToken": "FQoDYXdzECAaDNulTKmYE2uPIz5knSLMAQpXAWKiP12iimd4jahm419QH7Ip89jNwH2Pcd0vEgtFPIEjZbOuKYCqdbvHgPUDoDbZ6oMG/lL8BZUh/3Jsf+6KkfDZEGRoOLPNpIGkl/G34yqo53KRrLGmy/03i9RTbVQTdyeri5Gdt7HlGG88KV/pTQwOTeuC4TlJHnZwdIcQ0s2LOPha9bcFXoK2wKscHIgCWPCGvN0C99zp3GgRdNO8H0qyFdLYDam+ozDIOjltqrJsFl7qpwehbnavOicOCBfgOx6+W7Nzs75JfCiR2KLJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4a0f7179-64b8-4ba4-80b9-dd8222a65db3", "record_id": "flaws_cloudtrail:0000424:4a0f7179-64b8-4ba4-80b9-dd8222a65db3", "row_index": 424, "timestamp": "2017-05-26T22:28:34Z", "event_type": "DescribeFlowLogs", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIARYCJ3ZSR2I8PTTZ8", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "ec2-frontend-api.amazonaws.com", "user_agent": "ec2-frontend-api.amazonaws.com", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1014, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4a0f7179-64b8-4ba4-80b9-dd8222a65db3", "eventTime": "2017-05-26T22:28:34Z", "eventName": "DescribeFlowLogs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2-frontend-api.amazonaws.com", "userAgent": "ec2-frontend-api.amazonaws.com", "awsRegion": "ca-central-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIARYCJ3ZSR2I8PTTZ8", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:28:33Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}, "invokedBy": "ec2-frontend-api.amazonaws.com"}, "responseElements": {"flowLogSet": []}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bb9a1232-9d7b-454a-89ca-69896892884f", "record_id": "flaws_cloudtrail:0000425:bb9a1232-9d7b-454a-89ca-69896892884f", "row_index": 425, "timestamp": "2017-05-26T22:28:34Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bb9a1232-9d7b-454a-89ca-69896892884f", "eventTime": "2017-05-26T22:28:34Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAT7I9UJKRU1FM6LLS", "expiration": "May 26, 2017 11:28:34 PM", "sessionToken": "FQoDYXdzECAaDJu6lJMQ+Lo8s4X99CLMAVU/t9gIsAN7jCwmaHXF+eQVVsvkhOHJlhvkYHVgpt5bRC5spOenhD661vHM88fQKqW7V22PtNPgYSRBpxVP+X2upi4tNBnKSX7/tCrtgEw5DMK5U4SdF4m+mXKm33ywM3rQLRy5cq9qmz5ag3ldiLXbJ0l6KrD4ACHGdTqXEa20GK5IF7448+C/zihe+tW5jmXympEk4KONUUrNd6FFIHmht9EJgRai9Xc35DMSgRKrYVX0Qw9exgLnQy9xzwpEbaHBikrjV8hXgncGSiiS2KLJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "729642a0f-97f8-4d12-b28e-57fa5e236485", "record_id": "flaws_cloudtrail:0000426:729642a0f-97f8-4d12-b28e-57fa5e236485", "row_index": 426, "timestamp": "2017-05-26T22:28:36Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1455, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "729642a0f-97f8-4d12-b28e-57fa5e236485", "eventTime": "2017-05-26T22:28:36Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAOOEL1ULTCKANXCFA", "expiration": "May 26, 2017 11:28:36 PM", "sessionToken": "FQoDYXdzECAaDCsEacTd0dCilKKYvyLMAYClkqWACPvDaidMUWkEGTswvxOJpcHsBWKwk4G6fULQeNqdI6dS5infGVtkFx5IvkD8+L6fx+KYP2WYLPL3H37YNCxmH8OHbjggE7DdBhdfpkFG7hS04FRHBQR4835qgktEiOARBPLBNs2CJJdcn9eQiDw7U5QaxLqYJhb195xa/u/VNIUoJS2D0CMC31h0idFNMDfpJCcXYjtejNwtk0sGxuAGFONrayfJnSc9fuIG7rqdelmvL1fm1k3EqiwbBIFWLtbA112vcRfLVSiU2KLJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "da14ad89-d826-4974-8b2b-42bb83ad93b2", "record_id": "flaws_cloudtrail:0000427:da14ad89-d826-4974-8b2b-42bb83ad93b2", "row_index": 427, "timestamp": "2017-05-26T22:28:36Z", "event_type": "DescribeFlowLogs", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAK3UD9K1KALXH2N1Y", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "ec2-frontend-api.amazonaws.com", "user_agent": "ec2-frontend-api.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1009, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "da14ad89-d826-4974-8b2b-42bb83ad93b2", "eventTime": "2017-05-26T22:28:36Z", "eventName": "DescribeFlowLogs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2-frontend-api.amazonaws.com", "userAgent": "ec2-frontend-api.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAK3UD9K1KALXH2N1Y", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:28:36Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}, "invokedBy": "ec2-frontend-api.amazonaws.com"}, "responseElements": {"flowLogSet": []}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e0f9a10a-ee9f-4a57-878d-b88a637a9b23", "record_id": "flaws_cloudtrail:0000428:e0f9a10a-ee9f-4a57-878d-b88a637a9b23", "row_index": 428, "timestamp": "2017-05-26T22:28:37Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e0f9a10a-ee9f-4a57-878d-b88a637a9b23", "eventTime": "2017-05-26T22:28:37Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAWLLD3IDSERWBY8MD", "expiration": "May 26, 2017 11:28:37 PM", "sessionToken": "FQoDYXdzECAaDFNkANoeT62dF1aVjSLMAT6LswwGE1AfEch2GIiG65UhgSfrFpV9k2i7eQcYiCPe5xud0QU1Nh/RlrWR3pXIqRLxlOzy8PA2jxotJoYGdp+w1LvZmjhzzDKWZxLEBfkWmKytjJMsE4AB83VzPFeDi82DTVF++32sIQ0MHuyKsL67ptQqHKunWNYr7mwjoXsQCc0TiEJeaJthXwvVSUq8+zmIzHqe7Mw8PNXftGQpQV5EoiPeIwjwoyhqjLI9ooAFhYVfQ7WpcsbiXQv1DmgY66jG7Rzn1XF3znkfgiiV2KLJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4007a0f9-3953-485e-8429-ebdeb33b8edb", "record_id": "flaws_cloudtrail:0000429:4007a0f9-3953-485e-8429-ebdeb33b8edb", "row_index": 429, "timestamp": "2017-05-26T22:28:37Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4007a0f9-3953-485e-8429-ebdeb33b8edb", "eventTime": "2017-05-26T22:28:37Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIA327GUZZDAFMVR7NX", "expiration": "May 26, 2017 11:28:37 PM", "sessionToken": "FQoDYXdzECAaDEX/UPzLhJGDdbk/USLMAedIROG5pl8K/PIql5//cWn3QCxC0bM0WP36kDAKsqPOqaswUtKmezs5mrqFpzV6EyU4oGkjzltEsNRG5T89zRfUAzORZzrlxYx+an9oJfeyw0NISOlgbRnJCGIgtiFQiKgeflzGRKQR931Z/Vz4TLoXEMCpHFWwAJ5j10weiwHJlAutL0K9PMQPPniglQpNAm88ZRF/INRkh0v41pLsfuxmDedkJdqdd1ZkdP2XwbJrjB2b6XuFqKx04QRPig9sCYbQR0jxw+K/icxpXyiV2KLJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fddae540-69bf-4c74-9ceb-644ae394ac0c", "record_id": "flaws_cloudtrail:0000430:fddae540-69bf-4c74-9ceb-644ae394ac0c", "row_index": 430, "timestamp": "2017-05-26T22:28:39Z", "event_type": "DescribeFlowLogs", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA1Y8BSOI2J5ENIBY5", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "ec2-frontend-api.amazonaws.com", "user_agent": "ec2-frontend-api.amazonaws.com", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 1012, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fddae540-69bf-4c74-9ceb-644ae394ac0c", "eventTime": "2017-05-26T22:28:39Z", "eventName": "DescribeFlowLogs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2-frontend-api.amazonaws.com", "userAgent": "ec2-frontend-api.amazonaws.com", "awsRegion": "ap-south-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA1Y8BSOI2J5ENIBY5", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:28:37Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}, "invokedBy": "ec2-frontend-api.amazonaws.com"}, "responseElements": {"flowLogSet": []}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "81053afa-5383-44cb-91ab-ea64c5c7c0de", "record_id": "flaws_cloudtrail:0000431:81053afa-5383-44cb-91ab-ea64c5c7c0de", "row_index": 431, "timestamp": "2017-05-26T22:28:39Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1455, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "81053afa-5383-44cb-91ab-ea64c5c7c0de", "eventTime": "2017-05-26T22:28:39Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAMUXENJ86CHRNKYAR", "expiration": "May 26, 2017 11:28:39 PM", "sessionToken": "FQoDYXdzECAaDJMbTKOnTKUIi101MiLMAfI39eYP7uk8h4XU80wduTQh4voJmtIbXd2y4iUGHvhRXzyNlof0KJITB2bsaGFrAuC3RR9edRxvbU0+gv9cV+EdIGqKZ+9sZjG5YUoWR0dKzCv+TRVgdxma5Sc/oKCW8H1NleBfSWYFUXcWBVKDjaETfops2kLtIHQIohXoUErz515TjA6H0jrsPnyLVuATstNVgMg0XPa05J5f7Hu+84NWSbHdGgIduBQHoSYtIxIxSV2/OUbHHYXh1bFlYk1DTO5HWApPiXp0czkvZiiX2KLJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9b21662-51e6-414a-9ba4-1fd13eb836047", "record_id": "flaws_cloudtrail:0000432:9b21662-51e6-414a-9ba4-1fd13eb836047", "row_index": 432, "timestamp": "2017-05-26T22:28:40Z", "event_type": "DescribeFlowLogs", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAL41R1WAZIU2VAOPA", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "ec2-frontend-api.amazonaws.com", "user_agent": "ec2-frontend-api.amazonaws.com", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1014, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9b21662-51e6-414a-9ba4-1fd13eb836047", "eventTime": "2017-05-26T22:28:40Z", "eventName": "DescribeFlowLogs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2-frontend-api.amazonaws.com", "userAgent": "ec2-frontend-api.amazonaws.com", "awsRegion": "eu-central-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAL41R1WAZIU2VAOPA", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:28:39Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}, "invokedBy": "ec2-frontend-api.amazonaws.com"}, "responseElements": {"flowLogSet": []}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "944c25cf-a199-492b-bc3c-b3dc6e98e143", "record_id": "flaws_cloudtrail:0000433:944c25cf-a199-492b-bc3c-b3dc6e98e143", "row_index": 433, "timestamp": "2017-05-26T22:28:41Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "944c25cf-a199-492b-bc3c-b3dc6e98e143", "eventTime": "2017-05-26T22:28:41Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIA8PFL1X257E14B8C5", "expiration": "May 26, 2017 11:28:41 PM", "sessionToken": "FQoDYXdzECAaDExqibhRrfBrXZxNNiLMATzZx5f0f7JqOebI1/9R7s9WBDHh2CUFnbne2ngyIK++tCnJM0OPqeSbMwvT3HZwnV/5/hVnL8B4dyKq4GSsLI1yke7focXgKpU0uTdpR1XIMJi+Xm0GTjgjUY2cclQqx9X34Dv0n7err66noz35xJ9VG1TtgXT1gj2vO+LtJATjpZ/1SOcscEgeSroYI4EVcpjAblkdopfAArsVg9EeCJsRXheD8GFaBR+HScJNMQAt6z+KiIS0Vyl1K1+l+s/Phs2v9erRGkXId/j0EiiZ2KLJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f36c26e2-8efb-4076-874c-59fcccf0e10a", "record_id": "flaws_cloudtrail:0000434:f36c26e2-8efb-4076-874c-59fcccf0e10a", "row_index": 434, "timestamp": "2017-05-26T22:28:42Z", "event_type": "DescribeFlowLogs", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAFSWFT676R4JJ9RGS", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "ec2-frontend-api.amazonaws.com", "user_agent": "ec2-frontend-api.amazonaws.com", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1011, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f36c26e2-8efb-4076-874c-59fcccf0e10a", "eventTime": "2017-05-26T22:28:42Z", "eventName": "DescribeFlowLogs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2-frontend-api.amazonaws.com", "userAgent": "ec2-frontend-api.amazonaws.com", "awsRegion": "eu-west-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAFSWFT676R4JJ9RGS", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:28:41Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}, "invokedBy": "ec2-frontend-api.amazonaws.com"}, "responseElements": {"flowLogSet": []}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9cddf1b6-e94a-4572-ad07-9768b45321a7", "record_id": "flaws_cloudtrail:0000435:9cddf1b6-e94a-4572-ad07-9768b45321a7", "row_index": 435, "timestamp": "2017-05-26T22:28:42Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9cddf1b6-e94a-4572-ad07-9768b45321a7", "eventTime": "2017-05-26T22:28:42Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIANTCOLPRCRDH3Y0RE", "expiration": "May 26, 2017 11:28:42 PM", "sessionToken": "FQoDYXdzECAaDE2aILJpEDUVBXIVDiLMAaE3OWtG4p9Ur2SMqgajEGYlWJLWKXOyjm9LUksv40ygq8NshSZtk7EFwoqCyf2FenJBD9feEwVnlPgPtf0JH6Tygkz6QyVyUeX5Mq5LVczDskpOB9zUxHDGQdeG2NRBex7MqGmZhGiRVlxVxgF1X6HfM8vva1WShf8I5duNvMoigkgw/SQasqezcRELbs0KSb+5vHV3D738sOZpY79OKSEPMS/14n9Z8KxeGOXmGgFv/jJTTKY6euFXcxjf0L5+6KFH+bCyPStxzoRrFiia2KLJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "037beac3-1943-4689-a823-be8c4e40a86e", "record_id": "flaws_cloudtrail:0000436:037beac3-1943-4689-a823-be8c4e40a86e", "row_index": 436, "timestamp": "2017-05-26T22:28:43Z", "event_type": "DescribeFlowLogs", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAZQZYEZ4K7VFWZZIM", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "ec2-frontend-api.amazonaws.com", "user_agent": "ec2-frontend-api.amazonaws.com", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1011, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "037beac3-1943-4689-a823-be8c4e40a86e", "eventTime": "2017-05-26T22:28:43Z", "eventName": "DescribeFlowLogs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2-frontend-api.amazonaws.com", "userAgent": "ec2-frontend-api.amazonaws.com", "awsRegion": "eu-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAZQZYEZ4K7VFWZZIM", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:28:42Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}, "invokedBy": "ec2-frontend-api.amazonaws.com"}, "responseElements": {"flowLogSet": []}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4f2bb67f-246b-4b07-a90e-c534b72c4477", "record_id": "flaws_cloudtrail:0000437:4f2bb67f-246b-4b07-a90e-c534b72c4477", "row_index": 437, "timestamp": "2017-05-26T22:28:43Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1446, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4f2bb67f-246b-4b07-a90e-c534b72c4477", "eventTime": "2017-05-26T22:28:43Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "cloudaux"}, "responseElements": {"credentials": {"accessKeyId": "ASIAEZS2JV5ZWQAWZIER", "expiration": "May 26, 2017 11:28:43 PM", "sessionToken": "FQoDYXdzECAaDEUdH1v5dsqeNBmjmSLLAW/DrnYyBrIZUTQpyh0WKAyWbGJKFH3zgMM19/WQjF382FxH560VN+d0MNZY3L7UZxnJ6VbdKe2q8gOeJb8WpinETFpf27/D1MiS3ICAh5k1dldtj+ceRuJBsg8liwT76uGirS+HLMVMxxDzDD/LVa2jrYrV0KDPnmv6G1qLJA3Sk0XQUpyL+rBlzmNh52pODKzCOYrOFJsoD/ns/ISJtExxcWUWiScZzr0M7qSwbH7pWRSUh+tQxIsOmmczuWBIWnZ73H8ZX+hg00e8KJvYoskF"}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:cloudaux", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/cloudaux"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9c5456bb-9e9c-4229-a38d-a9c9ed7e1d86", "record_id": "flaws_cloudtrail:0000438:9c5456bb-9e9c-4229-a38d-a9c9ed7e1d86", "row_index": 438, "timestamp": "2017-05-26T22:28:44Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9c5456bb-9e9c-4229-a38d-a9c9ed7e1d86", "eventTime": "2017-05-26T22:28:44Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIA870QJBWU74UDP0AS", "expiration": "May 26, 2017 11:28:44 PM", "sessionToken": "FQoDYXdzECAaDLkqSZkDRl1gXmNsICLMAds1ZpLXYi3MhQNvEK/xu+ydNFeuBG8eQ2zRBZqz17qdu/5WowcL6+S71jSPwsJjY1JFo/KzPVQ8FoGHkP9kw9T19xpc2vmsbCsmGaSLCIJxEQs1kil/4s71LQayjPXYwXKGr605mKOaQsRmHZwQlP7diWJnbLiB+EdeYa6MQNPj6bKX3m8V2F3LibESymVCPIBnFHkFwOf9lKI68o0YdH8agcGuRCULkV1/kqFFiVU8j/1NjfpgW17x8N3TBlQZGfVXnAfksG+Hy3Vjvyic2KLJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5946d49a-3603-42a6-97bb-89c59e573d9d", "record_id": "flaws_cloudtrail:0000439:5946d49a-3603-42a6-97bb-89c59e573d9d", "row_index": 439, "timestamp": "2017-05-26T22:28:44Z", "event_type": "ListHostedZones", "event_source": "route53.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/cloudaux", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:cloudaux", "user_name": null, "access_key_id": "ASIAEZS2JV5ZWQAWZIER", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 998, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5946d49a-3603-42a6-97bb-89c59e573d9d", "eventTime": "2017-05-26T22:28:44Z", "eventName": "ListHostedZones", "eventSource": "route53.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:cloudaux", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/cloudaux", "accountId": "811596193553", "accessKeyId": "ASIAEZS2JV5ZWQAWZIER", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:28:43Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "738542f4-aa54-4ae4-a9c8-e0d6c2ac7a90", "record_id": "flaws_cloudtrail:0000440:738542f4-aa54-4ae4-a9c8-e0d6c2ac7a90", "row_index": 440, "timestamp": "2017-05-26T22:28:46Z", "event_type": "DescribeSubnets", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA870QJBWU74UDP0AS", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1003, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "738542f4-aa54-4ae4-a9c8-e0d6c2ac7a90", "eventTime": "2017-05-26T22:28:46Z", "eventName": "DescribeSubnets", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA870QJBWU74UDP0AS", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:28:44Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"subnetSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "89d75d85-a753-43e3-813c-b22daad7a3cd", "record_id": "flaws_cloudtrail:0000441:89d75d85-a753-43e3-813c-b22daad7a3cd", "row_index": 441, "timestamp": "2017-05-26T22:28:48Z", "event_type": "DescribeSubnets", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA870QJBWU74UDP0AS", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1003, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "89d75d85-a753-43e3-813c-b22daad7a3cd", "eventTime": "2017-05-26T22:28:48Z", "eventName": "DescribeSubnets", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA870QJBWU74UDP0AS", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:28:44Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"subnetSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "59d228e6-1964-46c4-ae6c-356b71f96fb7", "record_id": "flaws_cloudtrail:0000442:59d228e6-1964-46c4-ae6c-356b71f96fb7", "row_index": 442, "timestamp": "2017-05-26T22:28:48Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIASQ4ZTBOL7CW8XXWD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "216.87.202.71", "user_agent": "aws-cli/1.18.69 Python/3.6.0 Linux/4.14.181-140.257.amzn2.x86_64 botocore/1.16.19", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 546, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "59d228e6-1964-46c4-ae6c-356b71f96fb7", "eventTime": "2017-05-26T22:28:48Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "216.87.202.71", "userAgent": "aws-cli/1.18.69 Python/3.6.0 Linux/4.14.181-140.257.amzn2.x86_64 botocore/1.16.19", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIASQ4ZTBOL7CW8XXWD", "userName": "SecurityMokey"}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "36f3875d-031d-4c5a-8864-0fcf9e5dec0a", "record_id": "flaws_cloudtrail:0000443:36f3875d-031d-4c5a-8864-0fcf9e5dec0a", "row_index": 443, "timestamp": "2017-05-26T22:28:49Z", "event_type": "DescribeSubnets", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA870QJBWU74UDP0AS", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 997, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "36f3875d-031d-4c5a-8864-0fcf9e5dec0a", "eventTime": "2017-05-26T22:28:49Z", "eventName": "DescribeSubnets", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-south-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA870QJBWU74UDP0AS", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:28:44Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"subnetSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c3d5c35a-f787-42a8-8520-7cd304d245b5", "record_id": "flaws_cloudtrail:0000444:c3d5c35a-f787-42a8-8520-7cd304d245b5", "row_index": 444, "timestamp": "2017-05-26T22:28:50Z", "event_type": "DescribeSubnets", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA870QJBWU74UDP0AS", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1003, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c3d5c35a-f787-42a8-8520-7cd304d245b5", "eventTime": "2017-05-26T22:28:50Z", "eventName": "DescribeSubnets", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA870QJBWU74UDP0AS", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:28:44Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"subnetSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b07b2806-904e-4d47-b6c0-823bfc67ae0e", "record_id": "flaws_cloudtrail:0000445:b07b2806-904e-4d47-b6c0-823bfc67ae0e", "row_index": 445, "timestamp": "2017-05-26T22:28:51Z", "event_type": "DescribeSubnets", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA870QJBWU74UDP0AS", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1003, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b07b2806-904e-4d47-b6c0-823bfc67ae0e", "eventTime": "2017-05-26T22:28:51Z", "eventName": "DescribeSubnets", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA870QJBWU74UDP0AS", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:28:44Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"subnetSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2746e423-1462-47e4-b85b-959761aafa09", "record_id": "flaws_cloudtrail:0000446:2746e423-1462-47e4-b85b-959761aafa09", "row_index": 446, "timestamp": "2017-05-26T22:28:52Z", "event_type": "DescribeSubnets", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA870QJBWU74UDP0AS", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1000, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2746e423-1462-47e4-b85b-959761aafa09", "eventTime": "2017-05-26T22:28:52Z", "eventName": "DescribeSubnets", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ca-central-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA870QJBWU74UDP0AS", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:28:44Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"subnetSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "441f8978-9cb6-4c91-933b-362ec4a7ef07", "record_id": "flaws_cloudtrail:0000447:441f8978-9cb6-4c91-933b-362ec4a7ef07", "row_index": 447, "timestamp": "2017-05-26T22:28:53Z", "event_type": "DescribeSubnets", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA870QJBWU74UDP0AS", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1000, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "441f8978-9cb6-4c91-933b-362ec4a7ef07", "eventTime": "2017-05-26T22:28:53Z", "eventName": "DescribeSubnets", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "eu-central-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA870QJBWU74UDP0AS", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:28:44Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"subnetSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "78ebca45-ba23-4cab-9e1c-eda6ebd19ee0", "record_id": "flaws_cloudtrail:0000448:78ebca45-ba23-4cab-9e1c-eda6ebd19ee0", "row_index": 448, "timestamp": "2017-05-26T22:28:54Z", "event_type": "DescribeSubnets", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA870QJBWU74UDP0AS", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 998, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "78ebca45-ba23-4cab-9e1c-eda6ebd19ee0", "eventTime": "2017-05-26T22:28:54Z", "eventName": "DescribeSubnets", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "eu-west-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA870QJBWU74UDP0AS", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:28:44Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"subnetSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ed5cefcc-3c0a-41c0-8f56-5ac52c62701c", "record_id": "flaws_cloudtrail:0000449:ed5cefcc-3c0a-41c0-8f56-5ac52c62701c", "row_index": 449, "timestamp": "2017-05-26T22:28:55Z", "event_type": "DescribeSubnets", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA870QJBWU74UDP0AS", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 998, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ed5cefcc-3c0a-41c0-8f56-5ac52c62701c", "eventTime": "2017-05-26T22:28:55Z", "eventName": "DescribeSubnets", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "eu-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA870QJBWU74UDP0AS", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:28:44Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"subnetSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "998082cb-4e49-4398-8a9f-8fbd79e7c859", "record_id": "flaws_cloudtrail:0000450:998082cb-4e49-4398-8a9f-8fbd79e7c859", "row_index": 450, "timestamp": "2017-05-26T22:28:56Z", "event_type": "DescribeSubnets", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA870QJBWU74UDP0AS", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 998, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "998082cb-4e49-4398-8a9f-8fbd79e7c859", "eventTime": "2017-05-26T22:28:56Z", "eventName": "DescribeSubnets", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "sa-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA870QJBWU74UDP0AS", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:28:44Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"subnetSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "30e3a69e-f69b-4c36-a921-d9a8efaf7c78", "record_id": "flaws_cloudtrail:0000451:30e3a69e-f69b-4c36-a921-d9a8efaf7c78", "row_index": 451, "timestamp": "2017-05-26T22:28:57Z", "event_type": "DescribeSubnets", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA870QJBWU74UDP0AS", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 998, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "30e3a69e-f69b-4c36-a921-d9a8efaf7c78", "eventTime": "2017-05-26T22:28:57Z", "eventName": "DescribeSubnets", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA870QJBWU74UDP0AS", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:28:44Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"subnetSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cb8715ce-daa8-470e-9dbd-23b91dc1a433", "record_id": "flaws_cloudtrail:0000452:cb8715ce-daa8-470e-9dbd-23b91dc1a433", "row_index": 452, "timestamp": "2017-05-26T22:28:57Z", "event_type": "DescribeSubnets", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA870QJBWU74UDP0AS", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 998, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cb8715ce-daa8-470e-9dbd-23b91dc1a433", "eventTime": "2017-05-26T22:28:57Z", "eventName": "DescribeSubnets", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA870QJBWU74UDP0AS", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:28:44Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"subnetSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "86f7234b-225f-4d01-9fa4-a30adff3e429", "record_id": "flaws_cloudtrail:0000453:86f7234b-225f-4d01-9fa4-a30adff3e429", "row_index": 453, "timestamp": "2017-05-26T22:28:58Z", "event_type": "DescribeSubnets", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA870QJBWU74UDP0AS", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 999, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "86f7234b-225f-4d01-9fa4-a30adff3e429", "eventTime": "2017-05-26T22:28:58Z", "eventName": "DescribeSubnets", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-west-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA870QJBWU74UDP0AS", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:28:44Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"subnetSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9114a789-7a26-48d1-a3c3-6fe03863", "record_id": "flaws_cloudtrail:0000454:9114a789-7a26-48d1-a3c3-6fe03863", "row_index": 454, "timestamp": "2017-05-26T22:28:58Z", "event_type": "DescribeSubnets", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA870QJBWU74UDP0AS", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 994, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9114a789-7a26-48d1-a3c3-6fe03863", "eventTime": "2017-05-26T22:28:58Z", "eventName": "DescribeSubnets", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA870QJBWU74UDP0AS", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:28:44Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"subnetSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ecb4acc8-cc63-4dce-b773-8252ed6190ac", "record_id": "flaws_cloudtrail:0000455:ecb4acc8-cc63-4dce-b773-8252ed6190ac", "row_index": 455, "timestamp": "2017-05-26T22:28:59Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ecb4acc8-cc63-4dce-b773-8252ed6190ac", "eventTime": "2017-05-26T22:28:59Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAPN301F8U32VLV8AA", "expiration": "May 26, 2017 11:28:59 PM", "sessionToken": "FQoDYXdzECAaDLZ/ZZqMFuX/32aogiLMAaLiC5AwUlmlVCJKBcDQlkN/6Z+yK+CZy7D96rqyptDIE7L8tm6jpWDHjfGYQoonqH6a+/aBQ7BL2Vkh2pxAn128UHlfYo2GzX14ttu5AbTb/w4wjmMGsXFQl0nul+NQ3Lld/pmW9rWkp1u5HOGu4ELpRi07JIzKMoGIpIACXG7sre2iGWHYLxnI3Zf9JCRB8ZKcH0m/wELq98T7T96agfd4YrZBqmc6Nyzf2pBU5yGtCQOwC/8cOUEjnMHaRoMlWdZNzJouDEH9JnuCgyir2KLJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cbcf1586-7989-41b9-83f5-11e6d279d09d", "record_id": "flaws_cloudtrail:0000456:cbcf1586-7989-41b9-83f5-11e6d279d09d", "row_index": 456, "timestamp": "2017-05-26T22:29:00Z", "event_type": "DescribeRegions", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPN301F8U32VLV8AA", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto/2.47.0 Python/2.7.12 Linux/4.4.0-78-generic", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 967, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cbcf1586-7989-41b9-83f5-11e6d279d09d", "eventTime": "2017-05-26T22:29:00Z", "eventName": "DescribeRegions", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto/2.47.0 Python/2.7.12 Linux/4.4.0-78-generic", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPN301F8U32VLV8AA", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:28:59Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"regionSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f3853d3d-d7be-4025-a585-abd56876daa", "record_id": "flaws_cloudtrail:0000457:f3853d3d-d7be-4025-a585-abd56876daa", "row_index": 457, "timestamp": "2017-05-26T22:29:00Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f3853d3d-d7be-4025-a585-abd56876daa", "eventTime": "2017-05-26T22:29:00Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAHKLW4YGJIWGUH2KI", "expiration": "May 26, 2017 11:29:00 PM", "sessionToken": "FQoDYXdzECAaDNbNKRtPv+RYMeVh1CLMAf+gBVieNwPWRTkhRsRRHp1ht5nW8qf80srpDIu+YNXl43Y6f51KVkpvVwcvPk3TOjRwOaP8EvPOjFVLn8hBYjbQBP+h7mDvtD7rH4wTd4AVI/d2hmsABfUBD6E30U3loFea9v2Tsi97F74/Pxc4Zy2mh4gxAQ3ZwxdKrFEbBpOusMN1YKQnP89n6A6VxpntYjU4wH1Qzplhgu3wshgworz5fccIhuL4BbvvvhrOnhYrN6v+41lKv19v8jGLXpxkZNbQJSOuzwa8547WBSis2KLJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "503ce52a-6e04-4bf5-8c3a-428b88c4e127", "record_id": "flaws_cloudtrail:0000458:503ce52a-6e04-4bf5-8c3a-428b88c4e127", "row_index": 458, "timestamp": "2017-05-26T22:29:02Z", "event_type": "DescribeTags", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAHKLW4YGJIWGUH2KI", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 981, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "503ce52a-6e04-4bf5-8c3a-428b88c4e127", "eventTime": "2017-05-26T22:29:02Z", "eventName": "DescribeTags", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-south-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAHKLW4YGJIWGUH2KI", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:29:00Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3d94bcee-672a-42d0-adf8-9809fd7d5c25", "record_id": "flaws_cloudtrail:0000459:3d94bcee-672a-42d0-adf8-9809fd7d5c25", "row_index": 459, "timestamp": "2017-05-26T22:29:02Z", "event_type": "DescribeAddresses", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAHKLW4YGJIWGUH2KI", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 1026, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3d94bcee-672a-42d0-adf8-9809fd7d5c25", "eventTime": "2017-05-26T22:29:02Z", "eventName": "DescribeAddresses", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-south-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAHKLW4YGJIWGUH2KI", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:29:00Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"publicIpsSet": {}, "filterSet": {}, "allocationIdsSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "efd927542-4bcd-4f06-9239-a71ec764b1c5", "record_id": "flaws_cloudtrail:0000460:efd927542-4bcd-4f06-9239-a71ec764b1c5", "row_index": 460, "timestamp": "2017-05-26T22:29:02Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 882, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "efd927542-4bcd-4f06-9239-a71ec764b1c5", "eventTime": "2017-05-26T22:29:02Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a2ebc101-bbc8-45c7-b387-d310b5caca81", "record_id": "flaws_cloudtrail:0000461:a2ebc101-bbc8-45c7-b387-d310b5caca81", "row_index": 461, "timestamp": "2017-05-26T22:29:03Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a2ebc101-bbc8-45c7-b387-d310b5caca81", "eventTime": "2017-05-26T22:29:03Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIA3U2JIBM1ZEXWG3L8", "expiration": "May 26, 2017 11:29:03 PM", "sessionToken": "FQoDYXdzECAaDISj6OnbOFHWXmv3gSLMATLXSAPdqZ7jvSav5sbIm15W4IhQ9qc8K1LCjYFOIAIODqb/yylafLYlskYVsIvLM+aWbiLudupcyKBgXekD1TrxqKVNCMSd4riZ1c2Piviq+dEk3OaPXlBvp8BgjpZ9XsgJp24Cgi7gxcyqfYJUuPXFYf2AxXTuNP9dO/dyplKS0lhkhl3a82IS99l2jwz7CNYEIbtfTsFzR6pvd4UoYiNoV8CxoJY9CucsdoTq9OANx+2VhnjRtkC9IFBpKYilI7ovCwQiMwoqvyPGcCiv2KLJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b91dc092-2239-4f04-b7bb-0bf36a64aaff", "record_id": "flaws_cloudtrail:0000462:b91dc092-2239-4f04-b7bb-0bf36a64aaff", "row_index": 462, "timestamp": "2017-05-26T22:29:03Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 880, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b91dc092-2239-4f04-b7bb-0bf36a64aaff", "eventTime": "2017-05-26T22:29:03Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2e244395a-d0db-4d72-9f11-ee21d0b9a956", "record_id": "flaws_cloudtrail:0000463:2e244395a-d0db-4d72-9f11-ee21d0b9a956", "row_index": 463, "timestamp": "2017-05-26T22:29:04Z", "event_type": "DescribeTags", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA3U2JIBM1ZEXWG3L8", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 985, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2e244395a-d0db-4d72-9f11-ee21d0b9a956", "eventTime": "2017-05-26T22:29:04Z", "eventName": "DescribeTags", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA3U2JIBM1ZEXWG3L8", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:29:03Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b690a257-fa1a-4e93-9989-efdf3625ca34", "record_id": "flaws_cloudtrail:0000464:b690a257-fa1a-4e93-9989-efdf3625ca34", "row_index": 464, "timestamp": "2017-05-26T22:29:04Z", "event_type": "DescribeAddresses", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA3U2JIBM1ZEXWG3L8", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1030, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b690a257-fa1a-4e93-9989-efdf3625ca34", "eventTime": "2017-05-26T22:29:04Z", "eventName": "DescribeAddresses", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA3U2JIBM1ZEXWG3L8", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:29:03Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"publicIpsSet": {}, "filterSet": {}, "allocationIdsSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7ed84939-d9a6-40c3-8329-d30c4c7e7499", "record_id": "flaws_cloudtrail:0000465:7ed84939-d9a6-40c3-8329-d30c4c7e7499", "row_index": 465, "timestamp": "2017-05-26T22:29:05Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1455, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7ed84939-d9a6-40c3-8329-d30c4c7e7499", "eventTime": "2017-05-26T22:29:05Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAYY4L8CG8991OKCV5", "expiration": "May 26, 2017 11:29:05 PM", "sessionToken": "FQoDYXdzECAaDJuRvfNyqdOTHrE2OCLMAZFwTfaM4JE25H5p4psAApZCZGC11/9uo83/AA92qdchtWWVF6CpNYzBqoQq2Dbvei2P6S5JpwoaYgsWc4kklRCFR00J9eAUZl3EaIvNRaErcPIvKuKDs6d0yNVqZcE3HiQFmK22JdYkz714yUGRcLJI5/r7xJFU5P4wKD2zAG9yXm4+FvbPAPKSlzHJeF0LlnLEsRiX7CrnAPtO2UeVnkee/RoxtudVMe0NEVk86rYvisxz12YWTsGDaUCUOROY/+7f5djTNNL5+7oTaSix2KLJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "daff4fac-d851-4643-95ff-152c0f354c06", "record_id": "flaws_cloudtrail:0000466:daff4fac-d851-4643-95ff-152c0f354c06", "row_index": 466, "timestamp": "2017-05-26T22:29:06Z", "event_type": "DescribeAddresses", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAYY4L8CG8991OKCV5", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1030, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "daff4fac-d851-4643-95ff-152c0f354c06", "eventTime": "2017-05-26T22:29:06Z", "eventName": "DescribeAddresses", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAYY4L8CG8991OKCV5", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:29:05Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"publicIpsSet": {}, "filterSet": {}, "allocationIdsSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dc969574-32a4-475f-b3c1-bfe0833a26e1", "record_id": "flaws_cloudtrail:0000467:dc969574-32a4-475f-b3c1-bfe0833a26e1", "row_index": 467, "timestamp": "2017-05-26T22:29:06Z", "event_type": "DescribeTags", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAYY4L8CG8991OKCV5", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 985, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dc969574-32a4-475f-b3c1-bfe0833a26e1", "eventTime": "2017-05-26T22:29:06Z", "eventName": "DescribeTags", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAYY4L8CG8991OKCV5", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:29:05Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bb59962-c83e-4093-aa6e-66de70bc04da", "record_id": "flaws_cloudtrail:0000468:bb59962-c83e-4093-aa6e-66de70bc04da", "row_index": 468, "timestamp": "2017-05-26T22:29:06Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1453, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bb59962-c83e-4093-aa6e-66de70bc04da", "eventTime": "2017-05-26T22:29:06Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIA9BDSR9GKLCMITXC5", "expiration": "May 26, 2017 11:29:06 PM", "sessionToken": "FQoDYXdzECAaDAOwvQkzrvx7LJzzeyLMATAAk9rtsjbegquP/tDFoSmjLbxFdXN4qhnC0EGmUuj4GUrnoCpmjtQ4vQImzXTRFosged785G01JMl1UunbxoDF8Udr+EHt7vKwS7MDBsF0xvp+7MtHOqJtT88COQGMZZnJBmun2s0RYdeJsTwHzqG2kbrfQqRjhE3mcJPuRWeo+JRHWJoByxYJHLuhexQW5YfGLLjF7KCkIfBjfZvAnJL/4EcX9LOnTgtFe0tVyXwk6qtDYmEnU1FXB9LdpW6j4BAfROChzsm+LoY+vCiy2KLJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e4b711723-6678-4b88-aeff-71801a7185d2", "record_id": "flaws_cloudtrail:0000469:e4b711723-6678-4b88-aeff-71801a7185d2", "row_index": 469, "timestamp": "2017-05-26T22:29:07Z", "event_type": "DescribeAddresses", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA9BDSR9GKLCMITXC5", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1026, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e4b711723-6678-4b88-aeff-71801a7185d2", "eventTime": "2017-05-26T22:29:07Z", "eventName": "DescribeAddresses", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "sa-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA9BDSR9GKLCMITXC5", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:29:06Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"publicIpsSet": {}, "filterSet": {}, "allocationIdsSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cf5ac665-28de-4eee-8dca-9c76ee3c3475", "record_id": "flaws_cloudtrail:0000470:cf5ac665-28de-4eee-8dca-9c76ee3c3475", "row_index": 470, "timestamp": "2017-05-26T22:29:07Z", "event_type": "DescribeTags", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA9BDSR9GKLCMITXC5", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 981, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cf5ac665-28de-4eee-8dca-9c76ee3c3475", "eventTime": "2017-05-26T22:29:07Z", "eventName": "DescribeTags", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "sa-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA9BDSR9GKLCMITXC5", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:29:06Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b2b880a7-da77-4d6d-b593-482f60dfe138", "record_id": "flaws_cloudtrail:0000471:b2b880a7-da77-4d6d-b593-482f60dfe138", "row_index": 471, "timestamp": "2017-05-26T22:29:08Z", "event_type": "DescribeTags", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAVZ3SBA5QO2CDEV1L", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 983, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b2b880a7-da77-4d6d-b593-482f60dfe138", "eventTime": "2017-05-26T22:29:08Z", "eventName": "DescribeTags", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ca-central-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAVZ3SBA5QO2CDEV1L", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:29:08Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a306fdee-6d4c-4116-adf6-302a35b03d4a", "record_id": "flaws_cloudtrail:0000472:a306fdee-6d4c-4116-adf6-302a35b03d4a", "row_index": 472, "timestamp": "2017-05-26T22:29:08Z", "event_type": "DescribeAddresses", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAVZ3SBA5QO2CDEV1L", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1028, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a306fdee-6d4c-4116-adf6-302a35b03d4a", "eventTime": "2017-05-26T22:29:08Z", "eventName": "DescribeAddresses", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ca-central-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAVZ3SBA5QO2CDEV1L", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:29:08Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"publicIpsSet": {}, "filterSet": {}, "allocationIdsSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4029a438-2eeb-467a-8f26-a2d6274a1902", "record_id": "flaws_cloudtrail:0000473:4029a438-2eeb-467a-8f26-a2d6274a1902", "row_index": 473, "timestamp": "2017-05-26T22:29:08Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4029a438-2eeb-467a-8f26-a2d6274a1902", "eventTime": "2017-05-26T22:29:08Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAVZ3SBA5QO2CDEV1L", "expiration": "May 26, 2017 11:29:08 PM", "sessionToken": "FQoDYXdzECAaDEtIhtcYj+7JJVglPyLMAZXXs/eeGudNLFmC19kDgP6NZ72hUNYKUXOS3nolcQ3HQW+h0Z+FFbqci8wqjbEtOG0WRJLAn0NtqW1CLfFJ/eARt84TyN6HVgdi7P7ENJdoyvwJRCGoI9wXgM6HdFCesA0HuoU1Tzu7+8HoWe8G9i0rvNVxULGHkkh1zE6uvQTcmTHTqMMBo85xk6L2+dbSskLnGh3BYzVokNlhn/2kZYqrdxcvT6evL4ai7VHhzSRGMWK0nF931UefsqGkdAHLU+sZXzwsTB2pY/Om1ii02KLJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5cc54b8d-e1d8-4178-9acc-0000e71a0dd9", "record_id": "flaws_cloudtrail:0000474:5cc54b8d-e1d8-4178-9acc-0000e71a0dd9", "row_index": 474, "timestamp": "2017-05-26T22:29:09Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 881, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5cc54b8d-e1d8-4178-9acc-0000e71a0dd9", "eventTime": "2017-05-26T22:29:09Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bb4101db-e645-4e79-9b2e-3de5a3d8a771", "record_id": "flaws_cloudtrail:0000475:bb4101db-e645-4e79-9b2e-3de5a3d8a771", "row_index": 475, "timestamp": "2017-05-26T22:29:09Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bb4101db-e645-4e79-9b2e-3de5a3d8a771", "eventTime": "2017-05-26T22:29:09Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIA0G3854OQAXDLNQS5", "expiration": "May 26, 2017 11:29:09 PM", "sessionToken": "FQoDYXdzECAaDGsI8Wqaz79mhrtFfiLMAYT9XIGNe55iFkIjNunxWYW5u7CmFnsZY3NI4SWZe0huD6/DwHl2bL1tSwLXUC67bBUfIbzPK/7K2rLxwzshNygq7UVaocqWu9I8ZTL6hwQe3Fr/iSFqlCr1HiX5EYsf4SpwUiWhSCswtiWMcHihXBdBvppIqQQlq21LUg3AvWyqOi0F8oimYKrC4WR9qjvIcuCXVBBKXOLJ3HoV8ybcYQ7Hi8mRRxXHp3GtMCM4TF0Ef+RV8I53XqY1HSghbo8quN/ihhAWL2wqEYsWBii12KLJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5ac8159d-ea41-4264-a553-fdef6743d5f9", "record_id": "flaws_cloudtrail:0000476:5ac8159d-ea41-4264-a553-fdef6743d5f9", "row_index": 476, "timestamp": "2017-05-26T22:29:10Z", "event_type": "DescribeTags", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA0G3854OQAXDLNQS5", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 985, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5ac8159d-ea41-4264-a553-fdef6743d5f9", "eventTime": "2017-05-26T22:29:10Z", "eventName": "DescribeTags", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA0G3854OQAXDLNQS5", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:29:09Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d6a7b1a4-f2f8-4d94-8507-950c627ef244", "record_id": "flaws_cloudtrail:0000477:d6a7b1a4-f2f8-4d94-8507-950c627ef244", "row_index": 477, "timestamp": "2017-05-26T22:29:10Z", "event_type": "DescribeAddresses", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA0G3854OQAXDLNQS5", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1030, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d6a7b1a4-f2f8-4d94-8507-950c627ef244", "eventTime": "2017-05-26T22:29:10Z", "eventName": "DescribeAddresses", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA0G3854OQAXDLNQS5", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:29:09Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"publicIpsSet": {}, "filterSet": {}, "allocationIdsSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "00594b68-7704-4cf6-866a-75ef817c59a3", "record_id": "flaws_cloudtrail:0000478:00594b68-7704-4cf6-866a-75ef817c59a3", "row_index": 478, "timestamp": "2017-05-26T22:29:11Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "00594b68-7704-4cf6-866a-75ef817c59a3", "eventTime": "2017-05-26T22:29:11Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAHKZ6RJSYWNG9EK29", "expiration": "May 26, 2017 11:29:11 PM", "sessionToken": "FQoDYXdzECAaDKK1XmVFNaylU+nKvSLMAWZY8gMt20pJMq/t/2wQZDRT2c4z4kXp5z2KsZcqz/w8gnxx6ytdoijXc4DsFb8Y9yEPKSVNmMx6hy58xd4Ju3UPZ6zq5xuE5aGmHmpUo5DGgzMhi0eMQt1Z5X1sP5BMBbaNLH4CSnqtzLuGeFTDx4LQoPSOL74kkPw466RQ/G6mRGT6tw3eNzLyUCDGVJ4wl3KKDZyia1x77oNBTsWuZ7iSp0nove62e6KdMiE+3wexqibvLDez11PINTfP7ijEO63QWURfNcUOhXm3/Si32KLJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fd744a04-7e75-4386-a2cd-dcccf540fd47", "record_id": "flaws_cloudtrail:0000479:fd744a04-7e75-4386-a2cd-dcccf540fd47", "row_index": 479, "timestamp": "2017-05-26T22:29:12Z", "event_type": "DescribeAddresses", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAHKZ6RJSYWNG9EK29", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1028, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fd744a04-7e75-4386-a2cd-dcccf540fd47", "eventTime": "2017-05-26T22:29:12Z", "eventName": "DescribeAddresses", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "eu-central-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAHKZ6RJSYWNG9EK29", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:29:11Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"publicIpsSet": {}, "filterSet": {}, "allocationIdsSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7edcc519-c0d4-404a-9388-979c709fc1ae", "record_id": "flaws_cloudtrail:0000480:7edcc519-c0d4-404a-9388-979c709fc1ae", "row_index": 480, "timestamp": "2017-05-26T22:29:12Z", "event_type": "DescribeTags", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAHKZ6RJSYWNG9EK29", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 983, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7edcc519-c0d4-404a-9388-979c709fc1ae", "eventTime": "2017-05-26T22:29:12Z", "eventName": "DescribeTags", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "eu-central-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAHKZ6RJSYWNG9EK29", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:29:11Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0b85a957-6376-42c6-ae97-efda5e1261d5", "record_id": "flaws_cloudtrail:0000481:0b85a957-6376-42c6-ae97-efda5e1261d5", "row_index": 481, "timestamp": "2017-05-26T22:29:12Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0b85a957-6376-42c6-ae97-efda5e1261d5", "eventTime": "2017-05-26T22:29:12Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIA5VIYS84TJX9K02YE", "expiration": "May 26, 2017 11:29:12 PM", "sessionToken": "FQoDYXdzECAaDHA7hYujb1E3crquxiLMAapU9pp1TZHkjQGIQLYY8DVPqO0DlUARMpVYVTJWeAQO0SAPXC3GAbxQk65AOQ16oTGTG1KrAZM2Hk3uTI0gzpISpHFuUbQEDLwcpwRhrB7dEQFNbnSWe/sMUP6p6LxdQHM8HvgaVsf36YbIkVc7RMlbLO7s8owWc7U/Mfv5J4HjC97q9CWv4Oq/oeNjiGczdoMU+NBAnmhRPKoW47WeAGJloBI2vl84hplE8wvcN3Q8U+RgI7Jq9AOlvFMQBPiYwK4NY4XOdqMgvVTP2yi42KLJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6bd7aae8-b28b-4cfd-925b-f0639ce3e995", "record_id": "flaws_cloudtrail:0000482:6bd7aae8-b28b-4cfd-925b-f0639ce3e995", "row_index": 482, "timestamp": "2017-05-26T22:29:13Z", "event_type": "DescribeTags", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA5VIYS84TJX9K02YE", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 979, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6bd7aae8-b28b-4cfd-925b-f0639ce3e995", "eventTime": "2017-05-26T22:29:13Z", "eventName": "DescribeTags", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA5VIYS84TJX9K02YE", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:29:12Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c50f044f-3d73-44dc-a78c-93c10fa8b81e", "record_id": "flaws_cloudtrail:0000483:c50f044f-3d73-44dc-a78c-93c10fa8b81e", "row_index": 483, "timestamp": "2017-05-26T22:29:13Z", "event_type": "DescribeAddresses", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA5VIYS84TJX9K02YE", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1025, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c50f044f-3d73-44dc-a78c-93c10fa8b81e", "eventTime": "2017-05-26T22:29:13Z", "eventName": "DescribeAddresses", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA5VIYS84TJX9K02YE", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:29:12Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"publicIpsSet": {}, "filterSet": {}, "allocationIdsSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a85bfd2b-8eb1-4340-8334-d7c785728b", "record_id": "flaws_cloudtrail:0000484:a85bfd2b-8eb1-4340-8334-d7c785728b", "row_index": 484, "timestamp": "2017-05-26T22:29:13Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1451, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a85bfd2b-8eb1-4340-8334-d7c785728b", "eventTime": "2017-05-26T22:29:13Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIARPCWG77CY2O62N5D", "expiration": "May 26, 2017 11:29:13 PM", "sessionToken": "FQoDYXdzECAaDGW4ZSTsi0mDcGr49iLMAY4yUsBu+I4pxDrCjNV1GtC6RXR37n2wPg0ZXmEMiq9Z6xJpHzAiOsQHb3kCkDQIi5TfsunPDGaWzOQXNaFKLBk5HJD5EtglijbdPV/yz9budBBHYJuXcf2NBRE7gENyR0GTIHmINMhmThmvUsPwCcknO5zjHi62D9E+ZkiADk9PqzJUF8Tt7a/txqMKN7yaCFHPGhVWlgLb3bduLFd0SFhjMHpv6pVTYwgtiWh6NvuyKTH6CO3AN0NfTYm3vqoMMKgsm9oCrkeyYTX4Fii52KLJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "da592c34-5ff5-4d86-a50f-744badcff524", "record_id": "flaws_cloudtrail:0000485:da592c34-5ff5-4d86-a50f-744badcff524", "row_index": 485, "timestamp": "2017-05-26T22:29:14Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 881, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "da592c34-5ff5-4d86-a50f-744badcff524", "eventTime": "2017-05-26T22:29:14Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7ac716668-5eae-42a4-b440-f3661bda92ad", "record_id": "flaws_cloudtrail:0000486:7ac716668-5eae-42a4-b440-f3661bda92ad", "row_index": 486, "timestamp": "2017-05-26T22:29:14Z", "event_type": "DescribeTags", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIARPCWG77CY2O62N5D", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 981, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7ac716668-5eae-42a4-b440-f3661bda92ad", "eventTime": "2017-05-26T22:29:14Z", "eventName": "DescribeTags", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIARPCWG77CY2O62N5D", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:29:13Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7c049f43-9ad7-4f84-b0e7-5f480252de6", "record_id": "flaws_cloudtrail:0000487:7c049f43-9ad7-4f84-b0e7-5f480252de6", "row_index": 487, "timestamp": "2017-05-26T22:29:14Z", "event_type": "DescribeAddresses", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIARPCWG77CY2O62N5D", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1024, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7c049f43-9ad7-4f84-b0e7-5f480252de6", "eventTime": "2017-05-26T22:29:14Z", "eventName": "DescribeAddresses", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIARPCWG77CY2O62N5D", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:29:13Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"publicIpsSet": {}, "filterSet": {}, "allocationIdsSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2318bd59-107a-470f-beff-843bdb884a8e", "record_id": "flaws_cloudtrail:0000488:2318bd59-107a-470f-beff-843bdb884a8e", "row_index": 488, "timestamp": "2017-05-26T22:29:15Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2318bd59-107a-470f-beff-843bdb884a8e", "eventTime": "2017-05-26T22:29:15Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAJGTK6W8G7OJ5MGZX", "expiration": "May 26, 2017 11:29:15 PM", "sessionToken": "FQoDYXdzECAaDFCY5Pyr4amIOPqdZSLMAWhGmm+LaXX84oZPfa5+gjNTrGErr+/p4QLpALSDlYxkkG7LBIEenTOkJz6/Uya/0TSHJPip6NzlkDdstpCxiNW/nW5EfHsGJeqaTE48DVW+BdscYyyjpnrudQZ7HRRhpXl9Ac+xkFEbjmOQO+QIFkhJpfiTCBzaD1AHmPpaZSNcCf7B5jkOSiT24I34Ga4vT+pIWOqkCYcJBOMP0dvhgtcUAvd7iTKgiiiRhzFt3/JtNvUQGKqZXLpm3zhlvThCfJQQu9fo1q3+JgCRaCi72KLJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "60057ae0-7fd4-4ce3-90bc-f3b22e3da26c", "record_id": "flaws_cloudtrail:0000489:60057ae0-7fd4-4ce3-90bc-f3b22e3da26c", "row_index": 489, "timestamp": "2017-05-26T22:29:15Z", "event_type": "DescribeAddresses", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAJGTK6W8G7OJ5MGZX", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1025, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "60057ae0-7fd4-4ce3-90bc-f3b22e3da26c", "eventTime": "2017-05-26T22:29:15Z", "eventName": "DescribeAddresses", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAJGTK6W8G7OJ5MGZX", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:29:15Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"publicIpsSet": {}, "filterSet": {}, "allocationIdsSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "50a407954-1357-45e9-a974-65e009bb0dfb", "record_id": "flaws_cloudtrail:0000490:50a407954-1357-45e9-a974-65e009bb0dfb", "row_index": 490, "timestamp": "2017-05-26T22:29:15Z", "event_type": "DescribeTags", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAJGTK6W8G7OJ5MGZX", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 981, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "50a407954-1357-45e9-a974-65e009bb0dfb", "eventTime": "2017-05-26T22:29:15Z", "eventName": "DescribeTags", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAJGTK6W8G7OJ5MGZX", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:29:15Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a61d7e3d-6c62-46cd-a926-f2456e999dae", "record_id": "flaws_cloudtrail:0000491:a61d7e3d-6c62-46cd-a926-f2456e999dae", "row_index": 491, "timestamp": "2017-05-26T22:29:16Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 881, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a61d7e3d-6c62-46cd-a926-f2456e999dae", "eventTime": "2017-05-26T22:29:16Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/SecurityMokey is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "26480685-641d-40c6-99fe-a5068b0df298", "record_id": "flaws_cloudtrail:0000492:26480685-641d-40c6-99fe-a5068b0df298", "row_index": 492, "timestamp": "2017-05-26T22:30:03Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIASQ4ZTBOL7CW8XXWD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "216.87.202.71", "user_agent": "aws-cli/1.18.69 Python/3.6.0 Linux/4.14.181-140.257.amzn2.x86_64 botocore/1.16.19", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 550, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "26480685-641d-40c6-99fe-a5068b0df298", "eventTime": "2017-05-26T22:30:03Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "216.87.202.71", "userAgent": "aws-cli/1.18.69 Python/3.6.0 Linux/4.14.181-140.257.amzn2.x86_64 botocore/1.16.19", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIASQ4ZTBOL7CW8XXWD", "userName": "SecurityMokey"}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "77a6a01f-7aa3-4dd4-8b55-52557895459e", "record_id": "flaws_cloudtrail:0000493:77a6a01f-7aa3-4dd4-8b55-52557895459e", "row_index": 493, "timestamp": "2017-05-26T22:33:21Z", "event_type": "GetTrailStatus", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIASQ4ZTBOL7CW8XXWD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "216.87.202.71", "user_agent": "aws-cli/1.18.69 Python/3.6.0 Linux/4.14.181-140.257.amzn2.x86_64 botocore/1.16.19", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:cloudtrail:us-east-1:811596193553:trail/trail-5890"], "raw_record_size_bytes": 675, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "resources", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "77a6a01f-7aa3-4dd4-8b55-52557895459e", "eventTime": "2017-05-26T22:33:21Z", "eventName": "GetTrailStatus", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "216.87.202.71", "userAgent": "aws-cli/1.18.69 Python/3.6.0 Linux/4.14.181-140.257.amzn2.x86_64 botocore/1.16.19", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIASQ4ZTBOL7CW8XXWD", "userName": "SecurityMokey"}, "requestParameters": {"name": "trail-5890"}, "resources": [{"ARN": "arn:aws:cloudtrail:us-east-1:811596193553:trail/trail-5890"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0ceb07b7-c702-4556-b71a-ff4a7eb44de8", "record_id": "flaws_cloudtrail:0000494:0ceb07b7-c702-4556-b71a-ff4a7eb44de8", "row_index": 494, "timestamp": "2017-05-26T22:34:51Z", "event_type": "StopLogging", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIASQ4ZTBOL7CW8XXWD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "216.87.202.71", "user_agent": "aws-cli/1.18.69 Python/3.6.0 Linux/4.14.181-140.257.amzn2.x86_64 botocore/1.16.19", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:cloudtrail:us-east-1:811596193553:trail/trail-5890"], "raw_record_size_bytes": 672, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "resources", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0ceb07b7-c702-4556-b71a-ff4a7eb44de8", "eventTime": "2017-05-26T22:34:51Z", "eventName": "StopLogging", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "216.87.202.71", "userAgent": "aws-cli/1.18.69 Python/3.6.0 Linux/4.14.181-140.257.amzn2.x86_64 botocore/1.16.19", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIASQ4ZTBOL7CW8XXWD", "userName": "SecurityMokey"}, "requestParameters": {"name": "trail-5890"}, "resources": [{"ARN": "arn:aws:cloudtrail:us-east-1:811596193553:trail/trail-5890"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0e199900-a857-43c9-916e-01a6ba6889e7", "record_id": "flaws_cloudtrail:0000495:0e199900-a857-43c9-916e-01a6ba6889e7", "row_index": 495, "timestamp": "2017-05-26T22:36:25Z", "event_type": "UpdateTrail", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIASQ4ZTBOL7CW8XXWD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "216.87.202.71", "user_agent": "aws-cli/1.18.69 Python/3.6.0 Linux/4.14.181-140.257.amzn2.x86_64 botocore/1.16.19", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:cloudtrail:us-east-1:811596193553:trail/trail-5890"], "raw_record_size_bytes": 731, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "resources", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0e199900-a857-43c9-916e-01a6ba6889e7", "eventTime": "2017-05-26T22:36:25Z", "eventName": "UpdateTrail", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "216.87.202.71", "userAgent": "aws-cli/1.18.69 Python/3.6.0 Linux/4.14.181-140.257.amzn2.x86_64 botocore/1.16.19", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIASQ4ZTBOL7CW8XXWD", "userName": "SecurityMokey"}, "requestParameters": {"name": "trail-5890", "isMultiRegionTrail": false, "enableLogFileValidation": false}, "resources": [{"ARN": "arn:aws:cloudtrail:us-east-1:811596193553:trail/trail-5890"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "967a09a5-3378-400c-b975-9d9f441850be8", "record_id": "flaws_cloudtrail:0000496:967a09a5-3378-400c-b975-9d9f441850be8", "row_index": 496, "timestamp": "2017-05-26T22:36:27Z", "event_type": "ListAttachedUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 723, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "967a09a5-3378-400c-b975-9d9f441850be8", "eventTime": "2017-05-26T22:36:27Z", "eventName": "ListAttachedUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "requestParameters": {"userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "61554-2b8a-41bb-b31f-4dc4caf4beb1", "record_id": "flaws_cloudtrail:0000497:61554-2b8a-41bb-b31f-4dc4caf4beb1", "row_index": 497, "timestamp": "2017-05-26T22:36:30Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 717, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "61554-2b8a-41bb-b31f-4dc4caf4beb1", "eventTime": "2017-05-26T22:36:30Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "requestParameters": {"maxItems": 1000, "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "67bc3eb8-41f4-46ad-aceb-f1293e6c17e2", "record_id": "flaws_cloudtrail:0000498:67bc3eb8-41f4-46ad-aceb-f1293e6c17e2", "row_index": 498, "timestamp": "2017-05-26T22:36:30Z", "event_type": "ListPolicyVersions", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 767, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "67bc3eb8-41f4-46ad-aceb-f1293e6c17e2", "eventTime": "2017-05-26T22:36:30Z", "eventName": "ListPolicyVersions", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/SecurityMonkey", "maxItems": 1000}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d2490e23-4b92-49a2-9ef5-d039a7d10bac", "record_id": "flaws_cloudtrail:0000499:d2490e23-4b92-49a2-9ef5-d039a7d10bac", "row_index": 499, "timestamp": "2017-05-26T22:36:30Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 766, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d2490e23-4b92-49a2-9ef5-d039a7d10bac", "eventTime": "2017-05-26T22:36:30Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/SecurityMonkey", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8f4a67c3-a248-494c-8a16-e3fcf9be5b7a", "record_id": "flaws_cloudtrail:0000500:8f4a67c3-a248-494c-8a16-e3fcf9be5b7a", "row_index": 500, "timestamp": "2017-05-26T22:36:31Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 766, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8f4a67c3-a248-494c-8a16-e3fcf9be5b7a", "eventTime": "2017-05-26T22:36:31Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/SecurityMonkey", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "560721aee-d1e0-47d3-a98f-39ab513ea61f", "record_id": "flaws_cloudtrail:0000501:560721aee-d1e0-47d3-a98f-39ab513ea61f", "row_index": 501, "timestamp": "2017-05-26T22:36:31Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 767, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "560721aee-d1e0-47d3-a98f-39ab513ea61f", "eventTime": "2017-05-26T22:36:31Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/SecurityMonkey", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "eeaf9936-83e2-4950-917d-dbd831da5d63", "record_id": "flaws_cloudtrail:0000502:eeaf9936-83e2-4950-917d-dbd831da5d63", "row_index": 502, "timestamp": "2017-05-26T22:36:37Z", "event_type": "ListEntitiesForPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 770, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "eeaf9936-83e2-4950-917d-dbd831da5d63", "eventTime": "2017-05-26T22:36:37Z", "eventName": "ListEntitiesForPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/SecurityMonkey", "maxItems": 1000}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "43c268775-1877-494b-86f3-c74a0a119d43", "record_id": "flaws_cloudtrail:0000503:43c268775-1877-494b-86f3-c74a0a119d43", "row_index": 503, "timestamp": "2017-05-26T22:37:34Z", "event_type": "ListUsers", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAO8MA6UJF8K96KCZD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 697, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "43c268775-1877-494b-86f3-c74a0a119d43", "eventTime": "2017-05-26T22:37:34Z", "eventName": "ListUsers", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAO8MA6UJF8K96KCZD", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-05-26T16:12:49Z"}}}, "requestParameters": {"maxItems": 1000}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3c4477cc-c6f9-4424-b406-b8da6d49282", "record_id": "flaws_cloudtrail:0000504:3c4477cc-c6f9-4424-b406-b8da6d49282", "row_index": 504, "timestamp": "2017-05-26T22:38:34Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1453, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3c4477cc-c6f9-4424-b406-b8da6d49282", "eventTime": "2017-05-26T22:38:34Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "expiration": "May 26, 2017 11:38:34 PM", "sessionToken": "FQoDYXdzECAaDIo6G/ZqSMzfKCfUMiLMATb4+L4rifDRgHq/vKso17HvPHBfYRjyeccJeXojpn7CWytZpa2PXpY9dI9oM4lCulxSL2Qq9wIa0kkxmIZ6HZVBbfxVNEknrnDqr0CNjQoQ1QamNzHMYk+Sk+tgqA7M+emXhhJd37Ed33bHrslWT5/bbYJ4quQVdriuZJ+r4LFXcrO3fiu1Vs/6DQVnJ/wVyVsqphuMEk9ORoklUBZsC/22ADjUkXzxfF4izrS5XtXIyAwxTRbVauuH6Hfi+YfQ1uXyV6PjZNJ167N6Pijq3KLJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fc0b5190-7053-4e67-b209-73a7f3e621f8", "record_id": "flaws_cloudtrail:0000505:fc0b5190-7053-4e67-b209-73a7f3e621f8", "row_index": 505, "timestamp": "2017-05-26T22:38:34Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1449, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fc0b5190-7053-4e67-b209-73a7f3e621f8", "eventTime": "2017-05-26T22:38:34Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAJDVNQJPZYGWS9K0N", "expiration": "May 26, 2017 11:38:34 PM", "sessionToken": "FQoDYXdzECAaDPZH/SC6IxgDJ7paLCLMAaWmGrGF9VvdstrRtC7psO7fC14+DjJcge+I+eInkv+jI2Bb//dQRFjEy9pgT3LRfK2i9ZFGXNbXaETbTjsB1GL50sPYeAsl0/uwWp/o9dZMB9cpPkuvds7Xm2bfBSg9IPEnsDv2h7kloPwTEjodvuPAQnZjc6iHzC/6P6QiVOBDcZXtuvnrEdjwStkJBPYkzfOFlJT0HmNEMCuBk92npJhFOI7kocL0bj+X6ugZh6b3OEqLyzOM7NL67gIz+8nIGprI4Zd2o/n8j5Z4uCjq3KLJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "60b0753b-00f9-43c6-b1dd-a6aec9ccd366", "record_id": "flaws_cloudtrail:0000506:60b0753b-00f9-43c6-b1dd-a6aec9ccd366", "row_index": 506, "timestamp": "2017-05-26T22:38:34Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAJDVNQJPZYGWS9K0N", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 977, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "60b0753b-00f9-43c6-b1dd-a6aec9ccd366", "eventTime": "2017-05-26T22:38:34Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-west-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAJDVNQJPZYGWS9K0N", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4f02d962-1019-4ea6-8581-7c6eb884b26f", "record_id": "flaws_cloudtrail:0000507:4f02d962-1019-4ea6-8581-7c6eb884b26f", "row_index": 507, "timestamp": "2017-05-26T22:38:35Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1120, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4f02d962-1019-4ea6-8581-7c6eb884b26f", "eventTime": "2017-05-26T22:38:35Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/service-role/AWSLambdaBasicExecutionRole-b6ab3a24-1aa4-4855-94d4-40cdef59ec5b", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6219c361-860b-4b8c-8587-cb040a2d92db", "record_id": "flaws_cloudtrail:0000508:6219c361-860b-4b8c-8587-cb040a2d92db", "row_index": 508, "timestamp": "2017-05-26T22:38:35Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1119, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6219c361-860b-4b8c-8587-cb040a2d92db", "eventTime": "2017-05-26T22:38:35Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"marker": "ACp+HkUaqzRRAtcocya1bo5goe1I8auN6qGgKZ47IL6n+ZLO2eoDG7xuLbaI44RzqyBkB2bz3wAvq9w/IGrpUsKmz97Y5m3qxK1kfPBTC4Cmbg==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a2eaa7be-1157-493c-9911-7c52ad240322", "record_id": "flaws_cloudtrail:0000509:a2eaa7be-1157-493c-9911-7c52ad240322", "row_index": 509, "timestamp": "2017-05-26T22:38:35Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1119, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a2eaa7be-1157-493c-9911-7c52ad240322", "eventTime": "2017-05-26T22:38:35Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"marker": "AC+tPR9KYFJ/LOuKLDfjck/dYrkBlpltn+2AQhakX4uKL4ZRio3XUHybtdKuNhjelfbqTY9E6I340kwXyIR9kyjjilnAlp9jIrZ/bA3Vf+g96A==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ef70792-bf27-4fd6-9eef-7610d913ef12", "record_id": "flaws_cloudtrail:0000510:ef70792-bf27-4fd6-9eef-7610d913ef12", "row_index": 510, "timestamp": "2017-05-26T22:38:35Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 995, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ef70792-bf27-4fd6-9eef-7610d913ef12", "eventTime": "2017-05-26T22:38:35Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d2981c9a-3843-4319-b465-67d6825ffe62", "record_id": "flaws_cloudtrail:0000511:d2981c9a-3843-4319-b465-67d6825ffe62", "row_index": 511, "timestamp": "2017-05-26T22:38:35Z", "event_type": "GetTrailStatus", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAHDIGBYVNC85SMCTH", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1040, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d2981c9a-3843-4319-b465-67d6825ffe62", "eventTime": "2017-05-26T22:38:35Z", "eventName": "GetTrailStatus", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAHDIGBYVNC85SMCTH", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:35Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"name": "arn:aws:cloudtrail:us-west-2:811596193553:trail/cloudtrail"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e30a14c2-acfa-4d7b-b089-0e0b9c5d18ce", "record_id": "flaws_cloudtrail:0000512:e30a14c2-acfa-4d7b-b089-0e0b9c5d18ce", "row_index": 512, "timestamp": "2017-05-26T22:38:35Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAHDIGBYVNC85SMCTH", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 975, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e30a14c2-acfa-4d7b-b089-0e0b9c5d18ce", "eventTime": "2017-05-26T22:38:35Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAHDIGBYVNC85SMCTH", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:35Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "77e62ef8-ba0f-4301-9ab4-8f042550b1cb1", "record_id": "flaws_cloudtrail:0000513:77e62ef8-ba0f-4301-9ab4-8f042550b1cb1", "row_index": 513, "timestamp": "2017-05-26T22:38:35Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1455, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "77e62ef8-ba0f-4301-9ab4-8f042550b1cb1", "eventTime": "2017-05-26T22:38:35Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAHDIGBYVNC85SMCTH", "expiration": "May 26, 2017 11:38:35 PM", "sessionToken": "FQoDYXdzECAaDIyHJC42Q3tAo0Xx6yLMAWiU7UeBuXS/9ozgAR0FTmGkOHtBspljBUTsH72uxMKj+U/O/fjUVOmoDTltDpYgZuxPMQn3C6QlXhnFWAfevYK30JB11L2eTFBn6Hl1wbS2IPAjb2cZI8shOjBWPWklMUcc7Tu21KeCCwZH7BhyIJ/WGl30Whk6T6YQnT3NVc5iRxOxNx727jJDEtdASuVRy5yozIkcolN8vyK/KoekqhYrtbENtaaL98EQ88esk+vQdwbkqPtvmJ4UaqBHH9k+sHD/TEQnT/+FPmCp0ijr3KLJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "948c92e8-36bd-4a84-a812-ecc87736f188", "record_id": "flaws_cloudtrail:0000514:948c92e8-36bd-4a84-a812-ecc87736f188", "row_index": 514, "timestamp": "2017-05-26T22:38:35Z", "event_type": "GetTrailStatus", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAJDVNQJPZYGWS9K0N", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1042, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "948c92e8-36bd-4a84-a812-ecc87736f188", "eventTime": "2017-05-26T22:38:35Z", "eventName": "GetTrailStatus", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-west-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAJDVNQJPZYGWS9K0N", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"name": "arn:aws:cloudtrail:us-west-2:811596193553:trail/cloudtrail"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f69b5fed-9403-4192-9829-e957578afb99d", "record_id": "flaws_cloudtrail:0000515:f69b5fed-9403-4192-9829-e957578afb99d", "row_index": 515, "timestamp": "2017-05-26T22:38:36Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAQZ9EJOPSU298VAZK", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 983, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f69b5fed-9403-4192-9829-e957578afb99d", "eventTime": "2017-05-26T22:38:36Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAQZ9EJOPSU298VAZK", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:36Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4f0272de-787e-44f4-9d29-f6f33b28de15", "record_id": "flaws_cloudtrail:0000516:4f0272de-787e-44f4-9d29-f6f33b28de15", "row_index": 516, "timestamp": "2017-05-26T22:38:36Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1050, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4f0272de-787e-44f4-9d29-f6f33b28de15", "eventTime": "2017-05-26T22:38:36Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/Level3", "versionId": "v10"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a9bf882d-4d17-43f1-b2c1-96e6ccf01da2", "record_id": "flaws_cloudtrail:0000517:a9bf882d-4d17-43f1-b2c1-96e6ccf01da2", "row_index": 517, "timestamp": "2017-05-26T22:38:36Z", "event_type": "ListEntitiesForPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1060, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a9bf882d-4d17-43f1-b2c1-96e6ccf01da2", "eventTime": "2017-05-26T22:38:36Z", "eventName": "ListEntitiesForPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"entityFilter": "Group", "policyArn": "arn:aws:iam::811596193553:policy/Level3"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5b5db2c7-afc4-47d2-89a0-3c3c88f4a22d", "record_id": "flaws_cloudtrail:0000518:5b5db2c7-afc4-47d2-89a0-3c3c88f4a22d", "row_index": 518, "timestamp": "2017-05-26T22:38:36Z", "event_type": "ListEntitiesForPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1059, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5b5db2c7-afc4-47d2-89a0-3c3c88f4a22d", "eventTime": "2017-05-26T22:38:36Z", "eventName": "ListEntitiesForPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"entityFilter": "Role", "policyArn": "arn:aws:iam::811596193553:policy/Level3"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a99eee7b-16a6-4d2c-b46f-3ca1fe775513", "record_id": "flaws_cloudtrail:0000519:a99eee7b-16a6-4d2c-b46f-3ca1fe775513", "row_index": 519, "timestamp": "2017-05-26T22:38:36Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 989, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a99eee7b-16a6-4d2c-b46f-3ca1fe775513", "eventTime": "2017-05-26T22:38:36Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d611942-2a01-48bd-a32e-c16d8a599291", "record_id": "flaws_cloudtrail:0000520:d611942-2a01-48bd-a32e-c16d8a599291", "row_index": 520, "timestamp": "2017-05-26T22:38:36Z", "event_type": "ListEntitiesForPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1058, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d611942-2a01-48bd-a32e-c16d8a599291", "eventTime": "2017-05-26T22:38:36Z", "eventName": "ListEntitiesForPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"entityFilter": "User", "policyArn": "arn:aws:iam::811596193553:policy/Level3"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b1ef92f0-e8bf-4650-b2c8-23b80231b", "record_id": "flaws_cloudtrail:0000521:b1ef92f0-e8bf-4650-b2c8-23b80231b", "row_index": 521, "timestamp": "2017-05-26T22:38:36Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1117, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b1ef92f0-e8bf-4650-b2c8-23b80231b", "eventTime": "2017-05-26T22:38:36Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/service-role/AWSLambdaBasicExecutionRole-4e23caa8-1f82-45b5-9068-3200fb1a0c7a", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dff52d5b-d2ac-4b93-a8c1-a9d9ffc1d19e", "record_id": "flaws_cloudtrail:0000522:dff52d5b-d2ac-4b93-a8c1-a9d9ffc1d19e", "row_index": 522, "timestamp": "2017-05-26T22:38:36Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1119, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dff52d5b-d2ac-4b93-a8c1-a9d9ffc1d19e", "eventTime": "2017-05-26T22:38:36Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/service-role/AWSLambdaBasicExecutionRole-d306bccd-4ecb-4557-a96f-9dbc7460dddc", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "812003c8-3ae2-47b8-8db2-541aab55dfd1", "record_id": "flaws_cloudtrail:0000523:812003c8-3ae2-47b8-8db2-541aab55dfd1", "row_index": 523, "timestamp": "2017-05-26T22:38:36Z", "event_type": "ListEntitiesForPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1131, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "812003c8-3ae2-47b8-8db2-541aab55dfd1", "eventTime": "2017-05-26T22:38:36Z", "eventName": "ListEntitiesForPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"entityFilter": "Group", "policyArn": "arn:aws:iam::811596193553:policy/service-role/AWSLambdaBasicExecutionRole-d306bccd-4ecb-4557-a96f-9dbc7460dddc"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a5e1fde9-1b20-46bb-8fe7-cfaf5e8b20aa", "record_id": "flaws_cloudtrail:0000524:a5e1fde9-1b20-46bb-8fe7-cfaf5e8b20aa", "row_index": 524, "timestamp": "2017-05-26T22:38:36Z", "event_type": "GetRole", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 989, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a5e1fde9-1b20-46bb-8fe7-cfaf5e8b20aa", "eventTime": "2017-05-26T22:38:36Z", "eventName": "GetRole", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"roleName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d411bf57-ce89-4a28-bcf7-e7d8d4566a71", "record_id": "flaws_cloudtrail:0000525:d411bf57-ce89-4a28-bcf7-e7d8d4566a71", "row_index": 525, "timestamp": "2017-05-26T22:38:36Z", "event_type": "ListEntitiesForPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1130, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d411bf57-ce89-4a28-bcf7-e7d8d4566a71", "eventTime": "2017-05-26T22:38:36Z", "eventName": "ListEntitiesForPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"entityFilter": "Role", "policyArn": "arn:aws:iam::811596193553:policy/service-role/AWSLambdaBasicExecutionRole-d306bccd-4ecb-4557-a96f-9dbc7460dddc"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d872a187-d612-4d12-b39f-b1fea56f2880", "record_id": "flaws_cloudtrail:0000526:d872a187-d612-4d12-b39f-b1fea56f2880", "row_index": 526, "timestamp": "2017-05-26T22:38:36Z", "event_type": "ListEntitiesForPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1130, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d872a187-d612-4d12-b39f-b1fea56f2880", "eventTime": "2017-05-26T22:38:36Z", "eventName": "ListEntitiesForPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"entityFilter": "User", "policyArn": "arn:aws:iam::811596193553:policy/service-role/AWSLambdaBasicExecutionRole-d306bccd-4ecb-4557-a96f-9dbc7460dddc"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "123bcff3-38db-44f6-a44a-8c7297872d8f", "record_id": "flaws_cloudtrail:0000527:123bcff3-38db-44f6-a44a-8c7297872d8f", "row_index": 527, "timestamp": "2017-05-26T22:38:36Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "123bcff3-38db-44f6-a44a-8c7297872d8f", "eventTime": "2017-05-26T22:38:36Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAQZ9EJOPSU298VAZK", "expiration": "May 26, 2017 11:38:36 PM", "sessionToken": "FQoDYXdzECAaDPetb7PaK3jFD+VVGyLMAaNuH3yFv0TeCT8Ibq0JMONxkCBvIuQbQ7T/GVTz4jGpzYI8gnrjMmXuXxfJX89xHpkpCPZEJBDBQlXDyz3Vwcj7L0wrG/JlzNe+YvO9uZJYlo9xocKYP8mH8LTvaxwvxCUZcqtYHCur1tSCOnowYjuSIX5jb/MMwI3ubI4wy6TKtAeNsM6W/iLqRBsik0+Vz95Fxif6QrK/fnDyw2EV1GyuVqAYZIPqsPZBcXK02k0zqNwgNNQu5UtPFTvkPg8VazCD6tfgH1z5j4ICbCjs3KLJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e552dc37-e5d3-40c7-9362-4a95f86670", "record_id": "flaws_cloudtrail:0000528:e552dc37-e5d3-40c7-9362-4a95f86670", "row_index": 528, "timestamp": "2017-05-26T22:38:37Z", "event_type": "GetTrailStatus", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAQZ9EJOPSU298VAZK", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1045, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e552dc37-e5d3-40c7-9362-4a95f86670", "eventTime": "2017-05-26T22:38:37Z", "eventName": "GetTrailStatus", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAQZ9EJOPSU298VAZK", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:36Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"name": "arn:aws:cloudtrail:us-west-2:811596193553:trail/cloudtrail"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fe41123a-b92f-4ed9-8c97-498c73b695086", "record_id": "flaws_cloudtrail:0000529:fe41123a-b92f-4ed9-8c97-498c73b695086", "row_index": 529, "timestamp": "2017-05-26T22:38:37Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1062, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fe41123a-b92f-4ed9-8c97-498c73b695086", "eventTime": "2017-05-26T22:38:37Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/AmazonGlacierReadOnlyAccess", "versionId": "v2"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4609e49c-f745-42ae-bf17-cac82d864cfe", "record_id": "flaws_cloudtrail:0000530:4609e49c-f745-42ae-bf17-cac82d864cfe", "row_index": 530, "timestamp": "2017-05-26T22:38:37Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1064, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4609e49c-f745-42ae-bf17-cac82d864cfe", "eventTime": "2017-05-26T22:38:37Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/AWSDirectConnectReadOnlyAccess", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "26af3aa9-1e93-4aa5-aecf-875d4eb0a0ec", "record_id": "flaws_cloudtrail:0000531:26af3aa9-1e93-4aa5-aecf-875d4eb0a0ec", "row_index": 531, "timestamp": "2017-05-26T22:38:37Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1057, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "26af3aa9-1e93-4aa5-aecf-875d4eb0a0ec", "eventTime": "2017-05-26T22:38:37Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/SecurityMonkey", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "acf9767d-8c27-4cda-9fbc-81a738fe2f56", "record_id": "flaws_cloudtrail:0000532:acf9767d-8c27-4cda-9fbc-81a738fe2f56", "row_index": 532, "timestamp": "2017-05-26T22:38:37Z", "event_type": "ListEntitiesForPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1068, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "acf9767d-8c27-4cda-9fbc-81a738fe2f56", "eventTime": "2017-05-26T22:38:37Z", "eventName": "ListEntitiesForPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"entityFilter": "Group", "policyArn": "arn:aws:iam::811596193553:policy/SecurityMonkey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5461b0a2-d148-47db-8889-564da0bd13d0", "record_id": "flaws_cloudtrail:0000533:5461b0a2-d148-47db-8889-564da0bd13d0", "row_index": 533, "timestamp": "2017-05-26T22:38:37Z", "event_type": "ListEntitiesForPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5461b0a2-d148-47db-8889-564da0bd13d0", "eventTime": "2017-05-26T22:38:37Z", "eventName": "ListEntitiesForPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"entityFilter": "Role", "policyArn": "arn:aws:iam::811596193553:policy/SecurityMonkey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "65060d8-d036-4935-8039-4fca55be1c44", "record_id": "flaws_cloudtrail:0000534:65060d8-d036-4935-8039-4fca55be1c44", "row_index": 534, "timestamp": "2017-05-26T22:38:37Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 995, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "65060d8-d036-4935-8039-4fca55be1c44", "eventTime": "2017-05-26T22:38:37Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"userName": "SecurityMokey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1d4c89f2-1e88-405d-aaec-c4f0f0bb08ac", "record_id": "flaws_cloudtrail:0000535:1d4c89f2-1e88-405d-aaec-c4f0f0bb08ac", "row_index": 535, "timestamp": "2017-05-26T22:38:37Z", "event_type": "ListEntitiesForPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1067, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1d4c89f2-1e88-405d-aaec-c4f0f0bb08ac", "eventTime": "2017-05-26T22:38:37Z", "eventName": "ListEntitiesForPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"entityFilter": "User", "policyArn": "arn:aws:iam::811596193553:policy/SecurityMonkey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2a381be9-b3cc-47df-a474-371496799332", "record_id": "flaws_cloudtrail:0000536:2a381be9-b3cc-47df-a474-371496799332", "row_index": 536, "timestamp": "2017-05-26T22:38:37Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1059, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2a381be9-b3cc-47df-a474-371496799332", "eventTime": "2017-05-26T22:38:37Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways", "versionId": "v4"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "35e8435e-66d7-4594-844d-75cebc326da6", "record_id": "flaws_cloudtrail:0000537:35e8435e-66d7-4594-844d-75cebc326da6", "row_index": 537, "timestamp": "2017-05-26T22:38:37Z", "event_type": "ListEntitiesForPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1070, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "35e8435e-66d7-4594-844d-75cebc326da6", "eventTime": "2017-05-26T22:38:37Z", "eventName": "ListEntitiesForPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"entityFilter": "Group", "policyArn": "arn:aws:iam::811596193553:policy/list_apigateways"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "388ff488-a8b4-4309-9337-509e1d8c4382", "record_id": "flaws_cloudtrail:0000538:388ff488-a8b4-4309-9337-509e1d8c4382", "row_index": 538, "timestamp": "2017-05-26T22:38:37Z", "event_type": "ListEntitiesForPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1069, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "388ff488-a8b4-4309-9337-509e1d8c4382", "eventTime": "2017-05-26T22:38:37Z", "eventName": "ListEntitiesForPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"entityFilter": "Role", "policyArn": "arn:aws:iam::811596193553:policy/list_apigateways"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d86d7f67-3a26-460b-ad59-05efd411debb", "record_id": "flaws_cloudtrail:0000539:d86d7f67-3a26-460b-ad59-05efd411debb", "row_index": 539, "timestamp": "2017-05-26T22:38:37Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 989, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d86d7f67-3a26-460b-ad59-05efd411debb", "eventTime": "2017-05-26T22:38:37Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9548ab13-cd14-493c-97c6-7e0e882a4e8b", "record_id": "flaws_cloudtrail:0000540:9548ab13-cd14-493c-97c6-7e0e882a4e8b", "row_index": 540, "timestamp": "2017-05-26T22:38:37Z", "event_type": "ListEntitiesForPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1070, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9548ab13-cd14-493c-97c6-7e0e882a4e8b", "eventTime": "2017-05-26T22:38:37Z", "eventName": "ListEntitiesForPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"entityFilter": "User", "policyArn": "arn:aws:iam::811596193553:policy/list_apigateways"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fa851df4-3d7d-4e31-9151-c19c88a98240", "record_id": "flaws_cloudtrail:0000541:fa851df4-3d7d-4e31-9151-c19c88a98240", "row_index": 541, "timestamp": "2017-05-26T22:38:37Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1455, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fa851df4-3d7d-4e31-9151-c19c88a98240", "eventTime": "2017-05-26T22:38:37Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAN5Z8VLS88A4TTGUP", "expiration": "May 26, 2017 11:38:37 PM", "sessionToken": "FQoDYXdzECAaDJJJOaODraCqSPbu7yLMAWUfgVfT73oSO/giZ7Bp/RI0YQVyN455MlbQ7ew0r987jQ6Zd9RMx6eET0ivxgPucxbopUNgRUtazsg5q6Rf66JbAfte3hlNlNzWJnETsgoamSzB619rcPSoIiw8PshuRcjFkho+1Y8rtCjqO+SmWLL/xWNejmLJx7O34LGnBfeedItqAbVo4tksuSci91G+hwYQODxBkLxds4fiCBLUlDeOuSNoev4dNhQUvj+efq4sGvKGUqXSttAvVHhJ40iDDbKbuY19e/wkMLhk0Cjt3KLJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "001ac688-2492-4627-85f4-9e44bf140fe3", "record_id": "flaws_cloudtrail:0000542:001ac688-2492-4627-85f4-9e44bf140fe3", "row_index": 542, "timestamp": "2017-05-26T22:38:38Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAN5Z8VLS88A4TTGUP", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 982, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "001ac688-2492-4627-85f4-9e44bf140fe3", "eventTime": "2017-05-26T22:38:38Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAN5Z8VLS88A4TTGUP", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:37Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7564dcc0-47a0-4648-b012-ad230ff34235", "record_id": "flaws_cloudtrail:0000543:7564dcc0-47a0-4648-b012-ad230ff34235", "row_index": 543, "timestamp": "2017-05-26T22:38:38Z", "event_type": "GetTrailStatus", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAN5Z8VLS88A4TTGUP", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1047, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7564dcc0-47a0-4648-b012-ad230ff34235", "eventTime": "2017-05-26T22:38:38Z", "eventName": "GetTrailStatus", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAN5Z8VLS88A4TTGUP", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:37Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"name": "arn:aws:cloudtrail:us-west-2:811596193553:trail/cloudtrail"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "53de8dec-7c04-4b14-a34a-1038423e0ca0", "record_id": "flaws_cloudtrail:0000544:53de8dec-7c04-4b14-a34a-1038423e0ca0", "row_index": 544, "timestamp": "2017-05-26T22:38:38Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1053, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "53de8dec-7c04-4b14-a34a-1038423e0ca0", "eventTime": "2017-05-26T22:38:38Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/AmazonEC2FullAccess", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "67e568f1-6f01-4f8c-835e-7d46e03412a0", "record_id": "flaws_cloudtrail:0000545:67e568f1-6f01-4f8c-835e-7d46e03412a0", "row_index": 545, "timestamp": "2017-05-26T22:38:38Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1053, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "67e568f1-6f01-4f8c-835e-7d46e03412a0", "eventTime": "2017-05-26T22:38:38Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/AmazonRDSFullAccess", "versionId": "v2"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9cf56de1-9551-46b5-9579-a92cf0b6c8a6", "record_id": "flaws_cloudtrail:0000546:9cf56de1-9551-46b5-9579-a92cf0b6c8a6", "row_index": 546, "timestamp": "2017-05-26T22:38:38Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1053, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9cf56de1-9551-46b5-9579-a92cf0b6c8a6", "eventTime": "2017-05-26T22:38:38Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/AWSHealthFullAccess", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cb5d70c2-2538-4f75-8530-12c379d315506", "record_id": "flaws_cloudtrail:0000547:cb5d70c2-2538-4f75-8530-12c379d315506", "row_index": 547, "timestamp": "2017-05-26T22:38:38Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1068, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cb5d70c2-2538-4f75-8530-12c379d315506", "eventTime": "2017-05-26T22:38:38Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/service-role/AWSQuickSightListIAM", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cdbc1171-ac10-41a5-9915-565f50410e93", "record_id": "flaws_cloudtrail:0000548:cdbc1171-ac10-41a5-9915-565f50410e93", "row_index": 548, "timestamp": "2017-05-26T22:38:38Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1070, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cdbc1171-ac10-41a5-9915-565f50410e93", "eventTime": "2017-05-26T22:38:38Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/service-role/AmazonDMSRedshiftS3Role", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "246622f-0938-4afd-afc9-00de836e92e1", "record_id": "flaws_cloudtrail:0000549:246622f-0938-4afd-afc9-00de836e92e1", "row_index": 549, "timestamp": "2017-05-26T22:38:38Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1065, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "246622f-0938-4afd-afc9-00de836e92e1", "eventTime": "2017-05-26T22:38:38Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/AutoScalingConsoleReadOnlyAccess", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cd3ca967-4c1f-4ed0-9dae-821e77ef5ef9", "record_id": "flaws_cloudtrail:0000550:cd3ca967-4c1f-4ed0-9dae-821e77ef5ef9", "row_index": 550, "timestamp": "2017-05-26T22:38:38Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1058, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cd3ca967-4c1f-4ed0-9dae-821e77ef5ef9", "eventTime": "2017-05-26T22:38:38Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/AWSMarketplaceFullAccess", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "00ba985e-f7be-40bc-bd96-d314186edc", "record_id": "flaws_cloudtrail:0000551:00ba985e-f7be-40bc-bd96-d314186edc", "row_index": 551, "timestamp": "2017-05-26T22:38:38Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1070, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "00ba985e-f7be-40bc-bd96-d314186edc", "eventTime": "2017-05-26T22:38:38Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/service-role/AWSQuicksightAthenaAccess", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fbeee4d7-3019-4ba9-8be6-36277aea30b1", "record_id": "flaws_cloudtrail:0000552:fbeee4d7-3019-4ba9-8be6-36277aea30b1", "row_index": 552, "timestamp": "2017-05-26T22:38:38Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1063, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fbeee4d7-3019-4ba9-8be6-36277aea30b1", "eventTime": "2017-05-26T22:38:38Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/AWSCertificateManagerReadOnly", "versionId": "v2"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b12a3b54-9b0d-4465-8d0d-b79d3d3d598b", "record_id": "flaws_cloudtrail:0000553:b12a3b54-9b0d-4465-8d0d-b79d3d3d598b", "row_index": 553, "timestamp": "2017-05-26T22:38:38Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1067, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b12a3b54-9b0d-4465-8d0d-b79d3d3d598b", "eventTime": "2017-05-26T22:38:38Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/AWSElasticBeanstalkReadOnlyAccess", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ba89219b-4be9-4a94-a524-40283fc1fb98", "record_id": "flaws_cloudtrail:0000554:ba89219b-4be9-4a94-a524-40283fc1fb98", "row_index": 554, "timestamp": "2017-05-26T22:38:38Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1058, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ba89219b-4be9-4a94-a524-40283fc1fb98", "eventTime": "2017-05-26T22:38:38Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/job-function/SupportUser", "versionId": "v2"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "523795c-c672-4e51-b859-f6c79c71a931", "record_id": "flaws_cloudtrail:0000555:523795c-c672-4e51-b859-f6c79c71a931", "row_index": 555, "timestamp": "2017-05-26T22:38:39Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1056, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "523795c-c672-4e51-b859-f6c79c71a931", "eventTime": "2017-05-26T22:38:39Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/AWSCodeCommitFullAccess", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "47085c-728d-4ecb-b6b2-c49481", "record_id": "flaws_cloudtrail:0000556:47085c-728d-4ecb-b6b2-c49481", "row_index": 556, "timestamp": "2017-05-26T22:38:39Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1048, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "47085c-728d-4ecb-b6b2-c49481", "eventTime": "2017-05-26T22:38:39Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/AWSCodeCommitPowerUser", "versionId": "v3"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1fd04125-84db-46d9-a9df-04645f312185", "record_id": "flaws_cloudtrail:0000557:1fd04125-84db-46d9-a9df-04645f312185", "row_index": 557, "timestamp": "2017-05-26T22:38:39Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1060, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1fd04125-84db-46d9-a9df-04645f312185", "eventTime": "2017-05-26T22:38:39Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/service-role/AWSIoTLogging", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fc430de6-0e5d-4490-b285-fb92210c7cb", "record_id": "flaws_cloudtrail:0000558:fc430de6-0e5d-4490-b285-fb92210c7cb", "row_index": 558, "timestamp": "2017-05-26T22:38:39Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1056, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fc430de6-0e5d-4490-b285-fb92210c7cb", "eventTime": "2017-05-26T22:38:39Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/AmazonInspectorFullAccess", "versionId": "v2"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a00623e4-a987-4048-9e9d-c4eabcd12a5f", "record_id": "flaws_cloudtrail:0000559:a00623e4-a987-4048-9e9d-c4eabcd12a5f", "row_index": 559, "timestamp": "2017-05-26T22:38:39Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1073, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a00623e4-a987-4048-9e9d-c4eabcd12a5f", "eventTime": "2017-05-26T22:38:39Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/IAMSelfManageServiceSpecificCredentials", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1daceb4f-9d82-4d8b-a3c4-b11f0a024af0", "record_id": "flaws_cloudtrail:0000560:1daceb4f-9d82-4d8b-a3c4-b11f0a024af0", "row_index": 560, "timestamp": "2017-05-26T22:38:39Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1daceb4f-9d82-4d8b-a3c4-b11f0a024af0", "eventTime": "2017-05-26T22:38:39Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM", "versionId": "v3"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fbe3501c-2656-4b4b-8e2b-1026d5d5fc19", "record_id": "flaws_cloudtrail:0000561:fbe3501c-2656-4b4b-8e2b-1026d5d5fc19", "row_index": 561, "timestamp": "2017-05-26T22:38:39Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1053, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fbe3501c-2656-4b4b-8e2b-1026d5d5fc19", "eventTime": "2017-05-26T22:38:39Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/AWSLambdaFullAccess", "versionId": "v7"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f722501-42d3-4aef-854c-957265f98184", "record_id": "flaws_cloudtrail:0000562:f722501-42d3-4aef-854c-957265f98184", "row_index": 562, "timestamp": "2017-05-26T22:38:39Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1061, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f722501-42d3-4aef-854c-957265f98184", "eventTime": "2017-05-26T22:38:39Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/service-role/AWSCloudHSMRole", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5647c152-df62-4e63-8638-4709e8b32aad", "record_id": "flaws_cloudtrail:0000563:5647c152-df62-4e63-8638-4709e8b32aad", "row_index": 563, "timestamp": "2017-05-26T22:38:39Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1053, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5647c152-df62-4e63-8638-4709e8b32aad", "eventTime": "2017-05-26T22:38:39Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/AmazonSQSFullAccess", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c02ccfa5-988d-4eb2-943c-70a2986e6e96", "record_id": "flaws_cloudtrail:0000564:c02ccfa5-988d-4eb2-943c-70a2986e6e96", "row_index": 564, "timestamp": "2017-05-26T22:38:39Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1048, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c02ccfa5-988d-4eb2-943c-70a2986e6e96", "eventTime": "2017-05-26T22:38:39Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/IAMFullAccess", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cb893f8a-9bdb-4870-8ac8-f092fb49013", "record_id": "flaws_cloudtrail:0000565:cb893f8a-9bdb-4870-8ac8-f092fb49013", "row_index": 565, "timestamp": "2017-05-26T22:38:39Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1446, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cb893f8a-9bdb-4870-8ac8-f092fb49013", "eventTime": "2017-05-26T22:38:39Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIA5ZST7H45UXFIRQIR", "expiration": "May 26, 2017 11:38:39 PM", "sessionToken": "FQoDYXdzECAaDAq5YJT0B59nLnLaXSLMAQMQr3n0y+kJpN9cLHXjzpCXWNzq2KLlWYeYTi3wGSl0oDdLoe+CNALt9lKhvMXigw2QVo1+IPWVAdG69fVLm5fBb9Q8U24NSpXXJSkIUgTZBwIVddCcEWxw+6ZcKGCn0iaO/Gbl0d41nCfjoxf9zhLiBYibN9McSp4Ok0Lq7EnurWTPtqfO3YBDyHlEtpR7LmRfiQ2NwMQa0iWoV5Z+mv96DXVwppNDvkyGWm4Jz92iwbq6nwoqDEXN+7km/Lyeh/neOp6i2Rddw5mbNSjv3KLJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "54e9425e-9dd4-4334-85ee-45138fbb2f33", "record_id": "flaws_cloudtrail:0000566:54e9425e-9dd4-4334-85ee-45138fbb2f33", "row_index": 566, "timestamp": "2017-05-26T22:38:40Z", "event_type": "GetTrailStatus", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA5ZST7H45UXFIRQIR", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1042, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "54e9425e-9dd4-4334-85ee-45138fbb2f33", "eventTime": "2017-05-26T22:38:40Z", "eventName": "GetTrailStatus", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "sa-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA5ZST7H45UXFIRQIR", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:39Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"name": "arn:aws:cloudtrail:us-west-2:811596193553:trail/cloudtrail"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b40cdd94-23a3-44c5-8086-5b17f8c6bea1", "record_id": "flaws_cloudtrail:0000567:b40cdd94-23a3-44c5-8086-5b17f8c6bea1", "row_index": 567, "timestamp": "2017-05-26T22:38:40Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA5ZST7H45UXFIRQIR", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 977, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b40cdd94-23a3-44c5-8086-5b17f8c6bea1", "eventTime": "2017-05-26T22:38:40Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "sa-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA5ZST7H45UXFIRQIR", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:39Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "471fd97c-30a1-4a4e-bd7b-90c1edd342c9", "record_id": "flaws_cloudtrail:0000568:471fd97c-30a1-4a4e-bd7b-90c1edd342c9", "row_index": 568, "timestamp": "2017-05-26T22:38:40Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1454, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "471fd97c-30a1-4a4e-bd7b-90c1edd342c9", "eventTime": "2017-05-26T22:38:40Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIA4FTMJPUR53X1XGKF", "expiration": "May 26, 2017 11:38:40 PM", "sessionToken": "FQoDYXdzECAaDKRYsqqtWRH7nTmEPyLMATNA14e9qZ4MUCX+6fjef/8oxvXmnJ6aeJcBwk/OSqp7rpMxB/01LdLyJb0uM29CU4ZWTqWucMCo7r24+7IE6am7mSIA/yAet4Gey1GEcHY8xajGmd5jNzJbIH/BBahsKMZO+QrobBzBWTd/vz3xTY/YRG0XDT680ScORFvHDp5LHVQS+83pEq5HPbfGUTAhvklxlm3z6Z3pqWC7TUyhcp5WNQKZthUoJCrALC6+0ztZpaFrezv2s1fAfGwppSyA3Gcfh75IVGxvMjL+Cyjw3KLJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6c86d3fd-3aee-49a2-94f3-74a1dbcb4958", "record_id": "flaws_cloudtrail:0000569:6c86d3fd-3aee-49a2-94f3-74a1dbcb4958", "row_index": 569, "timestamp": "2017-05-26T22:38:40Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1062, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6c86d3fd-3aee-49a2-94f3-74a1dbcb4958", "eventTime": "2017-05-26T22:38:40Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/AWSAgentlessDiscoveryService", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c35b60d4-6f84-466e-80f3-256041c9d3fd0", "record_id": "flaws_cloudtrail:0000570:c35b60d4-6f84-466e-80f3-256041c9d3fd0", "row_index": 570, "timestamp": "2017-05-26T22:38:40Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1057, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c35b60d4-6f84-466e-80f3-256041c9d3fd0", "eventTime": "2017-05-26T22:38:40Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/AWSXrayWriteOnlyAccess", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8dd7aa0e-1cc9-47db-b90b-03f062513323", "record_id": "flaws_cloudtrail:0000571:8dd7aa0e-1cc9-47db-b90b-03f062513323", "row_index": 571, "timestamp": "2017-05-26T22:38:40Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1059, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8dd7aa0e-1cc9-47db-b90b-03f062513323", "eventTime": "2017-05-26T22:38:40Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/AutoScalingReadOnlyAccess", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d2bab14c-2b07-49b9-abda-32dfb8e9b8f0", "record_id": "flaws_cloudtrail:0000572:d2bab14c-2b07-49b9-abda-32dfb8e9b8f0", "row_index": 572, "timestamp": "2017-05-26T22:38:40Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1055, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d2bab14c-2b07-49b9-abda-32dfb8e9b8f0", "eventTime": "2017-05-26T22:38:40Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/AutoScalingFullAccess", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "450be555-fc8b-49f2-839b-b90bc894032e", "record_id": "flaws_cloudtrail:0000573:450be555-fc8b-49f2-839b-b90bc894032e", "row_index": 573, "timestamp": "2017-05-26T22:38:40Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1076, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "450be555-fc8b-49f2-839b-b90bc894032e", "eventTime": "2017-05-26T22:38:40Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforAWSCodeDeploy", "versionId": "v2"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "27d15195-8348-46c0-9ea0-e78ed7c84df0", "record_id": "flaws_cloudtrail:0000574:27d15195-8348-46c0-9ea0-e78ed7c84df0", "row_index": 574, "timestamp": "2017-05-26T22:38:40Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1055, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "27d15195-8348-46c0-9ea0-e78ed7c84df0", "eventTime": "2017-05-26T22:38:40Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/AWSMobileHub_ReadOnly", "versionId": "v6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8f661877f-24d1-4e74-98ec-d6d92050b41b", "record_id": "flaws_cloudtrail:0000575:8f661877f-24d1-4e74-98ec-d6d92050b41b", "row_index": 575, "timestamp": "2017-05-26T22:38:40Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1092, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8f661877f-24d1-4e74-98ec-d6d92050b41b", "eventTime": "2017-05-26T22:38:40Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/service-role/CloudWatchEventsBuiltInTargetExecutionAccess", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3f82578a-0456-49d4-9ce3-8d743c292b21", "record_id": "flaws_cloudtrail:0000576:3f82578a-0456-49d4-9ce3-8d743c292b21", "row_index": 576, "timestamp": "2017-05-26T22:38:40Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1068, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3f82578a-0456-49d4-9ce3-8d743c292b21", "eventTime": "2017-05-26T22:38:40Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/AmazonCloudDirectoryReadOnlyAccess", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "196afaa2-1e4e-4a35-b7d2-b5f461cd3857", "record_id": "flaws_cloudtrail:0000577:196afaa2-1e4e-4a35-b7d2-b5f461cd3857", "row_index": 577, "timestamp": "2017-05-26T22:38:40Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1055, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "196afaa2-1e4e-4a35-b7d2-b5f461cd3857", "eventTime": "2017-05-26T22:38:40Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/AWSOpsWorksFullAccess", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4352c6d4-f77f-4589-96e6-67e49f073d73", "record_id": "flaws_cloudtrail:0000578:4352c6d4-f77f-4589-96e6-67e49f073d73", "row_index": 578, "timestamp": "2017-05-26T22:38:40Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4352c6d4-f77f-4589-96e6-67e49f073d73", "eventTime": "2017-05-26T22:38:40Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/AWSOpsWorksCMInstanceProfileRole", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0ba2b81f-20e7-40c1-97a4-65f26961c97", "record_id": "flaws_cloudtrail:0000579:0ba2b81f-20e7-40c1-97a4-65f26961c97", "row_index": 579, "timestamp": "2017-05-26T22:38:40Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1057, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0ba2b81f-20e7-40c1-97a4-65f26961c97", "eventTime": "2017-05-26T22:38:40Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/AmazonElastiCacheFullAccess", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e2bfbd0e-0fb8-47c6-98d6-4714b015c1bf", "record_id": "flaws_cloudtrail:0000580:e2bfbd0e-0fb8-47c6-98d6-4714b015c1bf", "row_index": 580, "timestamp": "2017-05-26T22:38:41Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA4FTMJPUR53X1XGKF", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 979, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e2bfbd0e-0fb8-47c6-98d6-4714b015c1bf", "eventTime": "2017-05-26T22:38:41Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA4FTMJPUR53X1XGKF", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:40Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b0e30ee0-c769-49eb-a381-42870bb4958c", "record_id": "flaws_cloudtrail:0000581:b0e30ee0-c769-49eb-a381-42870bb4958c", "row_index": 581, "timestamp": "2017-05-26T22:38:41Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1061, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b0e30ee0-c769-49eb-a381-42870bb4958c", "eventTime": "2017-05-26T22:38:41Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/AWSCodePipelineApproverAccess", "versionId": "v2"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b208ecff-d751-41e6-895a-b2a80c580fc7", "record_id": "flaws_cloudtrail:0000582:b208ecff-d751-41e6-895a-b2a80c580fc7", "row_index": 582, "timestamp": "2017-05-26T22:38:41Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1067, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b208ecff-d751-41e6-895a-b2a80c580fc7", "eventTime": "2017-05-26T22:38:41Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/AWSApplicationDiscoveryAgentAccess", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "70fd4e9e-3fdc-4eb2-9048-1307c8a4b71e", "record_id": "flaws_cloudtrail:0000583:70fd4e9e-3fdc-4eb2-9048-1307c8a4b71e", "row_index": 583, "timestamp": "2017-05-26T22:38:41Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1061, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "70fd4e9e-3fdc-4eb2-9048-1307c8a4b71e", "eventTime": "2017-05-26T22:38:41Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/job-function/ViewOnlyAccess", "versionId": "v2"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8c9b06ca-3dd1-48f6-891c-6d1d81c6c443", "record_id": "flaws_cloudtrail:0000584:8c9b06ca-3dd1-48f6-891c-6d1d81c6c443", "row_index": 584, "timestamp": "2017-05-26T22:38:41Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1073, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8c9b06ca-3dd1-48f6-891c-6d1d81c6c443", "eventTime": "2017-05-26T22:38:41Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/service-role/AmazonElasticMapReduceRole", "versionId": "v7"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "101d390a-55ea-4a29-be99-1dd28ad81d61", "record_id": "flaws_cloudtrail:0000585:101d390a-55ea-4a29-be99-1dd28ad81d61", "row_index": 585, "timestamp": "2017-05-26T22:38:41Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1068, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "101d390a-55ea-4a29-be99-1dd28ad81d61", "eventTime": "2017-05-26T22:38:41Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/AmazonRoute53DomainsReadOnlyAccess", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "be7f4af2-2f15-43b3-afd2-e926dbc2edb8", "record_id": "flaws_cloudtrail:0000586:be7f4af2-2f15-43b3-afd2-e926dbc2edb8", "row_index": 586, "timestamp": "2017-05-26T22:38:41Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1062, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "be7f4af2-2f15-43b3-afd2-e926dbc2edb8", "eventTime": "2017-05-26T22:38:41Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/service-role/AWSOpsWorksRole", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9f4804f3-f02a-4c01-bdba-e548188aee48", "record_id": "flaws_cloudtrail:0000587:9f4804f3-f02a-4c01-bdba-e548188aee48", "row_index": 587, "timestamp": "2017-05-26T22:38:41Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1093, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9f4804f3-f02a-4c01-bdba-e548188aee48", "eventTime": "2017-05-26T22:38:41Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/service-role/ApplicationAutoScalingForAmazonAppStreamAccess", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "89026ac5-61b9-4ec9-9049-70aec1b9c37c", "record_id": "flaws_cloudtrail:0000588:89026ac5-61b9-4ec9-9049-70aec1b9c37c", "row_index": 588, "timestamp": "2017-05-26T22:38:41Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1070, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "89026ac5-61b9-4ec9-9049-70aec1b9c37c", "eventTime": "2017-05-26T22:38:41Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "281a73d1-2674-489e-b2d4-280c6596e05d", "record_id": "flaws_cloudtrail:0000589:281a73d1-2674-489e-b2d4-280c6596e05d", "row_index": 589, "timestamp": "2017-05-26T22:38:41Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1059, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "281a73d1-2674-489e-b2d4-280c6596e05d", "eventTime": "2017-05-26T22:38:41Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/SimpleWorkflowFullAccess", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d5ea659a-ac9d-4db8-9673-2e2d2e482a64", "record_id": "flaws_cloudtrail:0000590:d5ea659a-ac9d-4db8-9673-2e2d2e482a64", "row_index": 590, "timestamp": "2017-05-26T22:38:41Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1052, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d5ea659a-ac9d-4db8-9673-2e2d2e482a64", "eventTime": "2017-05-26T22:38:41Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/AmazonS3FullAccess", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a5b332e9-4b50-467e-8ead-ef7a540c1153", "record_id": "flaws_cloudtrail:0000591:a5b332e9-4b50-467e-8ead-ef7a540c1153", "row_index": 591, "timestamp": "2017-05-26T22:38:41Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1065, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a5b332e9-4b50-467e-8ead-ef7a540c1153", "eventTime": "2017-05-26T22:38:41Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/AWSStorageGatewayReadOnlyAccess", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "50192d91-2ebe-4483-987e-436a8978526d", "record_id": "flaws_cloudtrail:0000592:50192d91-2ebe-4483-987e-436a8978526d", "row_index": 592, "timestamp": "2017-05-26T22:38:42Z", "event_type": "GetTrailStatus", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIA4FTMJPUR53X1XGKF", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1044, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "50192d91-2ebe-4483-987e-436a8978526d", "eventTime": "2017-05-26T22:38:42Z", "eventName": "GetTrailStatus", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIA4FTMJPUR53X1XGKF", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:40Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"name": "arn:aws:cloudtrail:us-west-2:811596193553:trail/cloudtrail"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "171197f-4c76-4756-b282-568bdfefb67b", "record_id": "flaws_cloudtrail:0000593:171197f-4c76-4756-b282-568bdfefb67b", "row_index": 593, "timestamp": "2017-05-26T22:38:42Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "account_id": "811596193553", "principal_id": "AIDAQ9SRE1SZZZ4Q4UOJH", "user_name": "SecurityMokey", "access_key_id": "AKIAXJ0III4JBKZDXGXN", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/SecurityMonkey"], "raw_record_size_bytes": 1453, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "171197f-4c76-4756-b282-568bdfefb67b", "eventTime": "2017-05-26T22:38:42Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDAQ9SRE1SZZZ4Q4UOJH", "arn": "arn:aws:iam::811596193553:user/SecurityMokey", "accountId": "811596193553", "accessKeyId": "AKIAXJ0III4JBKZDXGXN", "userName": "SecurityMokey"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/SecurityMonkey", "roleSessionName": "secmonkey"}, "responseElements": {"credentials": {"accessKeyId": "ASIAXNN74RRO6CLU4YK5", "expiration": "May 26, 2017 11:38:42 PM", "sessionToken": "FQoDYXdzECAaDLqCoDX2DYhsrYOykSLMAWGZ7zsem8e3mUz/GL2Ya0ZXaI6u2E2ZBAoskbrJ5CpRHSrZLiBei7C3l+5FLis0+rexRIe5zIwuTGhRItAGtisQBEQNF66gkzp8LsxFBNFDYRFzTR9d0fsYVnPmXSHPl1BMzEbb5ZMF9K4+KKVkAHQM9Hw89Sr6aGMiISHsJ04p8afCFTlISVDMg3VxHi8Q3hDeHHrXXaCbv7v8o9SH6i3RFG8fTRiFG14G778HzfMbhAqOpYVc5Wfq4ZXeRIKiqkgIZz3lliw/y08gySjy3KLJBQ=="}, "assumedRoleUser": {"assumedRoleId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "517f206b-5e7e-4307-a1bf-c7099fb6dc99", "record_id": "flaws_cloudtrail:0000594:517f206b-5e7e-4307-a1bf-c7099fb6dc99", "row_index": 594, "timestamp": "2017-05-26T22:38:42Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1054, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "517f206b-5e7e-4307-a1bf-c7099fb6dc99", "eventTime": "2017-05-26T22:38:42Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/job-function/Billing", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3c5ae2c5-902a-4f7d-a124-17972f2676", "record_id": "flaws_cloudtrail:0000595:3c5ae2c5-902a-4f7d-a124-17972f2676", "row_index": 595, "timestamp": "2017-05-26T22:38:42Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3c5ae2c5-902a-4f7d-a124-17972f2676", "eventTime": "2017-05-26T22:38:42Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly", "versionId": "v2"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1f58c160-0957-4cec-9e04-e1d9d7ee8c39", "record_id": "flaws_cloudtrail:0000596:1f58c160-0957-4cec-9e04-e1d9d7ee8c39", "row_index": 596, "timestamp": "2017-05-26T22:38:42Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1079, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1f58c160-0957-4cec-9e04-e1d9d7ee8c39", "eventTime": "2017-05-26T22:38:42Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/service-role/AmazonElasticMapReduceforEC2Role", "versionId": "v2"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "45a9c779-d0dc-4865-ac5b-9bb2011a2b8f", "record_id": "flaws_cloudtrail:0000597:45a9c779-d0dc-4865-ac5b-9bb2011a2b8f", "row_index": 597, "timestamp": "2017-05-26T22:38:42Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1068, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "45a9c779-d0dc-4865-ac5b-9bb2011a2b8f", "eventTime": "2017-05-26T22:38:42Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/job-function/DatabaseAdministrator", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9acc062b-c07a-4b34-83ca-d400b7619331", "record_id": "flaws_cloudtrail:0000598:9acc062b-c07a-4b34-83ca-d400b7619331", "row_index": 598, "timestamp": "2017-05-26T22:38:42Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1062, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9acc062b-c07a-4b34-83ca-d400b7619331", "eventTime": "2017-05-26T22:38:42Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/AmazonRedshiftReadOnlyAccess", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7a0883d3-5cd0-453e-8024-0f35c04fd395", "record_id": "flaws_cloudtrail:0000599:7a0883d3-5cd0-453e-8024-0f35c04fd395", "row_index": 599, "timestamp": "2017-05-26T22:38:42Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1057, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7a0883d3-5cd0-453e-8024-0f35c04fd395", "eventTime": "2017-05-26T22:38:42Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5bd53feb-a8ed-4430-a911-053c9c5bcaee", "record_id": "flaws_cloudtrail:0000600:5bd53feb-a8ed-4430-a911-053c9c5bcaee", "row_index": 600, "timestamp": "2017-05-26T22:38:42Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1055, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5bd53feb-a8ed-4430-a911-053c9c5bcaee", "eventTime": "2017-05-26T22:38:42Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/AWSXrayReadOnlyAccess", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9b29ea1a-8dcb-4f50-a3c6-f0cadf5be643", "record_id": "flaws_cloudtrail:0000601:9b29ea1a-8dcb-4f50-a3c6-f0cadf5be643", "row_index": 601, "timestamp": "2017-05-26T22:38:42Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1080, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9b29ea1a-8dcb-4f50-a3c6-f0cadf5be643", "eventTime": "2017-05-26T22:38:42Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/service-role/AWSElasticBeanstalkEnhancedHealth", "versionId": "v2"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1262e569-1bc5-4e07-bc92-69bb1711c578", "record_id": "flaws_cloudtrail:0000602:1262e569-1bc5-4e07-bc92-69bb1711c578", "row_index": 602, "timestamp": "2017-05-26T22:38:42Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1070, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1262e569-1bc5-4e07-bc92-69bb1711c578", "eventTime": "2017-05-26T22:38:42Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/AmazonElasticMapReduceReadOnlyAccess", "versionId": "v2"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "44854c-2d63-4e5c-a536-592ca929551d", "record_id": "flaws_cloudtrail:0000603:44854c-2d63-4e5c-a536-592ca929551d", "row_index": 603, "timestamp": "2017-05-26T22:38:42Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1065, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "44854c-2d63-4e5c-a536-592ca929551d", "eventTime": "2017-05-26T22:38:42Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/AWSDirectoryServiceReadOnlyAccess", "versionId": "v3"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "115fdd7b-cbce-4d33-b6ec-6f7d93d4fb19", "record_id": "flaws_cloudtrail:0000604:115fdd7b-cbce-4d33-b6ec-6f7d93d4fb19", "row_index": 604, "timestamp": "2017-05-26T22:38:42Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "account_id": "811596193553", "principal_id": "AROAUB2AA5FQRGAHITW4A:secmonkey", "user_name": null, "access_key_id": "ASIAPIMHDTOEF7V3EVOB", "session_issuer_arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "session_issuer_user_name": "SecurityMonkey"}, "network": {"source_ip": "255.253.125.115", "user_agent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1054, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "115fdd7b-cbce-4d33-b6ec-6f7d93d4fb19", "eventTime": "2017-05-26T22:38:42Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Boto3/1.4.4 Python/2.7.12 Linux/4.4.0-78-generic Botocore/1.5.56 Resource", "awsRegion": "us-east-1", "userIdentity": {"type": "AssumedRole", "principalId": "AROAUB2AA5FQRGAHITW4A:secmonkey", "arn": "arn:aws:sts::811596193553:assumed-role/SecurityMonkey/secmonkey", "accountId": "811596193553", "accessKeyId": "ASIAPIMHDTOEF7V3EVOB", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-05-26T22:38:34Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAUB2AA5FQRGAHITW4A", "arn": "arn:aws:iam::811596193553:role/SecurityMonkey", "accountId": "811596193553", "userName": "SecurityMonkey"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/AmazonVPCReadOnlyAccess", "versionId": "v4"}, "resources": []}}